3

I have spent the past several hours attempting to install a decompiler with no success. Since I've recently been using radare2 as a disassembler, I figured using the associated decompiler package would work well. After finding out that radeco and radeco-lib aren't currently stable enough to build, I used their package manager r2pm to finally install the r2snow BASH script in ~/.local/share/radare2/prefix/bin.

But now I cannot figure out how to run it to decompile a binary! The error message I receive is: "Usage: r2 -i '.!r2snow'". I know that r2 is shorthand for radare2, and the -i flag is to pass a script file to run, but I've tried passing it the r2snow BASH script in multiple ways with no success.

Does anyone with experience using this particular decompiler know how to properly invoke it? Normally I could figure this out myself, but the lack of proper documentation has proved too difficult.

I kid you not, every time you invoke the program improperly, it taunts you. Most recently: "Usage: r2 -i '.!r2snow'" -- This should be documented, since it's not that obvious. Maybe I should try a different decompiler altogether. Are there any free decompilers out there which are easier to set up?

TimD1
  • 982
  • 15
  • 26

1 Answers1

4

To install radare2 plugins you should start with:

$ r2pm init
$ r2pm update

Then install your desired plugin using r2pm:

$ r2pm -i r2snow

You might get this error:

ERROR: Build failed. You probably need 'brew install cartr/qt4/qt' and 'brew install boost' or 'sudo apt-get install libboost-dev libqt4-dev'

So simply install the missing libraries:

$ sudo apt-get install libboost-dev libqt4-dev'

Then, you can call r2snow from wihtin r2 shell via !r2snow or from outside like r2 -i '.!r2snow' /bin/ls

Instead of r2snow, I'd suggest using r2dec or r2retdec.

To install r2dec:

$ r2pm -i r2dec

And then simply use pdd:

$ r2 -A my_file
...
[0x00000540]> s main
[0x000006a4]> pdd
int32_t main () {
    /* arg1 */
    *(local_14h) = edi;
    /* arg2 */
    *(local_20h) = rsi;
    esi = 7;
    edi = 0x61;
    print_it (*(local_20h), *(local_14h));
    esi = 0x11;
    edi = 0x6b;
    print_it (edi, esi);
    *(local_4h) = 5;
    edx = *(local_4h);
    eax = edx;
    eax += eax;
    eax += edx;
    *(local_4h) = eax;
    eax = *(local_4h);
    edi = eax;
    dumb_function (edi);
    esi = 9;
    edi = 0x62;
    print_it (edi, esi);
    eax = 0;
    return eax;
}

To install r2retdec:

$ r2pm -i r2retdec

Make sure to have npm installed and follow the instructions in the repository. After you installed it, use $dec from within r2 shell.

Megabeets
  • 1,378
  • 11
  • 19
  • Thanks, but after installing exactly as mentioned, whenever I try `r2 -i '.!r2snow' /bin/ls`, I get `Script '.!r2snow' not found.`. I'll try `r2dec` now. – TimD1 Jul 22 '18 at 14:40
  • Great, `r2dec` works for me! Is there any option to decompile an entire binary, instead of a specific function? – TimD1 Jul 22 '18 at 14:45
  • Nope, it is not design for such purpose. Anyway, r2dec is a pseudo decompiler, try making r2retdec work for the best decompilation experience – Megabeets Jul 22 '18 at 14:47