Possible to decompile DLL written in C?

Question

I want to decompile a DLL that I believe was written in C. How can I do this?

Answer 1

Short answer: you can't.

Long answer: The compilation process for C/C++ is very lossy. The compiler makes a whole lot of high and low level optimizations to your code, and the resulting assembly code more often than not resembles nothing of your original code. Furthermore there are different compilers in the market (and each has several different active versions), which each generate the output a little differently. Without knowledge of which compiler was used the task of decompiling becomes even more hopeless. At the best I've heard of some tools that can give you some partial decompilation, with bits of C code recognized here and there, but you're still going to have to read through a lot of assembly code to make sense of it.

That's by the way one of the reasons why copy protections on software are difficult to crack and require special assembly skills.

Answer 2

It is possible, but extremely difficult and will take ginormous amount of time even if you're pretty well versed in C, assembly and the intricacies of the operating system where this code is supposed to work.

The problem is, optimization makes compiled code hardly recognizable/understandable for humans.

Further, there will be ambiguities if the disassembler loses information (e.g. the same instruction can be encoded in different ways and if the rest of the code depends on a particular encoding which many disassemblers (or their users) fail to take into account, the resultant disassembly becomes incomplete or incorrect).

Self-modifying code complicates the matters as well.

See in this question more on the topic and available tools.

Answer 3

You can, but only up to a certain extent:

1. Optimizations could change the code
2. Symbols might have been stripped (DLL allows to refer to functions residing inside via index instead of symbol)
3. Some instruction combinations might not be convertible to C
4. and some other things I might forget...