FIG_DEC · An interactive simulation

Inside a Decompiler

A decompiler turns bytes into code you can read. Break the machine to see which parts are facts and which are guesses. Strip the symbols. Switch the decoder. Watch the ledger.

Run
Setup
Look

Press step 1. The machine reads one small program, one step at a time.

7F 45 4C 46ELF64 · LSBREL · X86-64.SYMTABDECODE · 16 BYTESOBSDERINFUNK

StageReady
Instructions0
Blocks0
Names and typesnone yet
Unknowns0
Evidence0 observed
Steps0

The big ideaA decompiler only ever reads bytes. Every station after the bytes adds a claim, and the ledger keeps what the bytes showed apart from what the machine guessed.

What the machine shows

Every stage feeds the next. The header gives the sections, the sections give the bytes, the decoder gives the instructions, and the graph gives the shape. A mistake at one station rides on the carriage to every later station.

Bytes do not say which bytes are code. Recursive descent follows the jumps. Linear sweep decodes every byte. On the data-in-code program, the sweep reads four data bytes as instructions and misses the real instruction at 0x14.

Symbols carry names, not meaning. Strip them and the logic of the function stays the same, but the name, the size and the end become unknowns. The parameter names were never in the file.

Pseudocode is a claim. The ledger keeps what the bytes showed apart from what the machine inferred. Lesson 36 proves a candidate equal by running it and rebuilding it.

Build every station from scratch.

Start with the ELF reader Read the RE 101 manual