Decompiler Output

Investigation Methodology

1. Read Assembly Line by Line

Trace register values:

• mov eax, 5 → EAX = 5
• add eax, 3 → EAX = 8
• sub eax, 1 → EAX = 7
• imul eax, eax, 4 → EAX = 7 * 4 = 28
• cmp eax, 28 → 28 - 28 = 0 → ZF = 1
• jne fail → ZF=1 → NOT taken
• Fall through: mov ebx, 1 → EBX = 1
• ret → return 1 (success)

2. Map to High-Level Logic

The decompiler shows:

int check() {
    int x = ((5 + 3) - 1) * 4;
    if (x == 28) return 1;
    return 0;
}

3. Verify Decompiler Accuracy

• Check: Does decompiler match assembly control flow?
• Check: Are constants correct? (28 = literal)
• Check: Are variable names meaningful? (x, result)
• Check: Is branch direction correct? (jne = jump if NOT equal)

4. Common Decompiler Artifacts

• Goto statements: Irreducible control flow
• Stack variables: local_8, local_10 → rename based on use
• Type inference: May guess wrong (int vs pointer, signed vs unsigned)
• Inlined functions: May appear as straight-line code
• Optimized patterns: lea for multiply, xor for zero, etc.

5. Cross-Reference Assembly ↔ Pseudocode

• Click variable in decompiler → highlights in assembly
• Click instruction in assembly → highlights in decompiler
• Use this bidirectional navigation to verify