RetDec — Retargetable Machine-Code Decompiler

Introduction

RetDec is an open-source, retargetable machine-code decompiler developed originally by Avast and built on the LLVM infrastructure. It converts executable binaries from multiple architectures into human-readable C-like source code without requiring the original source. RetDec supports a wide range of file formats and processor architectures, making it a versatile tool for malware analysis and reverse engineering.

What RetDec Does

• Decompiles machine code from x86, x64, ARM, MIPS, PIC32, and PowerPC architectures into C source
• Processes ELF, PE, Mach-O, COFF, Intel HEX, and raw binary file formats
• Recovers function signatures, data types, and control flow structures from stripped binaries
• Generates call graphs, control flow graphs, and other visual representations of program structure
• Provides both a standalone command-line tool and a C++ library API for integration

Architecture Overview

RetDec uses a multi-stage pipeline built on LLVM. The frontend lifts architecture-specific machine code into LLVM IR (intermediate representation) through architecture-specific instruction decoders. The middle layer applies a series of LLVM optimization and analysis passes that recover high-level constructs: loops, conditionals, switch statements, data types, and function prototypes. A signature database helps identify known library functions in stripped binaries. The backend then translates the optimized LLVM IR into C source code, applying formatting and variable naming heuristics to improve readability.

Self-Hosting & Configuration

• Download pre-built packages from the GitHub releases page for Linux, macOS, or Windows
• Build from source requires CMake 3.14+, a C++17 compiler, and LLVM development libraries
• Use the --select-ranges and --select-functions flags to decompile specific code regions
• Configure output options including generation of call graphs and control flow graphs
• The RetDec IDA plugin integrates decompilation directly into the IDA Pro disassembler

Key Features

• Architecture-independent decompilation through LLVM IR as a universal intermediate form
• Static detection of compiler and packer signatures for identifying known binary transformations
• Library function identification using signature databases for common C runtime and system libraries
• Support for decompiling position-independent code and shared libraries
• IDA Pro and Radare2 plugin integrations for use within established reverse engineering workflows

Comparison with Similar Tools

• Ghidra Decompiler: Integrated into the Ghidra RE suite with interactive refinement; RetDec is a standalone decompiler with LLVM-based analysis suitable for batch processing
• Hex-Rays (IDA Pro): The industry-standard commercial decompiler with high-quality output; RetDec is free and open-source with broader architecture retargetability
• angr/decompiler: Part of the angr binary analysis platform focused on research; RetDec provides a more mature decompilation output aimed at readability
• Snowman: A lightweight open-source decompiler; RetDec offers broader architecture support and more sophisticated type recovery through LLVM

FAQ

Q: What architectures does RetDec support for decompilation? A: RetDec supports x86 (32-bit), x86-64, ARM (32-bit), ARM64 (AArch64), MIPS, PIC32, and PowerPC. Architecture support is extensible through the LLVM-based frontend.

Q: Can RetDec handle packed or obfuscated binaries? A: RetDec includes a static unpacker for common packers like UPX. For other packers, the binary should be unpacked first before decompilation.

Q: Is RetDec still actively maintained after Avast? A: The project is open-source under the MIT license on GitHub. Community contributions continue, though the pace of development has changed since the original Avast team.

Q: How does RetDec compare to Ghidra for batch decompilation? A: RetDec is designed as a command-line tool well suited for automated batch processing. Ghidra can also run in headless mode but is primarily designed for interactive analysis.

Sources

• Repository: https://github.com/avast/retdec
• Documentation: https://retdec.com/documentation/