# RetDec — Retargetable Machine-Code Decompiler

> An LLVM-based retargetable decompiler that translates machine code from multiple architectures into readable C-like source code.

## Install

Save as a script file and run:

# RetDec — Retargetable Machine-Code Decompiler

## Quick Use

```bash
# Install RetDec from pre-built packages (Ubuntu/Debian)
# Download the latest release from GitHub releases page
wget https://github.com/avast/retdec/releases/download/v5.0/RetDec-v5.0-Linux-Release.tar.xz
tar xf RetDec-v5.0-Linux-Release.tar.xz
export PATH="$PWD/retdec/bin:$PATH"

# Decompile a binary to C source
retdec-decompiler input_binary

# Decompile with a specific architecture
retdec-decompiler -a arm input_binary.bin
```

## Introduction

RetDec is an open-source, retargetable machine-code decompiler developed originally by Avast and built on the LLVM infrastructure. It converts executable binaries from multiple architectures into human-readable C-like source code without requiring the original source. RetDec supports a wide range of file formats and processor architectures, making it a versatile tool for malware analysis and reverse engineering.

## What RetDec Does

- Decompiles machine code from x86, x64, ARM, MIPS, PIC32, and PowerPC architectures into C source
- Processes ELF, PE, Mach-O, COFF, Intel HEX, and raw binary file formats
- Recovers function signatures, data types, and control flow structures from stripped binaries
- Generates call graphs, control flow graphs, and other visual representations of program structure
- Provides both a standalone command-line tool and a C++ library API for integration

## Architecture Overview

RetDec uses a multi-stage pipeline built on LLVM. The frontend lifts architecture-specific machine code into LLVM IR (intermediate representation) through architecture-specific instruction decoders. The middle layer applies a series of LLVM optimization and analysis passes that recover high-level constructs: loops, conditionals, switch statements, data types, and function prototypes. A signature database helps identify known library functions in stripped binaries. The backend then translates the optimized LLVM IR into C source code, applying formatting and variable naming heuristics to improve readability.

## Self-Hosting & Configuration

- Download pre-built packages from the GitHub releases page for Linux, macOS, or Windows
- Build from source requires CMake 3.14+, a C++17 compiler, and LLVM development libraries
- Use the `--select-ranges` and `--select-functions` flags to decompile specific code regions
- Configure output options including generation of call graphs and control flow graphs
- The RetDec IDA plugin integrates decompilation directly into the IDA Pro disassembler

## Key Features

- Architecture-independent decompilation through LLVM IR as a universal intermediate form
- Static detection of compiler and packer signatures for identifying known binary transformations
- Library function identification using signature databases for common C runtime and system libraries
- Support for decompiling position-independent code and shared libraries
- IDA Pro and Radare2 plugin integrations for use within established reverse engineering workflows

## Comparison with Similar Tools

- **Ghidra Decompiler**: Integrated into the Ghidra RE suite with interactive refinement; RetDec is a standalone decompiler with LLVM-based analysis suitable for batch processing
- **Hex-Rays (IDA Pro)**: The industry-standard commercial decompiler with high-quality output; RetDec is free and open-source with broader architecture retargetability
- **angr/decompiler**: Part of the angr binary analysis platform focused on research; RetDec provides a more mature decompilation output aimed at readability
- **Snowman**: A lightweight open-source decompiler; RetDec offers broader architecture support and more sophisticated type recovery through LLVM

## FAQ

**Q: What architectures does RetDec support for decompilation?**
A: RetDec supports x86 (32-bit), x86-64, ARM (32-bit), ARM64 (AArch64), MIPS, PIC32, and PowerPC. Architecture support is extensible through the LLVM-based frontend.

**Q: Can RetDec handle packed or obfuscated binaries?**
A: RetDec includes a static unpacker for common packers like UPX. For other packers, the binary should be unpacked first before decompilation.

**Q: Is RetDec still actively maintained after Avast?**
A: The project is open-source under the MIT license on GitHub. Community contributions continue, though the pace of development has changed since the original Avast team.

**Q: How does RetDec compare to Ghidra for batch decompilation?**
A: RetDec is designed as a command-line tool well suited for automated batch processing. Ghidra can also run in headless mode but is primarily designed for interactive analysis.

## Sources

- Repository: https://github.com/avast/retdec
- Documentation: https://retdec.com/documentation/

---
Source: https://tokrepo.com/en/workflows/asset-221ccd64
Author: Script Depot