What is decompilation?


Software decompilation is the process of reverse engineering a compiled software program to recover its source code or a representation close to the original source code. In other words, it involves translating the machine code or bytecode of a compiled program back into a higher-level programming language like C or Java.

The Compilation Process

Software development typically involves writing code in a high-level programming language like C, C++, Java, etc. The high-level source code is then compiled into machine code or intermediate code (bytecode), depending on the programming language.

What is Decompilation

Decompilation is the reverse process. It starts with the compiled machine code or intermediate code, and the goal is to recover a representation of the original source code. Decompilers are tools designed to perform this task. They analyze the binary code and attempt to reconstruct the higher-level code that was used to generate it.

Some Challenges in Decompilation

Decompilation is a challenging task because the compiled code lacks certain high-level constructs, variable names, and comments present in the original source code.

Optimization techniques used during compilation may further complicate the decompilation process.

Software protection techniques, as described below, are commonly employed by legitimate programs and malware alike, and complicate even more the decompilation process.

The Output of a Decompiler

The output of a decompiler is not always an exact replica of the original source code. It might be a close approximation, and in some cases, it might not be as readable or maintainable as the original code. (In some rare cases, it may be cleaner than the original code, but a reverser is unlikely to verify that!)

Interactive Decompilation

An interactive decompiler such as JEB produces output that is interactive and actionable via a graphical user interface (GUI) and application programming interfaces (API).

Use Cases

Decompilation can be used for various purposes, such as understanding and debugging software, analyzing malware, auditing closed-source programs, or recovering lost source code.

Software protection

Software protection techniques aim to make reverse engineering (and therefore, decompilation) more difficult by adding complexity to the analysis of the executable code. Here are some advanced code protection techniques commonly used to hinder reverse engineering efforts.


Purpose: To make the code more difficult to understand by renaming variables, functions, and other identifiers, without changing the program's logic.


  • Identifier Renaming: Renaming variables and functions to meaningless or non-descriptive names.
  • Hierarchy Flattening: Removing all package and namespace information to make it look like all functions and classes belong to a single unified namespace.
  • String Encryption: Encrypting strings in the code and decrypting them at runtime to thwart static analysis.
  • Code Encryption: Encrypting portions of the code and decrypting them dynamically during execution.

Control Flow Obfuscation

Purpose: To complicate the understanding of program flow by altering the control flow structure of the code.


  • Spaghetti Code: Introducing convoluted control flow structures with unnecessary branches and jumps to confuse analysis tools.
  • Code Flattening: Transforming structured code into a flat representation, making it harder to discern the original control flow.
  • Function Splitting: Splitting functions into smaller, interdependent fragments to hinder function-level analysis.
  • Opaque Predicates: Introducing conditional statements with always-true or always-false predicates to confuse control flow analysis.

Junk Code Insertion

Purpose: To add noise to the code, making it harder to distinguish between essential and non-essential instructions.


  • Instruction Padding: Inserting extra instructions that have no impact on program behavior but increase the overall code size.
  • Dead Code Insertion: Adding sections of code that are never executed, creating confusion for reverse engineers.
  • Redundant Operations: Introducing redundant computations or operations that do not affect the program's functionality.

Code Virtualization

Purpose: To transform the original code into an intermediate representation that is interpreted at runtime, making static analysis more challenging.


  • Instruction Virtualization: Translating machine code into a custom intermediate language, which is then interpreted at runtime.
  • Dynamic Code Generation: Generating code dynamically during program execution, making it harder to analyze statically.

Binary Packing

Purpose: To compress and encrypt the executable, requiring the unpacking and decryption at runtime.


  • Executable Compression: Compressing the executable to make it more challenging to analyze.
  • Encryption: Encrypting the executable and decrypting it dynamically during execution.

Combination of the Above

These techniques are often used in combination to create layered defenses against reverse engineering.

However, it's important to note that while these methods can increase the difficulty of reverse engineering, they cannot provide absolute protection. A determined reverse engineer may still find ways to analyze and understand the protected code, but these measures can significantly slow down the process and deter casual reversers.

JEB can help counter many of the techniques employed above, including the most complicated ones, such as code virtualization, control flow obfuscation via opaque predicates, and control flow flattening.

Benefits of Decompilers

Why reverse engineers benefit from working with an interactive decompiler such as JEB.

Code Understanding

Decompilers provide a human-readable representation of the code, making it much easier for reverse engineers to understand the functionality and structure of a program.

High-Level Abstraction

They offer a higher-level abstraction of the code, allowing reverse engineers to focus on the logic and algorithms rather than getting bogged down in low-level machine code details.

Time Efficiency

Using decompilers speeds up the analysis process. Reverse engineers can quickly grasp the intent of the code, saving time compared to manually deciphering raw machine code.

Variable and Function Naming

Decompilers often attempt to recover variable and function names, making the code more readable and allowing reverse engineers to understand the purpose of different components.

Malware Analysis

Threat engineers use decompilers to analyze and unerstand malicious programs (malware) such as viruses, trojan horses, or randomware.

Security Analysis

Security experts use decompilers to analyze software for vulnerabilities. By understanding the code, they can identify potential security issues, loopholes, or weaknesses in the application.

Legacy Software

When dealing with legacy systems where documentation is scarce or outdated, decompilers assist in reverse engineering efforts to understand and maintain older software.

Automated Analysis

Automated tools that assist in reverse engineering often leverage decompilers to generate insights and reports. These tools benefit from the decompiled representation to provide meaningful analysis.

Educational Purposes

Decompilers serve as valuable educational tools for teaching reverse engineering concepts and techniques. They allow students to explore real-world examples and understand the inner workings of software.

Learn More About JEB Try JEB Demo JEB Community Edition