What to do with questions of type "Decompile this assembler code"?

Question

Just now, I have edited a question of type "Decompile this assembler code".

It is not the first one and it will not be the last one...

I know that, whatever we do, we will encounter this kind of question a lot. So, there is absolutely no way to fight against. But, at least, is there some recommendations, ways to handle it, specific tags to add to it, to make it easier to browse in and relevant as an answer ?

Any ideas, comments, or opinion about this issue is more than welcome ! (I, personally, have no real ideas on what is the best way to handle it... my only certainty is that it will come again and again with no possible way to avoid it).

Answer 1

There are two problems with that question:

1. The asker didn't include much in the way of context. We don't know where that code came from, how it was called, which platform it was found running on, or why the asker wants to decompile it. Not only does this make answering the question unnecessarily difficult, but it also makes the question less useful as an opportunity to teach, because...

2. The asker gave no indication of what he already knows and where he's running into trouble putting that knowledge to use.

Consider a hypothetical answerer who wishes to use this question as an opportunity to share his knowledge and experience. He must not only explain to the asker how to represent the logic presented in C, but also (if he wishes to be thorough) how to divine the nature of the compiler that produced the code in the first place. At which point he still can't know if his answer will actually be of use to the asker, since we don't know if the asker knows anything about i386 assembler or the process by which high-level languages are represented in it... So he would have to explain those as well.

At this point, a fairly simple-looking question has become quite broad and time-consuming to answer. But let's say someone did put the time and effort into answering it... What are the chances that this textbook-sized answer is going to benefit anyone else? Well, pretty good if they could find it... But it's trapped under a very specific question with a fairly nondescript title, so first those would have to be edited to generalize the question. Even more work...

And what happens if the asker comes back and says he already knew all of this and was just stuck on one small part of the code he listed, and edits his question to be more specific. Now all that effort is wasted on him.

Over on English Language & Usage, J.R. came up with a reasonable simple formula for asking questions like these:

1. Let me explain why I'm asking this question.
2. Let me ask the question.
3. Let me tell you what I found when I tried to find the answer myself.
4. Let me explain why I'm still confused.

Not that every question explicitly states all of this information, but I would argue that every good question contains this information at least implicitly - and if you find yourself struggling to understand the purpose of a question, looking for these factors is a good exercise. If you strongly suspect that the question falls into the trap I've outlined above (possibly too broad with no way to be sure) leave a comment noting the information that is missing and vote to close it. There's even a specific off-topic sub-reason defined for this purpose:

Questions asking for help reverse-engineering a specific system are off-topic unless they demonstrate an understanding of the concepts involved and clearly identify a specific problem.

If the asker comes back and clarifies, you can retract your vote or vote to re-open. But failing that, it would be better to help those answering focus their efforts on questions that can already be answered effectively.

Answer 2

Another issue with these sort of questions, which will probably be a continuing issue for the RE SE, is the issue of copyright. Although it is small, that code is clearly owned by someone, it is a derivative work of the code the original author used to generate the machine code. I, and I assume the owners of SE in general, would probably prefer that we avoid redistributing code for which there is an unclear or no license.

I would say for questions that list large amounts of machine code or decompiled code there needs to be a clear source so that the moderators can determine whether its redistribution is a copyright violation.

I want to make sure we stay on the right side so that we don't wind up in a situation where the powers that be decide that keeping this site up is not worth the trouble.

Repeated complaints from original authors will definitely risk us getting shut down. With the work people are putting into asking and answering very good questions that would be a great loss to the reverse engineering community.

Answer 3

Copyright is a tricky subject and IMO outside of the scope of RE.

RE is about teaching techniques and not about explicitly performing a disassembly act. If we stick to teaching, then we can't be convicted of copyright infringement as we never saw the original code or performed the infraction.

My 2c

Answer 4

Binaries have protection. Source code has protection, but not as much as the binary. Disassemblies are smart guesses. You can't take a disassembly from IDA or objdump and recover a working program. You equally can't recover the source. RE has more than enough plausible deniability.