Decompilation

When developers write a program, they first type readable text — the so-called source code. A tool called a compiler then translates this text into machine code: a sequence of zeros and ones that the computer can execute directly. This machine code is barely readable for humans. Decompilation reverses this process: it attempts to reconstruct something that looks like readable source code from the finished machine code. The result is rarely perfect — variable names, comments, and the original structure are lost during compilation and cannot simply be recovered.

Significance for security and software analysis

Decompilation is a fundamental tool of IT security. Security researchers use it to examine malware without possessing the original source code. When a virus or ransomware is discovered on a computer, the attacker’s source code is of course not publicly available. Through decompilation, one can nevertheless understand what the program does, how it spreads, and where its vulnerabilities lie.

Decompilation is also relevant for software without malicious intent. Companies use it to analyze third-party programs to solve compatibility problems or to check whether a competing product has copied their own ideas. Without decompilation, software would be a complete black box for outsiders — a system into which you feed something and out of which something emerges, without ever knowing what happens in between.

What actually happens during decompilation

A decompiler reads the machine code step by step and tries to recognize patterns within it. It identifies loops, conditions, and functions — the typical building blocks of a program. It then assembles these into readable but artificial source code. In doing so, it invents placeholder names like “var_1” or “function_A”, because the real names were deleted during compilation.

The result is functionally equivalent to the original — it describes the same behavior — but it doesn’t look like code a human would have written. You can think of it like an automatic translation: the content is the same, but the style is clunky and unnatural. Modern decompilers, including the free tool Ghidra from the US agency NSA, have become very powerful and often produce quite readable code.

For some programming languages, decompilation is particularly easy. Java and C# store their code in an intermediate format — so-called bytecode — which contains more information than pure machine code. Decompiled Java programs sometimes look almost identical to the original. For this reason, many Java developers deliberately obscure their code beforehand, a process called obfuscation.

Decompilation in products, news, and legal questions

In practice, decompilation appears in various contexts. Game developers protect their games with anti-cheat systems designed to detect when someone decompiles and modifies the game code to gain an advantage. At the same time, modders — fans who unofficially extend games — use exactly this technique to add their own content. The Pokémon fan community, for example, has completely reconstructed and re-released entire games through decompilation.

Legally, decompilation occupies a gray area. In the EU, a directive explicitly permits decompilation when it is necessary to achieve compatibility between programs. Anything beyond that — such as copying ideas from someone else’s code — can constitute a copyright infringement. In practice, companies regularly dispute exactly what is permitted.

In the world of AI, decompilation is gaining a new dimension. Researchers apply similar principles to understand what is contained within trained AI models — that is, which rules and patterns a model has learned without anyone having explicitly programmed them. This field of research is called mechanistic interpretability and is closely tied to the question of whether AI systems can be trusted.