Update app.py

app.py

@@ -9,20 +9,20 @@ import re
 import json
 from pathlib import Path
 
-st.set_page_config(page_title="Executable Reverse Engineer", page_icon="🔍", layout="wide")
+st.set_page_config(page_title="Binary Decompiler", page_icon="🔍", layout="wide")
 
-st.title("Executable Reverse Engineering Tool")
+st.title("Executable Decompiler Tool")
 st.markdown("""
-This tool performs reverse engineering on executables (.exe/.dll) to show their inner workings:
-- Disassembles machine code to view assembly instructions
-- Attempts to decompile to pseudocode
-- Shows strings, imports, and other binary artifacts
-- Works with executables from any programming language
+This tool decompiles executables to source code:
+- Extracts assembly instructions from any .exe or .dll
+- Converts assembly to Python-like or C++-like code
+- Extracts embedded strings and resources
+- Works with any executable regardless of original language
 """)
 
 # Install necessary packages at startup
 try:
-    with st.spinner("Setting up reverse engineering environment..."):
+    with st.spinner("Setting up decompilation environment..."):
         # Install key analysis libraries
         subprocess.run(["pip", "install", "pyinstaller-extractor"], capture_output=True)
         subprocess.run(["pip", "install", "uncompyle6"], capture_output=True)
@@ -35,7 +35,7 @@ try:
         st.success("Environment ready")
 except Exception as e:
     st.error(f"Setup error: {str(e)}")
-    
+
 def extract_strings(file_path, min_length=4):
     """Extract ASCII and Unicode strings from binary file"""
     try:
@@ -56,72 +56,357 @@ def extract_strings(file_path, min_length=4):
     except Exception as e:
         return [f"Error extracting strings: {str(e)}"]
 
-def analyze_with_radare2(file_path):
-    """Use radare2 through r2pipe for deep analysis"""
-    try:
-        # Open file with r2pipe
-        r2 = r2pipe.open(file_path)
-        
-        # Perform initial analysis
-        r2.cmd("aaa")  # Analyze all
-        
-        # Get basic information
-        info = json.loads(r2.cmd("ij"))
-        
-        # Get entry point
-        entry_point = r2.cmd("ie")
-        
-        # Get imports
-        imports = r2.cmd("iij")
-        imports = json.loads(imports) if imports else []
-        
-        # Get exports (for DLLs)
-        exports = r2.cmd("iEj")
-        exports = json.loads(exports) if exports else []
+def assembly_to_python(assembly_lines):
+    """Convert assembly code to Python-like code"""
+    python_code = []
+    python_code.append("# Python code decompiled from assembly")
+    python_code.append("# This is an approximation of the original code")
+    python_code.append("")
+    
+    # Track variables and functions
+    variables = set()
+    functions = set()
+    current_function = None
+    indentation = 0
+    in_loop = False
+    in_condition = False
+    
+    i = 0
+    while i < len(assembly_lines):
+        line = assembly_lines[i]
         
-        # Get sections
-        sections = r2.cmd("iSj")
-        sections = json.loads(sections) if sections else []
+        # Parse assembly line
+        if ": " in line:
+            parts = line.split(": ", 1)
+            if len(parts) > 1:
+                addr, instruction = parts
+                
+                # Function start detection
+                if "push ebp" in instruction and "mov ebp, esp" in assembly_lines[i+1] if i+1 < len(assembly_lines) else "":
+                    current_function = f"function_{addr}"
+                    functions.add(current_function)
+                    python_code.append(f"\ndef {current_function}():")
+                    indentation = 1
+                    i += 2  # Skip the function prologue
+                    continue
+                
+                # Function return detection
+                if "ret" in instruction and indentation > 0:
+                    python_code.append(f"{' ' * 4 * indentation}return")
+                    indentation = 0
+                    current_function = None
+                
+                # Call instruction - function call
+                if "call" in instruction:
+                    target = instruction.split("call")[1].strip()
+                    if target.startswith("0x"):
+                        called_func = f"function_{target}"
+                        functions.add(called_func)
+                        python_code.append(f"{' ' * 4 * indentation}{called_func}()")
+                    else:
+                        python_code.append(f"{' ' * 4 * indentation}# Call to external function: {target}")
+                
+                # Variable assignment (mov)
+                elif "mov" in instruction:
+                    dest, source = instruction.split("mov")[1].split(",", 1)
+                    dest = dest.strip()
+                    source = source.strip()
+                    
+                    if dest not in variables:
+                        variables.add(dest)
+                    
+                    python_code.append(f"{' ' * 4 * indentation}{dest} = {source}")
+                
+                # Comparison and jumps (if statements)
+                elif "cmp" in instruction:
+                    parts = instruction.split("cmp")[1].split(",", 1)
+                    if len(parts) > 1:
+                        a, b = parts
+                        a = a.strip()
+                        b = b.strip()
+                        
+                        # Look ahead for jump instruction
+                        next_line = assembly_lines[i+1] if i+1 < len(assembly_lines) else ""
+                        if "j" in next_line:  # Any jump instruction
+                            jump_type = next_line.split(": ")[1].split()[0] if ": " in next_line else ""
+                            
+                            if jump_type == "je" or jump_type == "jz":
+                                python_code.append(f"{' ' * 4 * indentation}if {a} == {b}:")
+                            elif jump_type == "jne" or jump_type == "jnz":
+                                python_code.append(f"{' ' * 4 * indentation}if {a} != {b}:")
+                            elif jump_type == "jg" or jump_type == "jnle":
+                                python_code.append(f"{' ' * 4 * indentation}if {a} > {b}:")
+                            elif jump_type == "jge" or jump_type == "jnl":
+                                python_code.append(f"{' ' * 4 * indentation}if {a} >= {b}:")
+                            elif jump_type == "jl" or jump_type == "jnge":
+                                python_code.append(f"{' ' * 4 * indentation}if {a} < {b}:")
+                            elif jump_type == "jle" or jump_type == "jng":
+                                python_code.append(f"{' ' * 4 * indentation}if {a} <= {b}:")
+                            else:
+                                python_code.append(f"{' ' * 4 * indentation}# Comparison: {a} ? {b}")
+                            
+                            indentation += 1
+                            in_condition = True
+                            i += 1  # Skip the jump instruction
+                            continue
+                
+                # Loop detection (simplified)
+                elif "loop" in instruction or "jmp" in instruction:
+                    if not in_loop:
+                        python_code.append(f"{' ' * 4 * indentation}while True:  # Loop at {addr}")
+                        indentation += 1
+                        in_loop = True
+                    else:
+                        python_code.append(f"{' ' * 4 * indentation}# Jump or loop at {addr}")
+                
+                # Add/sub operations
+                elif "add" in instruction:
+                    parts = instruction.split("add")[1].split(",", 1)
+                    if len(parts) > 1:
+                        dest, value = parts
+                        dest = dest.strip()
+                        value = value.strip()
+                        python_code.append(f"{' ' * 4 * indentation}{dest} += {value}")
+                
+                elif "sub" in instruction:
+                    parts = instruction.split("sub")[1].split(",", 1)
+                    if len(parts) > 1:
+                        dest, value = parts
+                        dest = dest.strip()
+                        value = value.strip()
+                        python_code.append(f"{' ' * 4 * indentation}{dest} -= {value}")
+                
+                # Other arithmetic
+                elif "mul" in instruction:
+                    operand = instruction.split("mul")[1].strip()
+                    python_code.append(f"{' ' * 4 * indentation}# Multiply by {operand}")
+                
+                elif "div" in instruction:
+                    operand = instruction.split("div")[1].strip()
+                    python_code.append(f"{' ' * 4 * indentation}# Divide by {operand}")
+                
+                # Default case - just comment the assembly
+                else:
+                    python_code.append(f"{' ' * 4 * indentation}# {instruction}")
         
-        # Disassemble main function
-        main_disasm = r2.cmd("s main; pdf")
-        if not main_disasm or "Cannot find function" in main_disasm:
-            main_disasm = r2.cmd("s entry0; pdf")  # Try entry point instead
+        i += 1
+    
+    # Add main execution
+    python_code.append("\nif __name__ == '__main__':")
+    if functions:
+        first_function = next(iter(functions))
+        python_code.append(f"    {first_function}()")
+    else:
+        python_code.append("    pass  # No clear entry point found")
+    
+    return "\n".join(python_code)
+
+def assembly_to_cpp(assembly_lines):
+    """Convert assembly code to C++-like code"""
+    cpp_code = []
+    cpp_code.append("// C++ code decompiled from assembly")
+    cpp_code.append("// This is an approximation of the original code")
+    cpp_code.append("")
+    cpp_code.append("#include <iostream>")
+    cpp_code.append("#include <vector>")
+    cpp_code.append("#include <string>")
+    cpp_code.append("")
+    
+    # Track variables and functions
+    variables = set()
+    functions = set()
+    current_function = None
+    indentation = 0
+    in_loop = False
+    in_condition = False
+    
+    # Add forward declarations
+    cpp_code.append("// Forward declarations")
+    
+    i = 0
+    # First pass to identify functions
+    while i < len(assembly_lines):
+        line = assembly_lines[i]
         
-        # Get function list
-        functions = r2.cmd("aflj")
-        functions = json.loads(functions) if functions else []
+        # Parse assembly line
+        if ": " in line:
+            parts = line.split(": ", 1)
+            if len(parts) > 1:
+                addr, instruction = parts
+                
+                # Function start detection
+                if "push ebp" in instruction and "mov ebp, esp" in assembly_lines[i+1] if i+1 < len(assembly_lines) else "":
+                    func_name = f"function_{addr.replace('0x', '')}"
+                    functions.add(func_name)
+                    cpp_code.append(f"void {func_name}();")
         
-        # Get decompiled pseudocode (if available)
-        pseudocode = r2.cmd("s main; pdc")
-        if not pseudocode or pseudocode.strip() == "":
-            pseudocode = r2.cmd("s entry0; pdc")  # Try entry point instead
+        i += 1
+    
+    cpp_code.append("")
+    cpp_code.append("// Variable declarations")
+    cpp_code.append("int eax, ebx, ecx, edx, esi, edi, ebp, esp;")
+    cpp_code.append("")
+    
+    # Second pass to generate function code
+    i = 0
+    while i < len(assembly_lines):
+        line = assembly_lines[i]
         
-        # Close r2
-        r2.quit()
+        # Parse assembly line
+        if ": " in line:
+            parts = line.split(": ", 1)
+            if len(parts) > 1:
+                addr, instruction = parts
+                
+                # Function start detection
+                if "push ebp" in instruction and "mov ebp, esp" in assembly_lines[i+1] if i+1 < len(assembly_lines) else "":
+                    current_function = f"function_{addr.replace('0x', '')}"
+                    cpp_code.append(f"\nvoid {current_function}() {{")
+                    indentation = 1
+                    i += 2  # Skip the function prologue
+                    continue
+                
+                # Function return detection
+                if "ret" in instruction and indentation > 0:
+                    cpp_code.append(f"{' ' * 4 * indentation}return;")
+                    cpp_code.append("}")
+                    indentation = 0
+                    current_function = None
+                
+                # Call instruction - function call
+                if "call" in instruction:
+                    target = instruction.split("call")[1].strip()
+                    if target.startswith("0x"):
+                        called_func = f"function_{target.replace('0x', '')}"
+                        cpp_code.append(f"{' ' * 4 * indentation}{called_func}();")
+                    else:
+                        cpp_code.append(f"{' ' * 4 * indentation}// Call to external function: {target}")
+                
+                # Variable assignment (mov)
+                elif "mov" in instruction:
+                    dest, source = instruction.split("mov")[1].split(",", 1)
+                    dest = dest.strip()
+                    source = source.strip()
+                    
+                    # Check if memory access
+                    if "[" in dest:
+                        cpp_code.append(f"{' ' * 4 * indentation}// Memory write to {dest}")
+                    elif "[" in source:
+                        cpp_code.append(f"{' ' * 4 * indentation}// Memory read from {source}")
+                    else:
+                        cpp_code.append(f"{' ' * 4 * indentation}{dest} = {source};")
+                
+                # Comparison and jumps (if statements)
+                elif "cmp" in instruction:
+                    parts = instruction.split("cmp")[1].split(",", 1)
+                    if len(parts) > 1:
+                        a, b = parts
+                        a = a.strip()
+                        b = b.strip()
+                        
+                        # Look ahead for jump instruction
+                        next_line = assembly_lines[i+1] if i+1 < len(assembly_lines) else ""
+                        if "j" in next_line:  # Any jump instruction
+                            jump_type = next_line.split(": ")[1].split()[0] if ": " in next_line else ""
+                            
+                            if jump_type == "je" or jump_type == "jz":
+                                cpp_code.append(f"{' ' * 4 * indentation}if ({a} == {b}) {{")
+                            elif jump_type == "jne" or jump_type == "jnz":
+                                cpp_code.append(f"{' ' * 4 * indentation}if ({a} != {b}) {{")
+                            elif jump_type == "jg" or jump_type == "jnle":
+                                cpp_code.append(f"{' ' * 4 * indentation}if ({a} > {b}) {{")
+                            elif jump_type == "jge" or jump_type == "jnl":
+                                cpp_code.append(f"{' ' * 4 * indentation}if ({a} >= {b}) {{")
+                            elif jump_type == "jl" or jump_type == "jnge":
+                                cpp_code.append(f"{' ' * 4 * indentation}if ({a} < {b}) {{")
+                            elif jump_type == "jle" or jump_type == "jng":
+                                cpp_code.append(f"{' ' * 4 * indentation}if ({a} <= {b}) {{")
+                            else:
+                                cpp_code.append(f"{' ' * 4 * indentation}// Comparison: {a} ? {b}")
+                            
+                            indentation += 1
+                            in_condition = True
+                            i += 1  # Skip the jump instruction
+                            continue
+                
+                # Loop detection (simplified)
+                elif "loop" in instruction or "jmp" in instruction:
+                    if not in_loop:
+                        cpp_code.append(f"{' ' * 4 * indentation}while (true) {{ // Loop at {addr}")
+                        indentation += 1
+                        in_loop = True
+                    else:
+                        cpp_code.append(f"{' ' * 4 * indentation}// Jump or loop at {addr}")
+                
+                # Add/sub operations
+                elif "add" in instruction:
+                    parts = instruction.split("add")[1].split(",", 1)
+                    if len(parts) > 1:
+                        dest, value = parts
+                        dest = dest.strip()
+                        value = value.strip()
+                        cpp_code.append(f"{' ' * 4 * indentation}{dest} += {value};")
+                
+                elif "sub" in instruction:
+                    parts = instruction.split("sub")[1].split(",", 1)
+                    if len(parts) > 1:
+                        dest, value = parts
+                        dest = dest.strip()
+                        value = value.strip()
+                        cpp_code.append(f"{' ' * 4 * indentation}{dest} -= {value};")
+                
+                # Other arithmetic
+                elif "mul" in instruction:
+                    operand = instruction.split("mul")[1].strip()
+                    cpp_code.append(f"{' ' * 4 * indentation}// Multiply by {operand}")
+                
+                elif "div" in instruction:
+                    operand = instruction.split("div")[1].strip()
+                    cpp_code.append(f"{' ' * 4 * indentation}// Divide by {operand}")
+                
+                # Default case - just comment the assembly
+                else:
+                    cpp_code.append(f"{' ' * 4 * indentation}// {instruction}")
         
-        return {
-            "info": info,
-            "entry_point": entry_point,
-            "imports": imports,
-            "exports": exports,
-            "sections": sections,
-            "main_disasm": main_disasm,
-            "functions": functions,
-            "pseudocode": pseudocode
-        }
-    except Exception as e:
-        return {"error": f"Radare2 analysis failed: {str(e)}"}
+        i += 1
+    
+    # Add main function
+    cpp_code.append("\nint main() {")
+    if functions:
+        first_function = next(iter(functions))
+        cpp_code.append(f"    {first_function}();")
+    else:
+        cpp_code.append("    // No clear entry point found")
+    cpp_code.append("    return 0;")
+    cpp_code.append("}")
+    
+    return "\n".join(cpp_code)
 
 def try_pyinstaller_extraction(file_path, output_dir):
     """Attempt to extract Python scripts from PyInstaller executables"""
     try:
-        # Run pyinstxtractor on the file
-        result = subprocess.run(["python", "-m", "pyinstaller-extractor", file_path], 
-                               cwd=output_dir, capture_output=True, text=True)
+        # Run pyinstaller-extractor on the file
+        # Try both potential command names
+        try:
+            result = subprocess.run(["python", "-m", "pyinstxtractor", file_path], 
+                                  cwd=output_dir, capture_output=True, text=True)
+        except:
+            try:
+                result = subprocess.run(["python", "-m", "pyinstaller_extractor", file_path], 
+                                      cwd=output_dir, capture_output=True, text=True)
+            except:
+                # Direct command attempt
+                result = subprocess.run(["pyinstxtractor", file_path], 
+                                      cwd=output_dir, capture_output=True, text=True)
         
         extracted_dir = os.path.join(output_dir, os.path.basename(file_path) + "_extracted")
         
+        if not os.path.exists(extracted_dir):
+            # Try with different naming convention
+            potential_dirs = [d for d in os.listdir(output_dir) if os.path.isdir(os.path.join(output_dir, d)) and "_extracted" in d]
+            if potential_dirs:
+                extracted_dir = os.path.join(output_dir, potential_dirs[0])
+        
         if os.path.exists(extracted_dir):
             # Try to decompile the Python bytecode files
             python_files = {}
@@ -150,22 +435,34 @@ def try_pyinstaller_extraction(file_path, output_dir):
                         pyz_extract_dir = pyz_path + "_extracted"
                         os.makedirs(pyz_extract_dir, exist_ok=True)
                         try:
-                            # Extract PYZ files (these contain most of the Python modules)
-                            subprocess.run(["python", "-m", "pyinstxtractor", pyz_path], 
-                                          cwd=output_dir, capture_output=True)
-                            for pyz_root, _, pyz_files in os.walk(pyz_extract_dir):
-                                for pyz_file in pyz_files:
-                                    if pyz_file.endswith('.pyc') or pyz_file.endswith('.pyo'):
-                                        pyc_path = os.path.join(pyz_root, pyz_file)
-                                        py_path = pyc_path + ".py"
-                                        try:
-                                            subprocess.run(["uncompyle6", pyc_path, "-o", py_path], capture_output=True)
-                                            if os.path.exists(py_path):
-                                                with open(py_path, 'r', encoding='utf-8', errors='ignore') as f:
-                                                    rel_path = os.path.join("PYZ_ARCHIVE", os.path.relpath(pyc_path, pyz_extract_dir))
-                                                    python_files[rel_path] = f.read()
-                                        except:
-                                            pass
+                            # Try different extraction methods for the PYZ
+                            try:
+                                subprocess.run(["python", "-m", "pyinstxtractor", pyz_path], 
+                                            cwd=output_dir, capture_output=True)
+                            except:
+                                try:
+                                    subprocess.run(["python", "-m", "pyinstaller_extractor", pyz_path], 
+                                                cwd=output_dir, capture_output=True)
+                                except:
+                                    # Direct command attempt
+                                    subprocess.run(["pyinstxtractor", pyz_path], 
+                                                cwd=output_dir, capture_output=True)
+                                    
+                            # Look for extracted PYZ content
+                            if os.path.exists(pyz_extract_dir):
+                                for pyz_root, _, pyz_files in os.walk(pyz_extract_dir):
+                                    for pyz_file in pyz_files:
+                                        if pyz_file.endswith('.pyc') or pyz_file.endswith('.pyo'):
+                                            pyc_path = os.path.join(pyz_root, pyz_file)
+                                            py_path = pyc_path + ".py"
+                                            try:
+                                                subprocess.run(["uncompyle6", pyc_path, "-o", py_path], capture_output=True)
+                                                if os.path.exists(py_path):
+                                                    with open(py_path, 'r', encoding='utf-8', errors='ignore') as f:
+                                                        rel_path = os.path.join("PYZ_ARCHIVE", os.path.relpath(pyc_path, pyz_extract_dir))
+                                                        python_files[rel_path] = f.read()
+                                            except:
+                                                pass
                         except:
                             pass
             
@@ -184,8 +481,79 @@ def try_pyinstaller_extraction(file_path, output_dir):
             "message": f"PyInstaller extraction error: {str(e)}"
         }
 
+def disassemble_binary(file_path, is_dll=False):
+    """Disassemble a binary file to get assembly code"""
+    try:
+        # Try with radare2 first
+        try:
+            import r2pipe
+            r2 = r2pipe.open(file_path)
+            r2.cmd("aaa")  # Analyze all
+            
+            # Get main or entry point disassembly
+            main_disasm = r2.cmd("s main; pdf")
+            if not main_disasm or "Cannot find function" in main_disasm:
+                main_disasm = r2.cmd("s entry0; pdf")  # Try entry point instead
+            
+            # Get list of functions
+            functions = r2.cmd("afl")
+            
+            # Get all functions disassembly for more complete code
+            all_functions_disasm = []
+            function_addresses = re.findall(r'0x[0-9a-fA-F]+', functions)
+            for addr in function_addresses[:10]:  # Limit to first 10 functions to avoid huge output
+                func_disasm = r2.cmd(f"s {addr}; pdf")
+                all_functions_disasm.append(func_disasm)
+            
+            r2.quit()
+            
+            # Extract assembly instructions
+            assembly_lines = []
+            for disasm in [main_disasm] + all_functions_disasm:
+                for line in disasm.splitlines():
+                    if "│" in line:  # radare2 format contains this separator
+                        parts = line.split("│")
+                        if len(parts) > 1:
+                            addr_part = parts[0].strip()
+                            instr_part = parts[-1].strip()
+                            if addr_part and instr_part and "0x" in addr_part:
+                                address = addr_part.strip()
+                                instruction = instr_part.strip()
+                                assembly_lines.append(f"{address}: {instruction}")
+            
+            return assembly_lines
+        except:
+            # Fallback to pefile + capstone if radare2 fails
+            pe = pefile.PE(file_path)
+            
+            # Determine if 32-bit or 64-bit
+            is_64bit = pe.OPTIONAL_HEADER.Magic == 0x20b
+            mode = CS_MODE_64 if is_64bit else CS_MODE_32
+            
+            # Initialize disassembler
+            md = Cs(CS_ARCH_X86, mode)
+            md.detail = True
+            
+            assembly_lines = []
+            
+            # Find and disassemble code sections
+            for section in pe.sections:
+                if section.Characteristics & 0x20000000:  # IMAGE_SCN_CNT_CODE
+                    section_data = pe.get_data(section.VirtualAddress, section.SizeOfRawData)
+                    section_addr = pe.OPTIONAL_HEADER.ImageBase + section.VirtualAddress
+                    
+                    # Disassemble section code
+                    for i, (address, size, mnemonic, op_str) in enumerate(md.disasm_lite(section_data, section_addr)):
+                        if i >= 500:  # Limit to 500 instructions per section
+                            break
+                        assembly_lines.append(f"0x{address:08x}: {mnemonic} {op_str}")
+            
+            return assembly_lines
+    except Exception as e:
+        return [f"Disassembly error: {str(e)}"]
+
 def analyze_binary(file_path, is_dll=False):
-    """Comprehensive analysis of a binary file"""
+    """Comprehensive analysis and decompilation of a binary file"""
     try:
         results = {}
         
@@ -244,44 +612,15 @@ def analyze_binary(file_path, is_dll=False):
         # Extract strings
         results["strings"] = extract_strings(file_path)
         
-        # Use Radare2 for deeper analysis if available
-        try:
-            r2_results = analyze_with_radare2(file_path)
-            if "error" not in r2_results:
-                results["disassembly"] = r2_results["main_disasm"]
-                results["functions"] = r2_results["functions"]
-                results["pseudocode"] = r2_results["pseudocode"]
-            else:
-                # Fallback to basic disassembly with Capstone
-                from capstone import Cs, CS_ARCH_X86, CS_MODE_32, CS_MODE_64
-                
-                # Determine if 32-bit or 64-bit
-                is_64bit = pe.OPTIONAL_HEADER.Magic == 0x20b
-                mode = CS_MODE_64 if is_64bit else CS_MODE_32
-                
-                # Initialize disassembler
-                md = Cs(CS_ARCH_X86, mode)
-                md.detail = True
-                
-                # Find the entry point
-                entry_rva = pe.OPTIONAL_HEADER.AddressOfEntryPoint
-                for section in pe.sections:
-                    if section.contains_rva(entry_rva):
-                        # Calculate file offset of entry point
-                        entry_offset = entry_rva - section.VirtualAddress + section.PointerToRawData
-                        entry_data = pe.get_memory_mapped_image()[entry_rva:entry_rva+512]  # Get 512 bytes from entry
-                        
-                        disassembly = []
-                        for i, (address, size, mnemonic, op_str) in enumerate(md.disasm_lite(entry_data, pe.OPTIONAL_HEADER.ImageBase + entry_rva)):
-                            if i >= 100:  # Limit to 100 instructions for preview
-                                break
-                            disassembly.append(f"0x{address:08x}: {mnemonic} {op_str}")
-                        
-                        results["disassembly"] = "\n".join(disassembly)
-                        break
-        except ImportError:
-            # If r2pipe or capstone isn't available
-            results["disassembly"] = "Advanced disassembly not available. Install r2pipe or capstone."
+        # Disassemble to get assembly
+        assembly_lines = disassemble_binary(file_path, is_dll)
+        results["assembly_lines"] = assembly_lines
+        
+        # Convert assembly to Python
+        results["python_code"] = assembly_to_python(assembly_lines)
+        
+        # Convert assembly to C++
+        results["cpp_code"] = assembly_to_cpp(assembly_lines)
         
         return results
     except Exception as e:
@@ -365,114 +704,83 @@ if uploaded_file is not None:
                                     analysis = file_info['analysis']
                                     python_extraction = file_info['python_extraction']
                                     
-                                    tabs = st.tabs(["Summary", "Imports", "Strings", "Assembly", "Python Code"])
+                                    tabs = st.tabs(["Python Code", "C++ Code", "Assembly", "Imports", "Strings"])
                                     
                                     with tabs[0]:
                                         if "Error" in analysis:
                                             st.error(analysis["Error"])
                                         else:
-                                            st.json(analysis.get("basic_info", {}))
-                                            
-                                            st.subheader("Sections")
-                                            sections_df = {
-                                                "Name": [],
-                                                "VirtualSize": [],
-                                                "SizeOfRawData": [],
-                                                "Entropy": []
-                                            }
-                                            for section in analysis.get("sections", []):
-                                                sections_df["Name"].append(section["Name"])
-                                                sections_df["VirtualSize"].append(section["VirtualSize"])
-                                                sections_df["SizeOfRawData"].append(section["SizeOfRawData"])
-                                                sections_df["Entropy"].append(section["Entropy"])
-                                            
-                                            st.dataframe(sections_df)
+                                            # Check if we have extracted Python code
+                                            if python_extraction.get("success", False):
+                                                st.success("Original Python code extracted successfully!")
+                                                for filename, content in python_extraction.get("files", {}).items():
+                                                    with st.expander(f"Python File: {filename}"):
+                                                        st.code(content, language="python")
+                                            else:
+                                                # Show decompiled Python from assembly
+                                                st.warning("Converting assembly to Python code (not original source)")
+                                                st.code(analysis.get("python_code", "# Failed to generate Python code"), language="python")
                                     
                                     with tabs[1]:
+                                        st.subheader("Decompiled C++ Code")
+                                        st.code(analysis.get("cpp_code", "// Failed to generate C++ code"), language="cpp")
+                                    
+                                    with tabs[2]:
+                                        st.subheader("Assembly Code")
+                                        assembly = "\n".join(analysis.get("assembly_lines", []))
+                                        st.code(assembly, language="asm")
+                                    
+                                    with tabs[3]:
+                                        st.subheader("Imported Functions")
                                         for imp in analysis.get("imports", []):
                                             with st.expander(f"DLL: {imp['DLL']}"):
                                                 st.code("\n".join(imp["Functions"]))
                                     
-                                    with tabs[2]:
+                                    with tabs[4]:
                                         st.subheader("Strings Found")
                                         all_strings = analysis.get("strings", [])
                                         interesting_strings = [s for s in all_strings if len(s) > 8]  # Filter out very short strings
                                         st.code("\n".join(interesting_strings[:500]))  # Limit to 500 strings
-                                    
-                                    with tabs[3]:
-                                        st.subheader("Disassembly")
-                                        if "disassembly" in analysis:
-                                            st.code(analysis["disassembly"], language="asm")
-                                        else:
-                                            st.warning("Disassembly not available")
-                                        
-                                        if "pseudocode" in analysis and analysis["pseudocode"]:
-                                            st.subheader("Decompiled Pseudocode")
-                                            st.code(analysis["pseudocode"], language="c")
-                                    
-                                    with tabs[4]:
-                                        if python_extraction.get("success", False):
-                                            st.success("Python code extracted successfully!")
-                                            for filename, content in python_extraction.get("files", {}).items():
-                                                with st.expander(f"Python File: {filename}"):
-                                                    st.code(content, language="python")
-                                        else:
-                                            st.warning(python_extraction.get("message", "Not a Python executable or extraction failed."))
                                 else:  # DLL
                                     analysis = file_info['analysis']
                                     
-                                    tabs = st.tabs(["Summary", "Exports", "Imports", "Strings", "Assembly"])
+                                    tabs = st.tabs(["Python Code", "C++ Code", "Assembly", "Exports", "Imports", "Strings"])
                                     
                                     with tabs[0]:
                                         if "Error" in analysis:
                                             st.error(analysis["Error"])
                                         else:
-                                            st.json(analysis.get("basic_info", {}))
-                                            
-                                            st.subheader("Sections")
-                                            sections_df = {
-                                                "Name": [],
-                                                "VirtualSize": [],
-                                                "SizeOfRawData": [],
-                                                "Entropy": []
-                                            }
-                                            for section in analysis.get("sections", []):
-                                                sections_df["Name"].append(section["Name"])
-                                                sections_df["VirtualSize"].append(section["VirtualSize"])
-                                                sections_df["SizeOfRawData"].append(section["SizeOfRawData"])
-                                                sections_df["Entropy"].append(section["Entropy"])
-                                            
-                                            st.dataframe(sections_df)
+                                            st.subheader("Decompiled Python Code")
+                                            st.code(analysis.get("python_code", "# Failed to generate Python code"), language="python")
                                     
                                     with tabs[1]:
+                                        st.subheader("Decompiled C++ Code")
+                                        st.code(analysis.get("cpp_code", "// Failed to generate C++ code"), language="cpp")
+                                    
+                                    with tabs[2]:
+                                        st.subheader("Assembly Code")
+                                        assembly = "\n".join(analysis.get("assembly_lines", []))
+                                        st.code(assembly, language="asm")
+                                    
+                                    with tabs[3]:
                                         st.subheader("Exported Functions")
                                         st.json(analysis.get("exports", []))
                                     
-                                    with tabs[2]:
+                                    with tabs[4]:
+                                        st.subheader("Imported Functions")
                                         for imp in analysis.get("imports", []):
                                             with st.expander(f"DLL: {imp['DLL']}"):
                                                 st.code("\n".join(imp["Functions"]))
                                     
-                                    with tabs[3]:
+                                    with tabs[5]:
                                         st.subheader("Strings Found")
                                         all_strings = analysis.get("strings", [])
                                         interesting_strings = [s for s in all_strings if len(s) > 8]  # Filter out very short strings
                                         st.code("\n".join(interesting_strings[:500]))  # Limit to 500 strings
-                                    
-                                    with tabs[4]:
-                                        st.subheader("Disassembly")
-                                        if "disassembly" in analysis:
-                                            st.code(analysis["disassembly"], language="asm")
-                                        else:
-                                            st.warning("Disassembly not available")
-                                        
-                                        if "pseudocode" in analysis and analysis["pseudocode"]:
-                                            st.subheader("Decompiled Pseudocode")
-                                            st.code(analysis["pseudocode"], language="c")
         
         elif uploaded_file.name.lower().endswith('.exe'):
             st.subheader("EXE File Analysis")
-            with st.spinner("Reverse engineering executable..."):
+            with st.spinner("Decompiling executable..."):
                 output_dir = os.path.join(temp_dir, "exe_unpacked")
                 os.makedirs(output_dir, exist_ok=True)
                 
@@ -482,115 +790,118 @@ if uploaded_file is not None:
                 # Try Python extraction
                 python_extraction = try_pyinstaller_extraction(file_path, output_dir)
                 
-                tabs = st.tabs(["Summary", "Imports", "Strings", "Assembly", "Python Code"])
+                tabs = st.tabs(["Python Code", "C++ Code", "Assembly", "Summary", "Imports", "Strings"])
                 
                 with tabs[0]:
                     if "Error" in analysis:
                         st.error(analysis["Error"])
                     else:
-                        st.subheader("Basic Information")
-                        st.json(analysis.get("basic_info", {}))
-                        
-                        st.subheader("Sections")
-                        sections_df = {
-                            "Name": [],
-                            "VirtualSize": [],
-                            "SizeOfRawData": [],
-                            "Entropy": []
-                        }
-                        for section in analysis.get("sections", []):
-                            sections_df["Name"].append(section["Name"])
-                            sections_df["VirtualSize"].append(section["VirtualSize"])
-                            sections_df["SizeOfRawData"].append(section["SizeOfRawData"])
-                            sections_df["Entropy"].append(section["Entropy"])
-                        
-                        st.dataframe(sections_df)
+                        # Check if we have extracted Python code
+                        if python_extraction.get("success", False):
+                            st.success("Original Python code extracted successfully!")
+                            for filename, content in python_extraction.get("files", {}).items():
+                                with st.expander(f"Python File: {filename}"):
+                                    st.code(content, language="python")
+                        else:
+                            # Show decompiled Python from assembly
+                            st.warning("Converting assembly to Python code (not original source)")
+                            st.code(analysis.get("python_code", "# Failed to generate Python code"), language="python")
                 
                 with tabs[1]:
+                    st.subheader("Decompiled C++ Code")
+                    st.code(analysis.get("cpp_code", "// Failed to generate C++ code"), language="cpp")
+                
+                with tabs[2]:
+                    st.subheader("Assembly Code")
+                    assembly = "\n".join(analysis.get("assembly_lines", []))
+                    st.code(assembly, language="asm")
+                
+                with tabs[3]:
+                    st.subheader("Basic Information")
+                    st.json(analysis.get("basic_info", {}))
+                    
+                    st.subheader("Sections")
+                    sections_df = {
+                        "Name": [],
+                        "VirtualSize": [],
+                        "SizeOfRawData": [],
+                        "Entropy": []
+                    }
+                    for section in analysis.get("sections", []):
+                        sections_df["Name"].append(section["Name"])
+                        sections_df["VirtualSize"].append(section["VirtualSize"])
+                        sections_df["SizeOfRawData"].append(section["SizeOfRawData"])
+                        sections_df["Entropy"].append(section["Entropy"])
+                    
+                    st.dataframe(sections_df)
+                
+                with tabs[4]:
                     st.subheader("Imported Functions")
                     for imp in analysis.get("imports", []):
                         with st.expander(f"DLL: {imp['DLL']}"):
                             st.code("\n".join(imp["Functions"]))
                 
-                with tabs[2]:
+                with tabs[5]:
                     st.subheader("Strings Found")
                     all_strings = analysis.get("strings", [])
                     interesting_strings = [s for s in all_strings if len(s) > 8]  # Filter out very short strings
                     st.code("\n".join(interesting_strings[:500]))  # Limit to 500 strings
-                
-                with tabs[3]:
-                    st.subheader("Disassembly")
-                    if "disassembly" in analysis:
-                        st.code(analysis["disassembly"], language="asm")
-                    else:
-                        st.warning("Disassembly not available")
-                    
-                    if "pseudocode" in analysis and analysis["pseudocode"]:
-                        st.subheader("Decompiled Pseudocode")
-                        st.code(analysis["pseudocode"], language="c")
-                
-                with tabs[4]:
-                    if python_extraction.get("success", False):
-                        st.success("Python code extracted successfully!")
-                        for filename, content in python_extraction.get("files", {}).items():
-                            with st.expander(f"Python File: {filename}"):
-                                st.code(content, language="python")
-                    else:
-                        st.warning(python_extraction.get("message", "Not a Python executable or extraction failed."))
         
         elif uploaded_file.name.lower().endswith('.dll'):
             st.subheader("DLL File Analysis")
-            with st.spinner("Reverse engineering DLL..."):
+            with st.spinner("Decompiling DLL..."):
                 # Perform comprehensive analysis (with is_dll=True)
                 analysis = analyze_binary(file_path, is_dll=True)
                 
-                tabs = st.tabs(["Summary", "Exports", "Imports", "Strings", "Assembly"])
+                tabs = st.tabs(["Python Code", "C++ Code", "Assembly", "Summary", "Exports", "Imports", "Strings"])
                 
                 with tabs[0]:
                     if "Error" in analysis:
                         st.error(analysis["Error"])
                     else:
-                        st.subheader("Basic Information")
-                        st.json(analysis.get("basic_info", {}))
-                        
-                        st.subheader("Sections")
-                        sections_df = {
-                            "Name": [],
-                            "VirtualSize": [],
-                            "SizeOfRawData": [],
-                            "Entropy": []
-                        }
-                        for section in analysis.get("sections", []):
-                            sections_df["Name"].append(section["Name"])
-                            sections_df["VirtualSize"].append(section["VirtualSize"])
-                            sections_df["SizeOfRawData"].append(section["SizeOfRawData"])
-                            sections_df["Entropy"].append(section["Entropy"])
-                        
-                        st.dataframe(sections_df)
+                        st.subheader("Decompiled Python Code")
+                        st.code(analysis.get("python_code", "# Failed to generate Python code"), language="python")
                 
                 with tabs[1]:
+                    st.subheader("Decompiled C++ Code")
+                    st.code(analysis.get("cpp_code", "// Failed to generate C++ code"), language="cpp")
+                
+                with tabs[2]:
+                    st.subheader("Assembly Code")
+                    assembly = "\n".join(analysis.get("assembly_lines", []))
+                    st.code(assembly, language="asm")
+                
+                with tabs[3]:
+                    st.subheader("Basic Information")
+                    st.json(analysis.get("basic_info", {}))
+                    
+                    st.subheader("Sections")
+                    sections_df = {
+                        "Name": [],
+                        "VirtualSize": [],
+                        "SizeOfRawData": [],
+                        "Entropy": []
+                    }
+                    for section in analysis.get("sections", []):
+                        sections_df["Name"].append(section["Name"])
+                        sections_df["VirtualSize"].append(section["VirtualSize"])
+                        sections_df["SizeOfRawData"].append(section["SizeOfRawData"])
+                        sections_df["Entropy"].append(section["Entropy"])
+                    
+                    st.dataframe(sections_df)
+                
+                with tabs[4]:
                     st.subheader("Exported Functions")
                     st.json(analysis.get("exports", []))
                 
-                with tabs[2]:
+                with tabs[5]:
                     st.subheader("Imported Functions")
                     for imp in analysis.get("imports", []):
                         with st.expander(f"DLL: {imp['DLL']}"):
                             st.code("\n".join(imp["Functions"]))
                 
-                with tabs[3]:
+                with tabs[6]:
                     st.subheader("Strings Found")
                     all_strings = analysis.get("strings", [])
                     interesting_strings = [s for s in all_strings if len(s) > 8]  # Filter out very short strings
-                    st.code("\n".join(interesting_strings[:500]))  # Limit to 500 strings
-                
-                with tabs[4]:
-                    st.subheader("Disassembly")
-                    if "disassembly" in analysis:
-                        st.code(analysis["disassembly"], language="asm")
-                    else:
-                        st.warning("Disassembly not available")
-                    
-                    if "pseudocode" in analysis and analysis["pseudocode"]:
-                        st.subheader("Decompiled Pseudocode")
-                        st.code(analysis["pseudocode"], language="c")
+                    st.code("\n".join(interesting_strings[:500]))  # Limit to 500 strings