Seconding Hex-rays, but if you can't justify that cost, Boomerang might work.
Answer from Serafina Brocious on Stack OverflowVideos
So you had a cow, but you inadvertently converted it to hamburger, and now you want your cow back.
Sorry, it just doesn't work that way.
Simply restore the source file from your backups.
Ah, you didn't have backups. Unfortunately, the universe doens't give you a break for that.
You can decompile the binary. That won't give you your source code, but it'll give you some source code with the same behavior. You won't get the variable names unless it was a debug binary. You won't get the exact same logic unless you compiled without optimizations. Obviously, you won't get comments.
I've used Boomerang to decompile some programs, and the result was more readable than the machine code. I don't know if it's the best tool out there. Anyway, don't expect miracles.
Several tools are common in reverse engineering an executable.
- The command "file" which takes the file path as the first parameter so you can determine (in most cases) what type of executable you have.
- Disassemblers which show EXACTLY what the executable does but is difficult to read for those that don't write assembly code on that specific architecture or have experience with disassembly.
- Decompilers like Boomerang, Hex-rays, and Snowman can provide some greater readability but they do not recover the actual variable names or syntax of the original program and they are not 100% reliable, especially in cases where the engineers that created the executable tested with these packages and tried to obfuscate the security further.
- Data flow diagrams or tables. I know of no free tool to do this automatically, but a Python or Bash script over the top of a text parser of the assembly output (which can be written in sed or Perl) can be helpful.
- Pencil and paper, believe it or not, for jotting flows and ideas.
In most cases I've seen, the code needed to be rewritten from scratch, maintained as an assembly language program, or reconstituted by re-applying change requests to an older version.