Decompile · Disassemble
Decompilation / Disassembly
What is decompiling?
- Turning machine code back into readable form
- The result is an inferred reconstruction, not the original
- Code you ship can be read by others
The source code a developer writes is converted into machine code that a computer runs, through a process called compilation. In the process, most of the information meant for people is discarded, such as variable names, comments, and the intent behind how functions were split. Disassembly translates machine code line by line into assembly language, one instruction at a time. Decompilation analyzes those groups of instructions and reassembles them into a high-level form where conditionals and loops are visible. The result is not the original but an estimated reconstruction of 'code that probably looked like this,' which is why it is commonly called pseudocode.
Think of it as translating a translation back into the original language. Much of the meaning returns, but the original author's style and word choices do not. That is why decompiled code shows function names like FUN_00401a20, which mean nothing to a reader. Recently, AI has gone a step further: it can read this output and add names and explanations, such as 'This function appears to check a password,' which has sped up analysis considerably.
If you ever need to look at decompiled output at work, the way to read it is simple. Before function or variable names, look at which files it opens, where it sends data, and under what conditions it stops. That is where the skeleton of its behavior shows. These days, the fastest starting point is to paste the output into an AI and ask, 'Explain what this code does in business terms.'
Not every program reads equally well. Programs deployed in an intermediate form, such as Java, .NET, and JavaScript, can be recovered fairly close to the original, while programs built in C or C++ come out much rougher. Web JavaScript in particular can be downloaded by anyone through a browser, so an API key or admin address placed in front-end code is not hidden. As more departments build internal tools with vibe coding, incidents are common where people put secrets in front-end code without realizing this. Obfuscation techniques can make analysis harder, but they only slow it down and cannot stop it completely.
Jaryong KooMarketing PhD and leading authority on AI, data analytics, and personal branding
Seolyeong ParkGenerative AI and AX training specialist with 17 years of hands-on experience and 200+ sessions, making AI usable even for non-specialists| Category | Disassembly | Decompile |
|---|---|---|
| Output | Assembly language (instruction level) | Pseudocode (C-like high-level language) |
| Reading difficulty | Specialist use | Readable by most developers |
| Accuracy | 1:1 match with machine code | Structure is inferred and rebuilt |
It was first used in the 1960s, when companies switched computer models and needed to port old programs that had no source code to the new machines. In 2019, the U.S. National Security Agency (NSA) released its internal analysis tool Ghidra as open source, making the technique available to anyone without expensive commercial tools.
Consider a hypothetical case. The marketing team at Company A, a food distributor with 390 employees, used vibe coding to build an internal web tool in two weeks that has AI sort customer inquiries. It had been opened to the internet so external partners could view it too.
- Yoon, an assistant manager on the IT team, was running a security check. Using the browser developer tools, Yoon downloaded this page's JavaScript and read it, and found the key to the company's AI service billing account sitting in it in plain text.
- Seo, a manager on the marketing team, said, 'The code is behind the screen, so I thought no one could see it.' Yoon explained that any code delivered to the browser is effectively public.
- Checking the usage log showed that about 18% of requests over the past month were calls that never came from inside the company. Assistant Manager Yoon revoked the key on the spot and issued a new one.
- In the new version, AI calls were rerouted through the company's own server so the key stays on the server only, and partner access was restructured so it opens only after login.
- Afterward, the marketing team agreed that any web tool they build themselves would go through the IT team's front-end code secrets check before being opened to outside users. In the first quarter, that check caught two of the same problem before release.