我可以重建 C++来自调试二进制文件的源代码？
我有一个在调试中编译的 C++ 应用程序（使用 MinGW 和 Qt），但我丢失了一些重大更改，因为我团队中的某人忘记在源代码控制管理器中提交他的更改，并用其他更改覆盖了源代码。
当我在调试中运行程序（在 Qt Creator 中）时，我可以在 main 中设置断点，然后查看源代码。
有没有办法仅使用调试二进制文件来重建所有丢失的源文件？手动或自动均可。
谢谢！
I have a C++ application compiled in debug (using MinGW and Qt) but I've lost some major changes because someone in my team forgot to commit his changes in the source control manager and overwrote the source code with other changes.
When I run the program in debug (in Qt Creator) I can set a break point in main and then see the source code.
Is there a way to reconstruct all the source file lost using only the debug binaries? Either manually or automatically.
Thanks!
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（5）
真的吗？找出调试器从哪里获取源代码，然后从那里复制它。
更有可能的是，您的调试器只是抓取系统上与原始文件名具有相同名称/路径的文件（可能是更新的版本，或旧版本等），并且事情恰好对齐。
您无法真正从编译的二进制文件中重新生成原始源代码，因为从 C++ 源代码到编译的二进制文件的转换不是 1 对 1 的关系。有许多（无限......）不同的源文件将编译为相同的二进制文件。无法通过查看二进制文件来了解原始源代码是什么样的。
有些工具可以生成类似于 C++ 源文件的文件，但很可能它看起来与您的原始源文件完全不同。
Really? Find out where your debugger is getting the source code from, and copy it from there.
It's more likely that your debugger is just grabbing a file on your system with the same name/path as the original filename (perhaps a more recent version, or an old version, etc) and things just happen to line up.
You can not truly regenerate the original source form a compiled binary, because the transformation from C++ source to a compiled binary is not a 1 to 1 relationship. There are many (infinitely...) different source files which will compile to the same binary. There is no way to know from looking at a binary what the original source looked like.
There are tools which can generate something which resembles a C++ source file, but more than likely it'll look nothing like your original source.
我认为您实际上可以恢复源代码的可能性很小，但不能从二进制文件本身恢复：如果您真的非常绝望，您可以使用搜索应用程序（例如 Agent Ransack）并在整个驱动器中搜索您知道的字符串模式存在于源代码中。特别是，如果您有页面文件 (pagefile.sys)，请在其中搜索 - 它可能被埋在某个地方。
当我真的非常绝望时，我曾经尝试过这种方法，但当时我的情况有点不同，更适合“搜索和恢复”，因为当IDE崩溃并且整个源文件丢失时我丢失了它（！！！令人讨厌的惊喜！！！）
I think there is a small chance you can actually recover source, but not from the binary itself: If you are really, really desperate, you can use a search application (e.g. Agent Ransack) and search your entire drive for string patterns that you know exist in the source code. In particular, search in your pagefile (pagefile.sys) if you have one - there might be some chance it's buried there somewhere.
I have tried this method once when I was really really desperate, but my situation then was a bit different and more favourable for "search and recover" because I lost it when somehow the IDE crash and the entire source file is lost (!!!! nasty surprise!!!)
我最近不得不通过将 MSVC 编译的程序反编译为汇编程序来重建它 - 没有调试信息，源代码甚至没有进入版本控制。唯一让我从头开始的事情是以前的开发人员使用 API 的示例应用程序作为这个新应用程序的基础。
如果您有调试符号，您至少可以希望获得方法名称。
我发现 rec22 (recstudio.exe) 是我反编译的最佳选择（免费下载）
idaPro 和 hexrays 似乎可能更好（但买不起）
I recently had to rebuild a MSVC compiled program by decompiling it to assembler - no debug info, source didn't even make it to version control. Only thing that saved me from starting from scratch was the previous dev using an example app for the API as the base for this new app.
If you have the debug symbols you can at least hope to get the method names.
I found rec22 (recstudio.exe) to be my best option for decompiling (as a free download)
idaPro and hexrays seemed like it might be better (but couldn't afford to buy)
如果通过“当我在调试中运行程序（在 Qt Creator 中）时，我可以在 main 中设置断点，然后查看源代码。”您实际上的意思是，在调试器内您可以看到旧的良好版本的代码，那么这意味着调试器能够拾取的某个地方仍然存在该源代码的副本。您应该能够（最坏的情况）让调试器找出文件所在的位置。
如果这不是您的意思，我所知道的最好的方法是尝试使用调试器进行某种反汇编。根据更改的复杂性，可以从程序集中推断源代码。
一般来说，即使调试二进制文件也不能重新创建原始源：这就是源的用途。他们确实有符号表和指令->行号映射，可能会有所帮助。
If by "When I run the program in debug (in Qt Creator) I can set a break point in main and then see the source code." you actually mean that inside the debugger you can see the older good version of the code, then that means there's still a copy of that source lying around somewhere that the debugger is able to pick up. You should be able to (worst case) truss the debugger to find out where the files are.
If that's not what you mean, the best I'm aware of is trying to do some sort of disassembly using a debugger. Depending on the complexity of the changes it may be possible to infer the source code from the assembly.
In general even debug binaries aren't designed to be able to recreate the original source: that's what the source is for. They do have the symbol table and instruction->line number maps which may be able to help.
使用
strings程序提取所有 ASCII 字节，然后对它们进行排列。Use the
stringsprogram to extract all the ASCII bytes, then permute them.