r2dec: a pseudo-C decompiler for radare2, written in JavaScript

A radare2 plugin, not a standalone decompiler

r2dec-js is described as a JavaScript-based decompiler that converts assembly code into pseudo-C, and its stated purpose is to help users understand assembly by giving readable high-level explanations, which makes low-level programming more accessible and helps with debugging across hardware platforms. The important framing is that this is a radare2 plugin. The software requirements are a single line: it requires radare2. The usage sequence is three steps. You open your file with radare2, you analyse the function you want to disassemble with the af command, and then you run the plugin with pdd. That last precondition is worth internalising, because the plugin works on what radare2 has already analysed, and a function that has not been analysed has no structure for it to work from. The tool is aimed at a person already inside radare2 rather than at someone who wants a decompiler as a separate application.

Installing through r2pm, or building the shared library by hand

The package manager route is two commands.

# initialize the r2pm database
$ r2pm -U
# install r2dec via r2pm
$ r2pm -i r2dec

The first command initialises the r2pm database and the second installs the package. If you would rather build it yourself, the manual path is to clone the repository, run meson setup build to create the build folder, and run ninja -C build install to build the shared library and install it. That is a Meson and Ninja build rather than a plain npm install, which is the first hint at how the JavaScript is actually consumed. The repository layout shows the split: a js directory for the JavaScript, a c directory for the native glue, a subprojects directory for the vendored dependencies including the duktape engine that the topics list names, and a tools directory, with a meson.build at the root and an eslint config for the JavaScript side.

The pdd command has a dozen variants, and two of them feed output back into radare2

The plugin's own help text is the best documentation of what it does, and it lists a family of subcommands. Plain pdd decompiles the current function. pdd with a question mark shows the help, and pdd with an asterisk returns the decompiled code to radare2 as a comment via the CCu mechanism. pdda decompiles side by side with the assembly, pddb shows only the scopes, and pddo shows side by side with offsets. pddu installs or upgrades r2dec through r2pm, pdds switches the r2dec branch, and pddi generates the issue data. The two interesting ones are the comment and the opcode modes, because they change the plugin from a viewer into something that annotates the disassembly, and the issue data mode, which is how a bad decompilation gets reported. The reporting path is described in the README as opening the file in radare2, analysing the function, giving the data to the plugin with pddi or pdd with the issue option, and inserting the resulting JSON into an issue.

Command line options, and the radare2 variables that replace typing them

The options list is long and every entry is a rendering or analysis choice. The help option prints the usage. The assembly option shows pseudo next to the assembly, the blocks option shows only scope blocks, and the casts option shows all the casts in the pseudo code. Colors enables syntax colouring, debug stops the plugin from catching exceptions, and html outputs HTML data instead of text. The issue option generates the JSON used for the test suite, and offsets shows the pseudo next to the assembly offset. The paddr option makes all xrefs use physical addresses instead of virtual ones, and xrefs shows the instruction xrefs in the pseudo code. There is also a vars option, in the variables section, that shows local variable definitions, and two ways to return the result, as a comment via CCu and as an opcode via aho.

The same settings are also available as radare2 evaluable variables that you can put in your .radare2rc file, so the plugin can be configured once at startup rather than per invocation.

The pseudo-C output, and how it maps back to the original C

The README's example is the clearest demonstration of the value. A small C function with a loop and a nested if is shown as a radare2 disassembly with local variables named from the stack frame, and then as the pseudo-C the plugin produces from it. The pseudo code has function signatures with explicit integer widths, keeps the local variable names, and rebuilds the while loop and the inner if as structured code. It is not the original source, and the README does not claim it is, but it is close enough that the control flow is legible at a glance instead of requiring you to trace jumps by hand. The decompiled version in the example also fixes up the argument registers into named parameters, which is exactly the part that is tedious to do in your head from a disassembly listing.

Architecture coverage, with the experimental markers spelled out

The supported architecture list is the practical limit of the tool, and the README is careful to mark the ones that are not finished. x86 and x64 are supported, as are arm at 16, 32 and 64 bit, avr, dalvik, mips, ppc at 32 and 64 bit including VLE, sparc and v850. The experimental entries are 6502, 8051, bpf, m68k, superh, wasm and riscv, each labelled as experimental in the list. For firmware work that is a useful spread, since AVR and the 8-bit parts are common in embedded targets and 6502 shows up in retro analysis, but the experimental label means the output quality is not guaranteed on those. The project also publishes a DEVELOPERS.md document for people working on the plugin itself, and a licences directory alongside the repository.

Editorial conclusion

r2dec fits a reverse engineer who already works in radare2 and wants a readable C-shaped view of a function without leaving the tool, particularly when reading firmware or a stripped binary. It does not fit someone who needs a production decompiler, since the output is pseudo-C by construction and the architecture support list marks several targets as experimental. Verify first that your architecture is on the supported list and not marked experimental, and that the function has been analysed with af before the plugin will produce anything useful.

Frequently asked questions

Official sources

1. Issues
2. README
3. Releases
4. wargio/r2dec-js on GitHub