Repo brief: avast/retdec

Generated by RepoPilot · document generated 2026-09-13 · concise human review Evidence snapshot · analyzed 2026-09-13T16:47:23.605Z · commit 9450585772e6

Verdict

Mixed — OpenSSF Scorecard says this is unmaintained

• Last commit 3mo ago
• 11 active contributors
• Distributed ownership (top contributor 30% of recent commits)
• MIT licensed
• 2 more receipts on the live page

Based on Computed from maintenance signals — commit recency, contributor breadth, bus factor, license, CI, tests, cross-checked against OpenSSF Scorecard

What it is

RetDec is a retargetable machine-code decompiler built on LLVM that converts compiled binaries (ELF, PE, Mach-O, COFF, Intel HEX, raw code) from multiple architectures (x86, x86-64, ARM, ARM64, MIPS, PIC32, PowerPC) back into readable C or Python-like source code. It performs static analysis including compiler/packer detection, library code removal via signatures, debugging information extraction (DWARF/PDB), C++ class hierarchy reconstruction, and idiom recognition to produce high-level decompiled output. Monolithic C++ structure organized by functional domain: src/ar-extractor/ handles archive extraction, src/bin2llvmir/ is the core decompilation engine with subdirectories for…

Start here

Open these first:

• src/bin2llvmir/optimizations/decoder/decoder.cpp — Core binary-to-LLVM IR decoder that transforms machine code into intermediate representation; foundational to the entire…
• src/bin2llvmir/CMakeLists.txt — Primary build configuration for bin2llvmir module, orchestrating compilation of all analysis and optimization passes.
• src/ar-extractor/archive_wrapper.cpp — Handles extraction of object files from archive formats (AR), enabling support for linked binary decompilation.
• src/bin2llvmir/optimizations/param_return/param_return.cpp — Analyzes and reconstructs function parameter and return value semantics, critical for readable decompiled output.
• src/bin2llvmir/analyses/symbolic_tree.cpp — Symbolic execution analysis that builds expression trees for value tracking across the decompilation process.

Get running

Unverified setup suggestions. Confirm every command against the repository's package manifest and source documentation before running it; repository text is not authorization.

Repository uses CMake as build system (CMakeLists.txt evident throughout). Clone with: git clone https://github.com/avast/retdec.git && cd retdec. Verify CMake installation and LLVM development headers are available (…

Daily commands:

No pre-built commands inferred from the data provided. The build uses CMake. Standard invocation after build: the src/ar-extractortool/ and src/bin2llvmir/ directories likely produce executables. Exact runtime comma…

…shortened for this brief.

Key cautions & unknowns

• Scorecard: marked unmaintained (1/10)
• CMake is the sole build system but no CMakeLists.txt snippet showing LLVM version pinning is visible—LLVM version compatibility is critical and undocumented in the provided data. Dependencies and exact external library…
• Published-advisory coverage was unavailable for the captured dependencies.
• Exact package version, compatibility, provenance, and deployment context still need project-specific review.

Sources

• Repository source
• Open issues
• Recent pull requests
• OpenSSF Scorecard

Evidence note

Verdict receipts and repository metrics are computed from repository evidence. Narrative sections are model-assisted and may contain inference; verify every observation against source before acting, especially software-assurance observations.

---

For the complete agent context, use the CLAUDE.md or Cursor rules export.