Decompilation fails with "Could not acquire a cryptographic context"

[trsh]

Running phase: Input binary to LLVM IR decoding ( 2.36s )
LLVM ERROR: Could not acquire a cryptographic context: Not enough memory resources are available to process this command. (0x8)
Error: Decompilation to LLVM IR failed

Sorry, another issue here

[s3rvac]

Have you taken a look at #73, #387, and #565? There are already three issues dealing with the problem you have reported.

[trsh]

Im on win 64b with 8gb ram. Im using 64b version of this tool with --no-memory-limit and it still fails :(

Running phase: Initialization ( 0.01s )
Running phase: LLVM ( 0.01s )
Running phase: Providers initialization ( 0.01s )
Running phase: Input binary to LLVM IR decoding ( 2.38s )
Error: Decompilation to LLVM IR failed

[s3rvac]

Does the same error happen when decompiling different input files, or just for some of them? Would it be possible to share the input file with us so we can try to reproduce the issue?

[trsh]

Sharing the exe would violate legit stuff :(

[trsh]

I tried it with GIMP executable

Running phase: Initialization ( 0.00s )
Running phase: LLVM ( 0.01s )
Running phase: Providers initialization ( 0.01s )
Running phase: Input binary to LLVM IR decoding ( 0.95s )
Running phase: LLVM ( 21.62s )
Running phase: x87 fpu register analysis ( 22.71s )
Running phase: Main function identification optimization ( 22.96s )
Running phase: Libgcc idioms optimization ( 22.97s )
Running phase: LLVM instruction optimization ( 22.97s )
Running phase: Conditional branch optimization ( 23.40s )
Error: Decompilation to LLVM IR failed

process went further but also died

[SuperKael]

I have what seems to be the same problem. After adding --no-memory-limit, it ran for over 2500(!) seconds, and multiple times during the process peaked its memory usage at a whopping 9.5 GB! The file being decompiled is under 18 MB... it used more than 500 times the memory of the size of the file itself! Something is obviously very wrong here. To be clear, it still finally failed, which coincided with many of my applications simultaneously crashing, probably due to my 32 GB pagefile finally getting full...

Running phase: Initialization ( 0.04s )
Running phase: LLVM ( 0.11s )
Running phase: Providers initialization ( 0.14s )
Running phase: Input binary to LLVM IR decoding ( 6.72s )
Running phase: LLVM ( 495.28s )
Running phase: x87 fpu register analysis ( 505.31s )
Running phase: Main function identification optimization ( 507.75s )
Running phase: Libgcc idioms optimization ( 507.93s )
Running phase: LLVM instruction optimization ( 507.93s )
Running phase: Conditional branch optimization ( 511.07s )
Running phase: Syscalls optimization ( 619.31s )
Running phase: Stack optimization ( 619.33s )
Running phase: Constants optimization ( 763.51s )
Running phase: Function parameters and returns optimization ( 2018.13s )
Running phase: Register localization optimization ( 2351.13s )
Running phase: LLVM instruction optimization ( 2578.77s )
Running phase: Simple types recovery optimization ( 2588.90s )
Error: Decompilation to LLVM IR failed

[silverbacknet]

That sounds fairly normal. Memory usage goes up exponentially with increasing executable size, not linearly. Just a few megabytes does need many gigabytes to reconstruct the complete program logic, as you've seen, though you can bypass individual stages that fail in exchange for worse output. If you can pick out the parts that matter, you can get much faster results that won't up and die like this.

[trsh]

How long can the process take? I'm in "Input binary to LLVM IR decoding" for 3 hrs. Task manager shows changing huge ram usage.

[s3rvac]

High memory and processing-time requirements are one of the issues that we constantly face and which need to be improved. As a rule of thumb, if a decompilation runs more than e.g. 30 minutes, the results probably won't be useful. In such cases, it is suggested to perform selective decompilation (decompile only the given functions via --select-functions or address ranges via --select-ranges) or use our IDA plugin with IDA 7.0 (beware that the plugin does not work with the freeware version though), which also performs selective decompilation.

As for the Could not acquire a cryptographic context errors, in general, I believe they are caused by insufficient memory in the system.

[s3rvac]

I am closing the issue as I do not believe there is anything else to be added here. If you wish to re-open, please share with us one of the executable files that you are unable to decompile so we can investigate. However, please bare with mind the above-mentioned comment of mine.