Snowman is a native code to C/C++ decompiler, see the examples of generated code. It is a fork of SmartDec.

Standalone Version

  • Supports x86 and x86-64 architectures.

  • Reads ELF and PE file formats.

  • Reconstructs functions, their names and arguments, local and global variables, expressions, integer, pointer and structural types, all types of control-flow structures, including switch.

  • Has a nice graphical user interface with one-click navigation between assembler code and reconstructed program.

  • Has a command-line interface for batch processing.

Plug-in for IDA

  • Enjoys all executable file formats supported by the disassembler.

  • Benefits from IDA's signature search, parsers of debug information, and demanglers.

  • Decompiles a chosen function or the whole program by push of a button.

  • Allows easy jumping between the disassembler and the decompiled code.

  • Fully integrated into IDA’s GUI.



Installation Instructions

Standalone version you can just unpack and run.

Plug-in for IDA is installed by copying .plw, .p64, .plx, .plx64 files to IDA’s plugins directory.

Usage Instructions

  1. Do not try to decompile large programs at once. Select a necessary part in the assembly listing and push Ctrl-E instead. Or better use the Snowman Plug-in for IDA.

  2. When using the IDA plug-in, press F4 to decompile the function under cursor.

  3. Submit bug reports and feature requests.


  1. I do not share sources. Currently. This is likely to change in the future.

  2. I am not going to provide OS X and Linux builds, except for the IDA plugin for Linux. The standalone decompiler runs fine under Wine.


  • v0.0.5 (20 September 2014)

    • GUI: added font selection, fixed performance problems, implemented refactoring (no persistence so far), go to function definition, shortcuts for navigation.

    • IDA plug-in: correct handling of imports.

    • PE parser: parsing imports.

    • x86: support for hlt and movsxd instructions.

  • v0.0.4 (17 August 2014)

    • x86: intermediate representation uses less memory, instructions are now printed in Intel assembly style.

    • PE parser: adding ImageBase to section addresses, adding virtual addresses of sections to symbols' values.

    • Dataflow: fixed constant folding for binary not operator.

    • Disassembled instructions are represented using much less memory.

    • Known bugs: structural analysis can produce reduced control flow graphs from which it is impossible to generate code. Beware of assertion failures!

  • v0.0.3 (13 July 2014)

    • x86: correct handling of rip-based addressing.

    • ELF parser: parsing of relocations, correct handling of bss sections, support for byte order.

    • PE parser: correct handling of bss sections, support for byte order.

    • Code generation: generating initial values for global variables, generating function names instead of constants.

    • GUI: symbols view, sorting in sections and symbols views.

    • The decompiler is now distributed under the CC BY-NC-ND 4.0 license.

  • v0.0.2 (4 July 2014)

    • The IDA plug-in works under Windows XP.

  • v0.0.1 (25 June 2014)

    • Initial release.

    • Architectures: x86, x86-64 (150 supported instructions).

    • File formats: ELF, PE.

    • Calling conventions: AMD64, Microsoft64, cdecl, stdcall.

    • Demanglers: MSVC, GNU V3.

    • Symbolic bit-precise byte-order-aware joint reaching definitions and constant folding analysis.

    • Interprocedural type reconstruction.

    • Interprocedural reconstruction of function arguments and return values.

    • Interprocedural reconstruction of variables.

    • Structural analysis of control flow.

    • Ascetic GUI.

    • Plug-in for IDA.