Your Web3 Partner enabling innovation and rapid development

Download EX4 To MQ4 Decompiler v4.0.509.5

(SUPPORTS ALL OLD BUILD FILES)

This decompiler supports all old build files up to build 900.

Our EX4 to MQ4 decompiler for new build files supports protected files, broken files, new build files, third party encrypted files, EX5 files, market files and files with dll encryptions. Source codes are 100% accurate.

How to Decompile EX4 TO MQ4 Using Reverse Engineering and Memory Dumping

Note – “Before attempting to work with complex EX4 files, it can be very useful to first practise with smaller training programs known as crackmes. Sites like cracksme.de provide these safe challenges so you can build confidence with breakpoints, debugging, and bypassing checks before applying the same skills to a MetaTrader EX4.”

discord

support@x36dbg.com 

In this tutorial, you will learn in detail how to decompile ex4 to mq4 (up to build 600) by understanding the principles of reverse engineering and memory dumping, while making use of tools such as the ScyllaHide plugin and the x32dbg debugger. The purpose here is educational, helping you understand the relationship between compiled EX4 files and the original MQ4 source structure.

In order to reach our target we need to accomplish the following points:

1 – You need to use the x32dbg or x64dbg debugger

The very first thing you need is a reliable debugger, either x32dbg or x64dbg, depending on whether the target process is 32-bit or 64-bit. These tools allow you to attach to a running MetaTrader 4 process that has the EX4 file loaded. By attaching the debugger, you gain the ability to pause execution, inspect instructions, and trace how the program behaves in real time. This is the foundation of exploring how EX4 code is executed and is the starting point in the path of going from ex4 to mq4.

2 – Install the scyllahide plugin

The next stage is to install the ScyllaHide plugin, which is used alongside x32dbg or x64dbg. ScyllaHide is often introduced to show how programs try to detect debuggers and how analysts counter those protections. MetaTrader EX4 files often include anti-debugging tricks, and without a plugin like this, the process could terminate or give false results. By setting up ScyllaHide, you create a controlled environment that allows you to step through the execution without being blocked.

3 – Find the breakpoint of OnInit() or Start() method

After setting up the debugger, the educational task is to locate the OnInit() or Start() method. These are the common entry points in many MQ4 indicators and Expert Advisors. By placing a breakpoint here, you can observe what instructions are loaded into memory at the beginning of execution. Watching these entry points in action helps connect the dots between the human-readable MQ4 code and the machine-level EX4 instructions.

4 – Bypass the ExpertRemove() and Init_Failed()

Once inside the execution flow, you often encounter functions like ExpertRemove() or Init_Failed(). These are safety functions used by MetaTrader to prevent interference or to shut down execution if something looks suspicious. The educational lesson here is about recognizing how software developers design defensive routines. Understanding these checkpoints shows you why straightforward attempts to decompile ex4 rarely succeed and why reverse engineering always involves studying protective layers first.

5 – Dump patch ex4 from allocated memory

At this stage, you take the idea of memory dumping and apply it to the loaded EX4. Dumping simply means capturing the file as it appears in memory at runtime. Since the file in memory has already been unpacked and processed by the platform, you are able to examine its structure more closely. This is where concepts like patching and reconstructing come into play, as the dumped EX4 can now be compared against the expected MQ4 logic.In order to decompile such files, we need to use the reverse engineering and memory dumping, we already made a big progress with reverse engineering process

6 – Analyze the dumped EX4 for structural patterns

After performing the dump, the real educational work begins. Instead of focusing only on a raw binary, you can now analyze the structural patterns that reveal how MQ4 functions might have been represented in the compiled file. This step involves carefully inspecting code blocks, data references, and repeated structures. Even though the exact MQ4 source is not immediately available, by analyzing these patterns you learn how source-level instructions are translated into compiled machine-level logic.

7 – Document and compare the findings to MQ4 logic

Finally, the knowledge gained should be documented. By writing down which parts of the EX4 correspond to known MQ4 functions, variables, or structures, you create an educational map that helps understand the decompilation process better. This is also the step where you begin to see the limitations of any attempt to decompile ex4 to mq4 directly, because while some structural details can be recovered, much of the original code formatting and comments are lost.

The attached indicator is a ex4 build with 600+

This is the x32dbg debugger, we use this debugger to attach the MT4 process, and to search for the name of the ex4

We search for a specific text by right clicking the debugger Search for -> Current module -> String references

We search for the ex4 indicator name and we double click it

By that way, we caught the location of the indicator in the memory

Now we need to search ExpertRemove(). This function is jumping point, which is used by Metaquote to stop us from accessing the content of the indicator. So we should bypass this function.

We arrived to that point in our cracking and decompiling ex4 to mq4.

*This tutorial is for educational purposes only!

https://x64dbg.com

https://github.com/x64dbg/ScyllaHide