A New Algorithm for Identifying Loops in Decompilation

Abstract

Abstract. Loop identification is an essential step of control flow analysis in decompilation. The Classical algorithm for identifying loops is Tarjan's intervalfinding algorithm, which is restricted to reducible graphs. Havlak presents one extension of Tarjan's algorithm to deal with irreducible graphs, which constructs a loop-nesting forest for an arbitrary flow graph. There's evidence showing that the running time of this algorithm is quadratic in the worst-case, and not almost linear as claimed. Ramalingam presents an improved algorithm with low time complexity on arbitrary graphs, but it performs not quite well on "real" control flow graphs (CFG). We present a novel algorithm for identifying loops in arbitrary CFGs. Based on a more detailed exploration on properties of loops and depth-first search (DFS), this algorithm traverses a CFG only once based on DFS and collects all information needed on the fly. It runs in approximately linear time and does not use any complicated data structures such as Interval/Derived Sequence of Graphs (DSG) or UNION-FIND sets. To perform complexity analysis of the algorithm, we introduce a new concept called unstructuredness coefficient to describe the unstructuredness of CFGs, and we find that the unstructuredness coefficients of these executables are usually small (<1.5). Such "low-unstructuredness" property distinguishes these CFGs from general singleroot connected directed graphs, and it offers an explanation why those algorithms existed perform not quite well on real-world cases. The new algorithm has been applied to 11526 CFGs in 6 typical binary executables on both Linux and Window platforms. Experimental result has validated our theoretical analysis and it shows that our algorithm runs 2-5 times faster than the Havlak-Tarjan algorithm, and 2-8 times faster than the Ramalingam-Havlak-Tarjan algorithm.

Analyzing Runtime and Size Complexity of Integer Programs

“…So this is a special case of a loop extraction technique, in which we introduce additional constraints on the data flow. In future work, it could be interesting to investigate whether other loop extraction techniques (e.g., [Wei et al 2007]) could be used to further improve precision of our analysis.…”

Stepwise structural verification of cyclic workflow models with acyclic decomposition and reduction of loops

“…The worst-case complexity is O(|N| × |E|) where |N| and |E| are a number of nodes and a number of edges, respectively. • Step 1.2 -The complexity of determining loop-nesting forest is O(|N| + k|E|) where k is a small unstructuredness coefficient [56]. In addition, extra computation is required for all irreducible loops sharing their entries with their child natural loops.…”

“…To clearly show such relationship, various kinds of loop-nesting forests are introduced e.g. Sreedhar-Gao-Lee's forest, Steensgard's forest, and Halvak's forest [52][53][54][55][56]. The graph in Fig.…”

“…Such a phenomenon induces a structure called loop-nesting forest, which can be determined in almost linear time by utilizing depth-first-search variations [52][53][54][55][56]. In the loop-nesting forest, either two loops are disjoint or one is nested within the other.…”

Visual MPI Performance Analysis using Event Flow Graphs

“…Algorithms for cycle detection in graphs have been studied for years [16,9,18]. Our graph visualization framework implements the algorithm in [20]. This algorithm traverses the graph only once with a depth-first search (DFS) and runs in almost linear time.…”