Decompilation of binary programs

Abstract

The structure of a decompiler is presented, along with a thorough description of the different modules that form part of a decompiler, and the type of analyses that are performed on the machine code to regenerate high‐level language code. The phases of the decompiler have been grouped into three main modules: front‐end, universal decompiling machine, and back‐end. The front‐end is a machine‐dependent module that performs the loading, parsing and semantic analysis of the input program, as well as generating an intermediate representation of the program. The universal decompiling machine is a machine‐ and language‐independent module that performs data and control flow analysis of the program based on the intermediate representation, and the program's control flow graph. The back‐end is a language‐dependent module that deals with the details of the target high‐level language. In order to increase the readability of the generated programs, a decompiling system has been implemented which integrates a decompiler, dcc, and an automatic signature generator, dccSign. Signatures for libraries and compilers are stored in a database that is read by the decompiler; thus, the generated programs can make use of known library names, such as WriteLn() and printf(). dcc is a decompiler for the Intel 80286 architecture and the DOS operating system. dec takes as input binary programs from a DOS environment and generates C programs as output. Sample code produced by this decompiler is given.

A comparison of code similarity analysers

“…Many decompilers have been invented in the literature for various programming languages (Cifuentes and Gough 1995;Proebsting and Watterson 1997;Desnos and Gueguen 2011;Mycroft 1999;Breuer and Bowen 1994). Several techniques are involved to successfully decompile a program.…”

“…Given a low-level language program such as an executable file, a decompiler generates a high-level language counterpart that resembles the (original) source code. This has several applications including recovery of lost source code, migrating a system to another platform, upgrading an old program into a newer programming language, restructuring poorly-written code, finding bugs or malicious code in binary programs, and program validation (Cifuentes and Gough 1995). An example of using the decompiler to reuse code is a well-known lawsuit between Oracle and Google (United States District Court 2011).…”

An Abstract Interpretation-Based Framework for Control Flow Reconstruction from Binaries

“…An obvious area is reverse engineering and in particular decompilation, where one aims to recover information about the original program, or preferably a close approximation of the original source code, from a compiled binary [11][12][13]. The compiler literature knows the concept of link-time-and post-link-optimizers [14,7], which exploit the fact that the whole program including libraries and hand-written assembly routines can be analyzed and optimized at linktime, i.e., after all code has been translated to binary with the symbol information still present.…”

A Fast Static Analysis Approach to Detect Exploit Code Inside Network Flows

“…Instruction recovery is central to static analysis and there are two general approaches -1) linear sweep, which begins decoding from the first byte, and 2) recursive traversal [9], which follows instruction flow as it decodes. The first approach is straightforward with the underlying assumption that the entire byte stream consists exclusively of instructions.…”