Detection and Recovery of Functions and their Arguments in a Retargetable Decompiler

E, Luk #x; Durfina,; Křoustek, Jakub; Zemek, Petr; Kábele, Břetislav

doi:10.1109/wcre.2012.15

Cited by 5 publications

(8 citation statements)

References 16 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Another example is the Microsoft Visual Studio. Nevertheless, program decompilation is still rare because even platform-dependent decompilers are hard to create [2,3].…”

Section: State Of the Artmentioning

confidence: 99%

“…In present, the retargetable decompiler allows decompilation of MIPS, ARM, and Intel x86 executables. The detailed description can be found in [3,4]. …”

Section: Figmentioning

confidence: 99%

“…In the next-step, the front-end performs several static analyses over the LLVM IR code, e.g. detection of functions, removal of statically-linked code, control-flow analysis, recovery of data types [3]. The final phase of front-end is the generation of the proper LLVM IR code that is passed to the middle-end.…”

Section: Křoustek Kolářmentioning

confidence: 99%

See 2 more Smart Citations

Approaching Retargetable Static, Dynamic, and Hybrid Executable-Code Analysis

Křoustek¹,

Kolář²

2013

AIP

View full text Add to dashboard Cite

Abstract:Program comprehension and reverse engineering are two large domains of computer science that have one common goal -analysis of existing programs and understanding their behaviour. In present, methods of source-code analysis are well established and used in practice by software engineers. On the other hand, analysis of executable code is a more challenging task that is not fully covered by existing tools. Furthermore, methods of retargetable executable-code analysis are rare because of their complexity. In this paper, we present a complex platform-independent toolchain for executable-code analysis that supports both static and dynamic analysis. This toolchain, developed within the Lissom project, exploits several previously designed methods and it can be used for debugging user's applications as well as malware analysis, etc. The main contribution of this paper is to interconnect the existing methods and illustrate their usage on the real-world scenarios. Furthermore, we introduce a concept of a new retargetable method -the hybrid analysis. It can eliminate the shortcomings of the static and dynamic analysis in future.

show abstract

“…Another example is the Microsoft Visual Studio. Nevertheless, program decompilation is still rare because even platform-dependent decompilers are hard to create [2,3].…”

Section: State Of the Artmentioning

confidence: 99%

“…In present, the retargetable decompiler allows decompilation of MIPS, ARM, and Intel x86 executables. The detailed description can be found in [3,4]. …”

Section: Figmentioning

confidence: 99%

See 1 more Smart Citation

Approaching Retargetable Static, Dynamic, and Hybrid Executable-Code Analysis

Křoustek¹,

Kolář²

2013

AIP

View full text Add to dashboard Cite

show abstract

“…The Lissom project [7] retargetable decompiler is de veloped to process any executable file, independently of a particular target architecture or object file format [9,10]. It consists of two essential parts-the preprocessing part and the decompiler core (containing the front-end, middle-end, and back-end parts), see Figure 1.…”

Section: Architecture and Conceptmentioning

confidence: 99%

“…Its main advantage over the existing tools lies in its generality-to add support for a new architecture, one has to first describe this architecture, and then utilize the already developed tools to build a decompiler for that architecture. In this way, the development time for adding support for a new architecture can be dramatically decreased [8,9]. The decompiler is freely available in the form of a web service, and is accessible via any commonly used web browser.…”

Section: Introductionmentioning

confidence: 99%

Retargetable machine-code decompilation in your web browser

Ďurfina

Křoustek

Zemek

2013

2013 Third World Congress on Information and Communication Technologies (WICT 2013)

Self Cite

View full text Add to dashboard Cite

Machine-code decompilation, belonging to the area of reverse engineering, has found its applications in many real-world areas. Analysis of malicious software, search for vulnerabilities, and source-code recovery are some of the most important uses. As there exists a diversity of different platforms on which software can be run, an existence of a generic decompiler would be highly appreciated. The present paper describes such a tool.In this paper, we provide a description of a retargetable decompiler that is being developed within the Lissom project.First, we give an introduction into the area of machine code decompilation, including a brief discussion of existing tools. Then, we describe the concept and architecture of the decompiler. As it is available in the form of a web service, we also provide its description. Finally, we summarize our results, present a case study of using the tool for analysing malicious software, and conclude the paper by several remarks on future research.

show abstract