Evolving Exact Decompilation

Abstract

We introduce a novel technique for C decompilation that provides the correctness guarantees and readability properties essential for accurate and efficient binary analysis. Given a binary executable, an evolutionary search seeks a combination of source code excerpts from a "big code" database that can be recompiled to an executable that is byte-equivalent to the original binary. Byte-equivalence ensures that a successful decompilation fully reproduces the behavior, both intended and unintended, of the original binary. Moreover, the decompiled source is typically more readable than source obtained with existing decompilers, since it is generated from human-written source code excerpts. We present experimental results demonstrating the promise of this novel, general, and powerful approach to decompilation. This material is based upon work supported by the SPAWAR Systems Center Pacific under Contract No. N66001-13-C-4046. this imbalance, we use evolutionary search that leverages the compilers themselves, enabling decompilation across compiler, ISA, and source language.

Get Rid of Inline Assembly through Verification-Oriented Lifting

“…Soundness is addressed by two recent works. Schulte et al [18] use search-based techniques to generate source-code producing byte-equivalent binaries to the original executable. This technique, when it succeeds, ensures soundness by design but it is only applied to small examples, with limited success.…”

“…In the end, TINA roughly generates one C statement per assembly instruction for the chunks of the Debian distribution. 13 "movq (%1, %0), %%mm1 \n\t" // T 14 "movq -1(%2, %0), %%mm2 \n\t" // L 15 "movq (%2, %0), %%mm3 \n\t" // X 16 "movq %%mm2, %%mm4 \n\t" // L "psubb %%mm0, %%mm2 \n\t" 18 "paddb %%mm1, %%mm2 \n\t" // L + T -LT 19 "movq %%mm4, %%mm5 \n\t" // L 20 "pmaxub %%mm1, %%mm4 \n\t" // max(T, L) 21 "pminub %%mm5, %%mm1 \n\t" // min(T, L) 22 "pminub %%mm2, %%mm4 \n\t" 23 "pmaxub %%mm1, %%mm4 \n\t" 24 "psubb %%mm4, %%mm3 \n\t" // dst -pred 25 "movq %%mm3, (%3, %0) \n\t" 26 "add $8, %0 \n\t" 27 "movq -1(%1, %0), %%mm0 \n\t" // LT 28 "cmp %4, %0 \n\t" 29 " jb 1b \n\t" 30 : "+r" (i) 31 : "r" (src1), "r" (src2), 32 "r" (dst), "r" ((x86 _ reg) w)); Sec. VII-D refers to a ffmpeg function accessing index −1 of its input buffer.…”

“…Yet, as they mostly aim at helping reverse engineers, correctness is not their main concern. Actually, "existing decompilers frequently produce decompilation that fails to achieve full functional equivalence with the original program" [18]. Some recent works partially target this issue: Schwartz et al [19] do not demonstrate correctness (they instead measure a certain degree of it via testing), while Schulte et al [18] use a correct-bydesign but intractable (possibly non-terminating) search-based method.…”

Imprecision in WCET estimates due to library calls and how to reduce it (WIP paper)

“…One obvious way to circumvent the problem of missing sources, is to decompile all such functions back to source code. There have been many attempts at decompiling assembly code to source code, both specifically to timing analysis and as a general tool [17]. However, the decompiled code is typically less precise than the original, due to the information that is lost during compilation [9].…”

“…However, this puts more burden on the decompiler, terms of how it is allowed to reconstruct source control flows from binary ones. Moreover, the decompiler must be sound itself, which appears to be difficult with available tools [17].…”