Result Details

Design of an Automatically Generated Retargetable Decompiler

ĎURFINA, L.; KŘOUSTEK, J.; ZEMEK, P.; KOLÁŘ, D.; HRUŠKA, T.; MASAŘÍK, K.; MEDUNA, A. Design of an Automatically Generated Retargetable Decompiler. 2nd European Conference of COMPUTER SCIENCE (ECCS'11). Puerto De La Cruz, Tenerife: North Atlantic University Union, 2011. p. 199-204. ISBN: 978-1-61804-056-5.
Type
conference paper
Language
English
Authors
Ďurfina Lukáš, Ing., Ph.D., DIFS (FIT)
Křoustek Jakub, Ing., Ph.D., DIFS (FIT)
Zemek Petr, Ing., Ph.D., DIFS (FIT)
Kolář Dušan, doc. Dr. Ing., DIFS (FIT)
Hruška Tomáš, prof. Ing., CSc., CIS - Director (CIS), DIFS (FIT)
Masařík Karel, Ing., Ph.D., DIFS (FIT)
Meduna Alexandr, prof. RNDr., CSc., DIFS (FIT)
Abstract

Accurate program decompilation is one of the most difficult tasks of reverse engineering. Currently, there exist several single-purpose decompilers targeted on a particular platform (e.g. Intel x86 architecture and Microsoft Windows OS) and on a particular language. These tools are always hand-written by the author from scratch. This paper presents a concept of a retargetable reverse compiler (i.e. a decompiler). This tool translates platform-specific binary applications into a high-level language (HLL) representation. A Python-like language was chosen as the target language, but the decompiler can be easily extended to other target languages. Our unique solution is automatically generated from the target platform description. It exploits the architecture description language ISAC for describing the target platform and the LLVM Compiler System as the core of the decompiler. The proof of our concept is presented on a Sony PlayStation Portable (PSP) handheld game console. As can be seen from the experimental results, we are able to automatically generate a decompiler producing a highly readable HLL code for this platform while preserving the functional equivalency with the original application.

Keywords

decompilation, reverse engineering, malware, LLVM, Lissom, ISAC

Published
2011
Pages
199–204
Proceedings
2nd European Conference of COMPUTER SCIENCE (ECCS'11)
Conference
2nd European Conference of Computer Science
ISBN
978-1-61804-056-5
Publisher
North Atlantic University Union
Place
Puerto De La Cruz, Tenerife
BibTeX 
@inproceedings{BUT76351,
  author="Lukáš {Ďurfina} and Jakub {Křoustek} and Petr {Zemek} and Dušan {Kolář} and Tomáš {Hruška} and Karel {Masařík} and Alexandr {Meduna}",
  title="Design of an Automatically Generated Retargetable Decompiler",
  booktitle="2nd European Conference of COMPUTER SCIENCE (ECCS'11)",
  year="2011",
  pages="199--204",
  publisher="North Atlantic University Union",
  address="Puerto De La Cruz, Tenerife",
  isbn="978-1-61804-056-5"
}
Projects
Advanced recognition and presentation of multimedia data, BUT, Vnitřní projekty VUT, FIT-S-11-2, start: 2011-01-01, end: 2013-12-31, completed
Centrum excelence IT4Innovations, MŠMT, Operační program Výzkum a vývoj pro inovace, ED1.1.00/02.0070, start: 2011-01-01, end: 2015-12-31, completed
Security-Oriented Research in Information Technology, MŠMT, Institucionální prostředky SR ČR (např. VZ, VC), MSM0021630528, start: 2007-01-01, end: 2013-12-31, running
System for Support of Platform Independent Malware Analysis in Executable Files, TAČR, Program aplikovaného výzkumu a experimentálního vývoje ALFA, TA01010667, start: 2011-01-01, end: 2013-12-31, completed
Research groups
Hardware-Software Codesign research group (RG LISSOM)
Departments
Department of Information Systems (DIFS)
Back to top