Publication Details

Advanced Static Analysis for Decompilation Using Scattered Context Grammars

ĎURFINA Lukáš, KŘOUSTEK Jakub, ZEMEK Petr, KOLÁŘ Dušan, HRUŠKA Tomáš, MASAŘÍK Karel and MEDUNA Alexander. Advanced Static Analysis for Decompilation Using Scattered Context Grammars. In: Proceedings of the Applied Computing Conference 2011 (ACC'11). Angers: World Scientific and Engineering Academy, 2011, pp. 164-169. ISBN 978-1-61804-051-0.
Czech title
Pokročilé statické analýzy využívající gramatiky s rozptýleným kontextem a jejich aplikace při zpětném překladu
Type
conference paper
Language
english
Authors
Ďurfina Lukáš, Ing. (DIFS FIT BUT)
Křoustek Jakub, Ing. (DIFS FIT BUT)
Zemek Petr, Ing. (DIFS FIT BUT)
Kolář Dušan, doc. Dr. Ing. (DIFS FIT BUT)
Hruška Tomáš, prof. Ing., CSc. (DIFS FIT BUT)
Masařík Karel, Ing., Ph.D. (DIFS FIT BUT)
Meduna Alexander, prof. RNDr., CSc. (DIFS FIT BUT)
Keywords

decompilation, Lissom, static analysis, LLVM IR, scattered context grammars

Abstract

Reverse program compilation (i.e. decompilation) is a process heavily exploited in reverse engineering. The task of decompilation is to transform a platform-specific executable into a high-level language representation, which is usually the C language. Such a process can be used for source code reconstruction, compiler testing, malware analysis, etc. In present, there are several existing decompilers that are able to decompile simple applications. However, we can see a drop-off in terms of the quality of the generated code when the decompiled code is highly optimized (e.g. usage of instruction idioms) or obfuscated (e.g. dead code insertion, register renaming). Optimized or obfuscated applications are usually generated by highly optimizing compilers or metamorphic engines (used by malware authors). In this paper, we present several innovative decompilation methods based on scattered context grammars. These methods are able to effectively decompile optimized or obfuscated code. For demonstration, we used these methods for enhancement of the static analysis phase of an existing decompiler. Experimental results of our solution are presented at the end of the paper.

Published
2011
Pages
164-169
Proceedings
Proceedings of the Applied Computing Conference 2011 (ACC'11)
Conference
Applied Computing Conference, Angers, FR
ISBN
978-1-61804-051-0
Publisher
World Scientific and Engineering Academy
Place
Angers, FR
BibTeX 
@INPROCEEDINGS{FITPUB9767,
   author = "Luk\'{a}\v{s} \v{D}urfina and Jakub K\v{r}oustek and Petr Zemek and Du\v{s}an Kol\'{a}\v{r} and Tom\'{a}\v{s} Hru\v{s}ka and Karel Masa\v{r}\'{i}k and Alexander Meduna",
   title = "Advanced Static Analysis for Decompilation Using Scattered Context Grammars",
   pages = "164--169",
   booktitle = "Proceedings of the Applied Computing Conference 2011 (ACC'11)",
   year = 2011,
   location = "Angers, FR",
   publisher = "World Scientific and Engineering Academy",
   ISBN = "978-1-61804-051-0",
   language = "english",
   url = "https://www.fit.vut.cz/research/publication/9767"
}
Back to top