An Environment for the Reverse Engineering of Executable Programs. Cristina Cifuentes. Department of Computer Science, University of Tasmania

Transcription

1 A Eviromet for the Reverse Egieerig of Executable Programs Cristia Cifuetes Departmet of Computer Sciece, Uiversity of Tasmaia GPO Box 252C, Hobart Tas 7001, Australia Abstract Reverse egieerig of software systems has traditioally cetered upo the geeratio of high-level abstractios or specicatios from high-level code or databases. I this paper we report o a reverse egieerig eviromet for low-level executable code: a reverse compilatio or decompilatio eviromet that aids i the uderstadig of the uderlyig executable program. The reverse compilatio process recovers high-level code from executable programs at a higher represetatio level tha that produced by disassemblers; i fact, disassembly is part of the rst stage i this process. Several tools aid i the process of reverse compilatio, these are: loaders, sigature geerators, library prototype geerators, disassemblers, library bidigs, ad laguage to laguage traslators. The itegratio of these tools i the whole process is preseted i this paper. The results obtaied by the prototype reverse compilatio system dcc are ecouragig: high-level code is regeerated with correct use of expressios ad cotrol structures, ad the complete elimiatio of registers ad coditio codes. A elimiatio rate of low-level istructios of over 75% was reached, represetig the overall improvemet this decompiler system has made over previous decompilers ad disassemblers (where the rate teds to be il). A sample decompilatio program is give. Keywords: reverse egieerig, reverse compiler, disassembler, sigatures, DOS, i80286, C laguage. 1 Itroductio Reverse egieerig of software systems has bee de- ed as the aalysis of a subject system to idetify the system's compoets ad their iterrelatioships, ad to create a represetatio of the system i aother form or at a higher level of abstractio [1]. The aim of reverse egieerig of software systems is to gai a This research was partly fuded by Australia Research Coucil (ARC) Grat No.A while the author was with the Queeslad Uiversity of Techology, Brisbae, Australia. uderstadig of the system ad its structure for the purposes of maiteace, which is ulike the case of reverse egieerig of hardware systems where the system is ormally aalyzed to create a duplicate copy of it. Most reverse egieerig eviromets reported i the literature cocetrate o the geeratio of high-level specicatios or graphical represetatios for Cobol ad Fortra source code [2, 3], ad the extractio of desig represetatios ad specicatio documets from source code [4]. Also, the recovery of desig iformatio from a database has bee icorporated ito CASE (Computer-Aided Software Egieerig) tools such as ADW. I this paper we cocetrate o reverse egieerig tools at a lower level: tools that recover high-level source code from executable programs. Tools i this category iclude disassemblers, debuggers, decompilers, disk editors, ad upackig utilities; we are iterested i disassemblers ad decompilers. It has log bee argued that decompilers are dicult to write due to the variety of output of each vedor's compiler [5], i this paper we preset a suite of tools that help i the process of decompilatio ad disassembly. A disassembler is a program that reads a executable program ad traslates it ito a equivalet assembler program; a decompiler goes a step further by traslatig the program ito a equivalet high-level laguage (such as C or Pascal) program. I both cases, the executable program to be traslated is a arbitrary program compiled from ay high-level laguage. I geeral, a decompiler comprises a disassembler sice this step is itermediate i the geeratio of high-level code. As with most reverse egieerig tools, disassemblers ad decompilers are semi-automated tools rather tha fully automated tools. 1.1 Uses of decompilatio i the 90s Traditioally, decompilatio has bee used to help i the migratio of computer software from a old to a ew machie architecture. I the 90s, with the advet of high-performace machies, a trasitioal migratio platform is eeded to provide users with the same soft-

2 ware they ru o their soo-to-become-old-machies, o the ew machie. A techique kow as biary traslatio was developed which makes use of disassembly ad decompilatio techiques, but which also provides a ru-time support eviromet to ru code that could ot be successfully traslated to the ew machie; this eviromet was rst developed by Digital to aid i the traslatio of VAX ad mx software to the ew Alpha machie [6]. As with the Alpha biary traslatio eviromet, several other uses of decompilatio require other tools to help i the process of extractio of high-level iformatio. This is maily due to the fact that software has become very large ad complex, ad also because decompilatio o its ow is a icomplete process. I the UK, the Nuclear Electric plc developed a decompiler to verify the code produced by a proprietary compiler; such code was to be ru i PROM i a safety critical eviromet ad therefore the compiler was ot trusted. Their eviromet icorporated a decompiler that made use of data type iformatio from the origial high-level laguage program, decompiled the executable program, ad determied whether the high-level code regeerated was similar i fuctioality to the iitial high-level code [7]. Also i the UK, a group at Oxford Uiversity has worked o the automatic geeratio of decompilers based o compiler specicatios usig logic ad fuctioal laguages [8, 9], ad recetly such approach was used to geerate a decompiler for a subset of a C++ compiler [10]. This research was aimed at the provisio of reverse egieerig tools for maiteace. I Chia, a decompiler for 8086 executable programs compiled with the Microsoft C Versio 5.0 compiler was writte [11]. This decompiler made use of the recogitio of library fuctios by a had-crafted method. A attempt at high-level data type recogitio, such as arrays ad structures is metioed but ot much detail is give i the paper. The use of this decompiler is ot metioed either. I Australia, the dcc decompiler was writte to help i the detectio of virus code i a executable program, ad to aid i the maiteace of legacy code by the extractio of source code from these systems [12]. I the former case, the decompiler reports o ay suspicious malicious code i the commets of the geerated high-level laguage program, ad i the latter case the decompiler produces a high-level program that aids i the uderstadig of the legacy system, which ca the be rewritte i a dieret (ewer) laguage. 1.2 The eed for extra tools There are several theoretical ad practical limitatios for writig decompilers. Some of these problems ca be solved by the use of heuristic methods, others caot be determied completely. Due to these limitatios, a decompiler performs automatic program traslatio of some source programs, ad semi-automatic program traslatio of other source programs. This diers from a compiler, which performs a automatic program traslatio of all source programs, but is ilie with the semi-automatio of reverse egieerig tools [13]. The mai problem i disassembly derives from the represetatio of data ad istructios i the Vo Neuma architecture: they are idistiguishable. Thus, data ca be located i betwee istructios, such as may implemetatios of idexed jump (case) tables. This represetatio alog with idioms 1 ad selfmodifyig code practices makes it hard to disassemble a executable program. I fact, the separatio of data ad istructios is usolvable i geeral as if there was a algorithm to determie such separatio, this algorithm would also solve the haltig problem [14]. Aother problem is the great umber of subrouties itroduced by the compiler ad the liker, ad boud i the executable program. The compiler itroduces startup subrouties that set up its eviromet, ad rutime support routies wheever required. These routies are ormally writte i assembler ad i most cases are utraslatable ito a higher-level represetatio. Also, i operatig systems that do ot provide a mechaism to share libraries, executable programs are self-cotaied ad library routies are boud ito each biary image. Library routies are either writte i the laguage the compiler was writte i or assembler. This meas that a executable program cotais ot oly the routies writte by the programmer, but a great umber of other routies liked i by the liker. For example, a \hello world" program compiled i C geerates over 25 dieret subrouties i the executable program. The same program compiled i Pascal geerates more tha 40 subrouties. Whe decompilig this example, we are oly iterested i the mai() subroutie, rather tha the other 25 or so subrouties. 1.3 Legal issues Several questios have bee raised i the last years regardig the legality of decompilatio. A debate betwee supporters of decompilatio who claim fair com- 1 A idiom is a sequece of istructios which form a logical etity, ad which take together have a meaig that caot be derived by cosiderig the primary meaigs of the istructios.

3 petitio is possible with the use of decompilatio tools, ad the oppoets of decompilatio who claim copyright is ifriged by decompilatio, is curretly beig held; i fact, this debate has bee reported i the literature sice 1984 [15]. The law i dieret coutries is beig modied to determie i which cases decompilatio is lawful. At preset, commercial software is beig sold with software agreemets that ba the user from disassemblig or decompilig the product. For example, part of the Lotus software agreemet reads like this: You may ot alter, merge, modify or adapt this Sofware i ay way icludig disassemblig or decompilig. It is ot the purpose of this paper to debate the legal implicatios of decompilatio. This topic is ot further covered i this paper. The rest of this paper is structured i the followig way: x2 describes a complete reverse compilatio system, x3 reports o results achieved by the implemetatio of the dcc system, x4 provides a sample decompilatio of a bechmark multiplicatio program, x5 compares this work with previous work, ad x6 provides the coclusios of this work. 2 A reverse compilatio system The steps ivolved i a typical \decompilatio" of a cotemporary executable program are show i Figure 1. I this gure, all text i boxes represet tools that aid i the process of decompilatio; all other text represets data les. This system is completely automated ad provides partial results which aid i the uderstadig of the uderlyig program. I geeral, oe ca cosider the user to be aother source of iformatio i this process, i particular whe separatig data from code; this optio was ot icluded i this system. 2.1 Loader Typical iformatio cotaied i a executable program is: the header (which cotais iformatio o the sizes of segmets, default values for registers, ad the etry-poit to the program), the relocatio table, the code segmet ad the data segmet. The loader reads the header iformatio of the executable program, determies the amout of memory required to load the biary image of the program (both code ad data segmets), allocates memory, loads it, ad performs relocatio of the data elemets foud i the relocatio table. The loader also determies the etry-poit to the program. 2.2 Sigature geerator The sigature geerator is a program that automatically determies library sigatures. A sigature is a biary patter that uiquely ideties each compiler ad each library subroutie of a particular library le. The use of these sigatures attempts to reverse the task performed by the liker, which liks i compiler start-up code ad library subrouties ito the executable program. The disassembler ad decompiler uses this iformatio to determie liked-i subrouties that are ot required to be aalyzed but rather elimiated (i the case of start-up code) or replaced by their ame (i the case of library routies). All other subrouties are likely to have bee user compiled from the iitial high-level laguage program. Library sigatures are eeded for statically-liked libraries, which is the case of all DOS executable programs ad of Widows programs that do ot use DDLs (dyamic-lik libraries). For example, i the compiled C program that displays \hello world" ad has over 25 dieret subrouties i the executable program, 16 subrouties are added by the compiler to set-up its eviromet, 9 routies that form part of pritf() are added by the liker, ad 1 subroutie oly forms part of the iitial C program. The determiatio of library sigatures aids i the matchig of pritf() ad its complete subtree of subrouties called. Compiler sigatures aid i the determiatio of the real etry-poit to the mai program (rather tha to the code itroduced by the compiler for settig up of the eviromet), hece allowig the disassembler ad decompiler to skip all compiler set-up routies (16 i this example). The use of a sigature geerator ot oly reduces the umber of subrouties to aalyze, but also icreases the documetatio of the al programs by usig library ames rather tha arbitrary subroutie ames. The lookup of these sigatures ca be implemeted with a perfect miimal hashig algorithm, hece a costat O(1) lookup is expected at all time to determie whether a subroutie matches a sigature of ay kow subroutie sigatures i the library. A automatic method for geeratig library sigatures is described i [16, 17]. 2.3 Prototype geerator The prototype geerator is a program that automatically determies the types of the formal argumets of library subrouties, ad the type of the retur value for fuctios. For C programs, these prototypes are derived from the library header les provided with ay C compiler; i the case of Pascal, this iformatio is stored i the library le itself ad hece it ca be determied by parsig this le. This iformatio is used by the decompiler to determie the type of the argumets to library subrouties, the umber of such argumets (wheever possible), ad the retur type of fuctios.

4 executable program (relocatable machie code) loader absolute machie code disassembler assembler program decompiler HLL program postprocessor HLL program 9 XXy XX XX libraries sigature geerator library sigatures compiler sigatures library bidigs library headers prototype geerator library prototypes Figure 1: A decompilatio system 2.4 Disassembler The disassembler parses the biary image of the program to traslate it to assembler. With the aid of compiler sigatures, the disassembler rstly determies if the rst bytes at the etry poit provided by the loader match a kow compiler sigature, if so, the real etrypoit to the mai program ca be determied ad code is disasssembled from this poit owards. If o compiler sigature is matched, code is disassembled from the give etry-poit, ad hece all the compiler's setup routies are disassembled. Note that the use of compiler sigatures is doe without lose of geerality; the disasembler performs the same parsig algorithm based o ay give etry-poit. The mai problem ecoutered by the disassembler is determiig what is data ad what is a istructio. Parsig of the program is performed by traversig all paths from the program's etry-poit, assumig that all paths are followed i the program. New paths are determied by trasfers of cotrol to other sectios of code (i.e. ew etry-poits) by meas of coditioal or ucoditioal jumps, or subroutie calls. The algorithm stops whe all paths have bee searched. Note that some paths may be oly partially searched due to a istructio that caot be decoded. I geeral, such is the case for idexed or idirect jumps which rely i the value i a register. I some cases, heuristics ca be applied to determie the bouds of the register, for example, i the implemetatio of idexed case istructios. Wheever a istructio caot be decoded, it is agged for commetig durig the geeratio of the al high-level program. This covetioal approach is able to disassemble a great percetage of the executable program. A disasembler o its ow ormally oly geerates a assembler program, but, if used as part of a decompiler, it also eeds to provide a cotrol ow graph of the program (i.e. the call graph with cotrol ow graphs attached to each subroutie ode). This graph is eeded for the aalysis that the decompiler performs. 2.5 Decompiler The decompiler trasforms a low-level represetatio of a program ito a high-level laguage represetatio. I this sectio we treat decompilatio as the complete process of traslatio from the biary image to the high-level laguage program, hece, i this discussio, a disassembler is icorporated as part of the decompiler, ad assembler code is used as the itermediate code which is aalysed ad trasformed by the decompiler. Coceptually, a decompiler is structured i a similar way to a compiler, by a series of phases that trasform the source executable program from oe represetatio to aother. These phases are grouped for implemetatio purposes ito three dieret modules: frot-ed, udm, ad back-ed; as see i Figure 2. I theory, the groupig of phases i a decompiler makes it easy to write dieret decompilers for dieret machies ad laguages; by writig dieret frot-eds

5 biary program Frot-ed (machie depedet) udm (aalysis) Back-ed (laguage depedet) HLL program Figure 2: Decompiler modules for dieret machies, ad dieret back-eds for differet target laguages. I practical applicatios, this result is always limited by the geerality of the itermediate laguage used. The frot-ed cosists of those phases that are machie ad machie-laguage depedet. This module parses the biary image of the program (i.e. implemets a disassembler) ad stores it i a itermediate laguage represetatio, aalyzes the disassembled code for the determiatio of base data types such as itegers, log itegers, ad reals, ad costructs the cotrol ow graph of the program. The udm is the uiversal decompilig machie; a itermediate module that is completely machie ad laguage idepedet, ad that performs the core of the decompilig aalysis. Two phases are icluded i this module; 1. Data ow aalysis: this phase improves the itermediate code by elimiatig machie low-level cocepts such as register ad coditio codes, ad by regeeratig high-level laguage cocepts such as expressios. For example, the followig itermediate laguage code: asg, [bp-0eh] asg bx, [bp-0ch] asg bx, bx * 2 asg, + bx asg [bp-0eh], is coverted ito the followig high-level expressio asg [bp-0eh], [bp-0eh] + [bp-0ch] * 2 which does ot rely o registers ay more. This phase makes use of traditioal compiler optimizatio theory ad ot oly implemets a exteded register copy propagatio algorithm to elimiate registers, regeerate high-level expressios, ad elimiate itermediate laguage istructios such as push ad pop; but it also performs iterad itra-procedural live register aalysis to determie register variables ad fuctio retur registers. Complete algorithms to perform this aalysis are described i [17]. A further aalysis of data types is doe at this stage to attempt to recover compoud data types such as arrays ad structures. 2. Cotrol ow aalysis: this aalysis structures the cotrol ow graph of each subroutie of the program ito a geeric set of high-level laguage costructs. This geeric set cotais cotrol istructios available i most laguages; such as loopig ad coditioal trasfers of cotrol. I our implemetatio, the geeric set was composed of if..the, if..the..else, ad case coditioals, ad while(), repeat..util(), ad edless loop loops. Laguage-specic costructs are ot allowed as they are ot available i most other laguages. Figure 3 shows two sample cotrol ow graphs: a if..the..else coditioal ad a while() loop. The aim of the structurig algorithm is to detect the uderlyig geeric cotrol structures of the program, ad elimiate as much as possible the use of ucoditioal trasfers of cotrol (i.e. goto statemets). Note that the goto costruct forms part of the geeric set of cotrol structures sice laguages such as Pascal ad C allow the use of this costruct; hece, the uderlyig graph might oly be represetable i a higher-level laguage that makes use of the goto statemet. Complete algorithms for structurig arbitrary graphs are based i graph theory ad are give i [17]. The back-ed geerates the al high-level laguage code based o the cotrol ow graph ad the improved itermediate code of each subroutie. Variable ames are selected for all local variables (stack ad register-variables), ad for all argumets. Subroutie ames are also selected for the dieret routies foud i the program. Cotrol structures ad itermediate istructios are traslated ito a high-level laguage statemet. 2.6 Library bidigs Wheever the target high-level laguage geerated by the decompiler is dieret to the origial laguage

6 if..the..else - while() Figure 3: Geeric costructs used to compile the executable source program, if the geerated target code makes use of library ames (i.e. library sigatures were detected), although this program is correct, it caot be recompiled i the target laguage sice it does ot use library routies for that laguage but for aother oe. The itroductio of library bidigs solves this problem, by bidig the subrouties of oe laguage to the other. ISO committee SC22 of Workig Group 11 is cocered with the creatio of stadards for laguage idepedet access to service facilities. This work ca be used to dee laguage idepedet bidigs for laguages such as C ad Modula-2. Iformatio o library bidigs ca be placed i a le ad used by the back-ed of the decompiler to produce target code that uses the target laguage's library routies, istead of the oes matched durig disassembly. 2.7 Postprocessor A postprocessor is a program that trasforms a highlevel laguage program ito a sematically equivalet high-level program writte i the same laguage. For example, if the target laguage is C, the followig code loc1 = 1; while (loc1 < 50) { /* some code i C */ loc1 = loc1 + 1; would be coverted by a postprocessor ito for (loc1 = 1; loc1 < 50; loc1++) { /* some code i C */ which is a sematically equivalet program that makes use of cotrol structures available i the C laguage, but ot preset i the geeric set of structures decompiled by the decompiler. 3 Experimetal results dcc is a prototype decompiler system writte i C for the DOS operatig system. dcc was iitially developed o a DecStatio 3000 ruig Ultrix, ad was ported to the Itel architecture uder DOS. dcc takes as iput.exe ad.com les for the Itel i80286 architecture, ad produces target C ad assembler programs. This decompiler was built usig the techiques summarized i this paper ad fully described i [17], ad is composed of the phases show i Figure 4. As ca be see, the decompiler has a built-i loader ad disassembler, ad there is o library bidigs or postprocessig phase. Compiler ad library sigatures were geerated for several compilers, icludig Borlad Turbo C ad Microsoft Visual C++. This prototype decompiler determies base types (i.e. byte, iteger, log, poiter), but is ot able to determie compoud types such as arrays ad structures because it has ot bee implemeted yet. Compiler sigatures Library sigatures Library prototypes biary program Loader - Parser Itermediate code geerator Cotrol ow graph geerator Sematic aalyzer Data ow aalyzer Cotrol ow aalyzer C code geerator C program - Assembler code geeratio Figure 4: Structure of the dcc decompiler system assembler program This sectio reports o a test suite of.exe programs origially writte i C ad compiled with Borlad Turbo C uder DOS. These programs make use of base type variables, ad illustrate dieret aspects of the decompilatio process. These programs were ru i

7 batch mode, geeratig the disassembly le.a2, the C le.b, the call graph of the program, ad statistics o the itermediate code istructios. The statistics reect the percetage of itermediate istructio reductio o all subrouties for which C is geerated; subrouties which traslate to assembler are ot cosidered i the statistics. For each program, a total cout o itermediate istructios before ad after aalysis, ad a total percetage reductio is give. The programs i the test suite are as follow: the rst three programs deal with arithmetic operatios o the dieret three base types (byte, iteger, log iteger); the origial C programs had the same code, but their variables were deed of a dieret type. The ext four programs are bechmark programs from the Plum-Hall bechmark suite. These programs were writte by Eric S. Raymod ad are freely available o the etwork [18]. These programs were modied to ask for the argumets to the program with scaf() rather tha scaig for them i the argv[] commad lie array sice arrays are ot supported by dcc yet. Fially, the last three programs calculate Fiboacci umbers, compute the cyclic redudacy check (CRC) for a character, ad multiply two matrixes. The latter program was used to illustrate how array address computatio is left i dcc i terms of a expressio, rather tha beig aalyzed ad type propagated as a array. Figure 5 presets summary results for the 10 programs cosidered i the test suite. The total umber of itermediate istructios before the aalysis is 963, compared with the al 306 itermediate istructios; which gives a reductio of istructios of 76.25%. This reductio of istructios is maily due to the optimizatios performed durig data ow aalysis, particularly the elimiatio of registers across subrouties ad the recostructio of high-level expressios. The recogitio of idioms i the iitial itermediate code also reduces the umber of istructios ad helps i the determiatio of data types such as log itegers. Decompiled programs have the same umber of user subrouties, plus ay rutime support routies used i the program. These latter routies are sometimes traslatable ito a high-level represetatio; assembler is geerated wheever they are utraslatable. The percetage reductio rate represets the code explosio performed by the compiler whe traslatig a high-level laguage to a machie laguage. This rate eeds to be fully reverted i a decompiler if a high-level of abstractio is to be expected. Note that the reductio rate for a disassembler would be zero as the disassembler does ot eed to geerate a higher represetatio, but merely traslate the machie istructios ito assembler Program Before After % Reductio itops byteops logops bechsho bechlg bechmul bechf bo crc matrixmu total Figure 5: Results for test suite programs (i.e. a 1:1 mappig). 4 Example We preset the decompilatio of bechmul, a bechmark program from the Plum-Hall bechmarks. This program bechmarks iteger multiplicatio by executig 1000 multiplicatios i a loop. The disassembly program is show i Figure 7, the decompiled C program i Figure 8, ad the iitial C program i Figure 9. Bechmul makes use of two log variables to loop a large umber of times through the program, ad three iteger variables that perform the operatios; oe of these variables is ot actually used i the program. As see from the disassembly, the log variables are located o the stack at osets -4 ad -8, ad the iteger variables are at osets -12, -10, ad o the register variable si. The al C code is idetical to the iitial C code, ad a reductio of 86.36% of istructios was achieved by this program, as see i Figure 5. 5 Compariso with previous work Decompilers have bee used sice the 1960s for a variety of purposes; these are summarized i Figure 10. I the 60s, decompilers were used to help i the migratio of 2d to 3rd geeratio machies (e.g. the Neliac decompiler [19]) ad i the coversio of laguages such as Autocoder to Cobol (reported i [20]). I the 70s decompilers were used i the automatic migratio of programs, with systems such as Piler which attempted to support a large umber of source ad target laguages [21], the desig of a laguage for a aircraft system [22], ad several theses described dieret methodologies for decompilatio; the most complete oes are [20, 23].

8 mai PROC NEAR bp bp, sp SUB sp, 0Ch si LEA, [bp-4], 194h CALL ear ptr scaf word ptr [bp-2] word ptr [bp-4], 198h CALL ear ptr pritf ADD sp, 6 LEA, [bp-0ch], 1B2h CALL ear ptr scaf LEA, [bp-0ah], 1B5h CALL ear ptr scaf word ptr [bp-6], 0 word ptr [bp-8], 1 L1: dx, [bp-6], [bp-8] CMP dx, [bp-2] JL L2 JG L3 CMP, [bp-4] JBE L2 L3: word ptr [bp-0ch], 1B8h CALL ear ptr pritf si sp, bp bp RET L2: si, 1 L4: CMP si, 28h JLE L5 Figure 6: Bechmul.a2 I the 80s decompilers were writte to recover iaccessible source code, such is the case of Decomp [24], ad i the documetatio of assembler code migrated from oe machie to aother [25]. Sample decompilers writte i the 90s were previously metioed i x1.1. ADD word ptr [bp-8], 1 ADC word ptr [bp-6], 0 JMP L1 ;Sythetic ist L5:, [bp-0ch] dx, 3 MUL dx [bp-0ch], INC si JMP L4 ;Sythetic ist mai ENDP Figure 7: Bechmul.a2 { Cotiued Due to the amout of iformatio lost i the compilatio process, to be able to regeerate high-level laguage (HLL) code, all of these experimetal decompilers have limitatios i oe way or aother, icludig decompilatio of source assembly les [20, 22, 23, 25] or object les with or without symbolic debuggig iformatio [24], simplied compiler source high-level laguage used to compile the source executable program fed ito the decompiler [20], ad the requiremet of the compiler's specicatio [8, 9]. Our decompilatio system, dcc, diers from previous decompilatio projects i several ways; it aalyses source executable programs rather tha assembler or object les, performs idiom aalysis to capture the essece of a sequece of istructios with a special meaig, performs data ow aalysis o registers ad coditio codes to elimiate them ad regeerate highlevel expressios, ad structures the program's cotrol ow graph ito a geeric set of high-level structures that ca be accommodated ito dieret high-level laguages, elimiatig as much as possible the use of the

9 /* * Iput file : bechmul.exe * File type : EXE */ #iclude "dcc.h" void mai () /* Takes o parameters. * High-level laguage prologue code. */ { it loc1; it loc2; log loc3; log loc4; it loc5; scaf ("%ld", &loc4); pritf ("executig %ld iteratios\", loc4); scaf ("%d", &loc1); scaf ("%d", &loc2); loc3 = 1; while ((loc3 <= loc4)) { loc5 = 1; while ((loc5 <= 40)) { loc1 = (((((((((((((((((((((((((loc1 * loc1) * loc1) * loc1) * loc1) * loc1) * loc1) * loc1) * loc1) * loc1) * loc1) * loc1) * loc1) * loc1) * loc1) * loc1) * loc1) * loc1) * loc1) * loc1) * loc1) * loc1) * loc1) * loc1) * loc1) * 3); loc5 = (loc5 + 1); loc3 = (loc3 + 1); pritf ("a=%d\", loc1); Figure 8: Bechmul.b goto statemet. dcc also makes use of compiler ad library sigatures, ad library prototypes, if available at decompilatio time. 6 Coclusios This paper presets a overview of a set of tools used i the reverse egieerig of executable programs; such tools are: loader, disassembler, sigature geerator, prototype geerator, ad decompiler. We report o results obtaied from the implemetatio of this system i a prototype decompiler system for the Itel i80286 architecture ad the DOS operatig system: dcc. The structure of the dcc decompiler is based o the structure of a compiler; several phases which are implemeted i machie- or laguage- depedet or idepedet modules: the frot-ed which is machiedepedet, the uiversal decompilig machie which is /* bechmul - bechmark for it multiply * Thomas Plum, Plum Hall Ic, * If machie traps overflow, use a usiged type * Let T be the executio time i millisecods * The average time per operator = T/major usec * (Because the ier loop has exactly 1000 * operatios) */ #defie STOR_CL auto #defie TYPE it #iclude <stdio.h> mai (it ac, char *av[]) { STOR_CL TYPE a, b, c; log d, major; scaf ("%ld", &major); pritf("executig %ld iteratios\", major); scaf ("%d", &a); scaf ("%d", &b); for (d = 1; d <= major; ++d) { /* ier loop executes 1000 selected operatios */ for (c = 1; c <= 40; ++c) { a = 3 *a*a*a*a*a*a*a*a * a*a*a*a*a* a*a*a * a*a*a*a*a*a*a*a * a; /* 25 * */ pritf("a=%d\", a); Figure 9: Bechmul.c Use Example 60 Migratio: 2d! 3rd Neliac Laguage coversio Autocoder 70 Migratio Piler System Laguage desig F4 traier aircraft Methodology descriptio 4 theses 80 Recover iaccessible code Decomp Modify biaries Documetatio Zebra 90 Migratio Biary traslatio Security PROM comparator Automatic geeratio Decompiler-compiler Maiteace dcc Figure 10: decades Uses of decompilatio throughout the machie- ad laguage-idepedet, ad the back-ed which is laguage-depedet. The results reported i this paper are based o a test suite of programs that make use of base data type variables such as byte, iteger, ad log iteger. The

10 statistics obtaied show that o average there is a reductio i the umber of itermediate istructios of 76.25%. This reductio is oly possible by the complete data ow aalysis of the program, ad it represets the overall improvemet this decompiler has made over previous decompilers which geerate \high-level code" that looks like assembler (ad hece their reductio rate is almost il). The resultat C programs make use of variables (as opposed to registers) ad the correct type of cotrol structures (with the miimum use of goto statemets). Some commets are also provided by the system. The decompiler geerates assembler code for utraslatable subrouties, ad C for the rest. The decompiler makes use of compiler ad library sigatures if they are available; otherwise it disassembles all code ad aalyses all subrouties (icludig low-level subrouties icluded by the compiler for settig up the eviromet, ad all library routies liked i by the liker). Ackowledgemets I would like to thak Michael Va Emmerik for codig the sigature ad prototype geerators, ad for modifyig the disassembler, ad Professor Joh Gough for discussios of decompilers. This research is partly supported by Su Microsystems Laboratories. For further iformatio refer to Refereces [1] E.J. Chikofsky ad J.H. Cross. Reverse egieerig ad desig recovery: A toomy. IEEE Software, 7:13{17, Jauary [2] K. Lao, P.T. Breuer, ad H. Haughto. Reverseegieerig cobol via formal methods. Joural of Software Maiteace: Research ad Practice, 5(1):13{35, March [3] J. Mallory. Reverse egieerig of fortra programs ow possible. Newsbytes, 16 July [4] S.E. Varey. IDE adds reverse egieerig, code geeratio to C package. Digital Review, 8(25):9{10, 24 Jue [5] R Swake. The art of reverse egieerig. Computer, Jue [6] R.L. Sites, A. Chero, M.B. Kirk, M.P. Marks, ad S.G. Robiso. Biary traslatio. Commuicatios of the ACM, 36(2):69{81, February [7] D.J. Pavey ad L.A. Wisborrow. Demostratig equivalece of source code ad PROM cotets. The Computer Laguage, 36(7):654{667, [8] J. Bowe. From programs to object code ad back agai usig logic programmig: Compilatio ad decompilatio. Joural of Software Maiteace: Research ad Practice, 5(4):205{234, [9] P.T. Breuer ad J.P. Bowe. Decompilatio: the eumeratio of types ad grammars. Trasactio of Programmig Laguages ad Systems, 16(5):1613{1647, September [10] P.T. Breuer ad J.P. Bowe. Geeratig decompilers. To appear i Iformatio ad Software Techology Joural, [11] C. Fua, L. Zogtia, ad L. Li. Desig ad implemetatio techiques of the 8086 C decompilig system. Mii-Micro Systems, 14(4):10{18,31, [12] C. Cifuetes ad K.J. Gough. Decompilatio of biary programs. Software { Practice ad Experiece, 25(7):811{829, July [13] P. Bailes, M Chapma, M Chia, ad I Peake. Geeric re-egieerig eviromet desig criteria: A evaluatio of Software Reery (TM). Australia Computer Joural, 26(4):151{157, November [14] R.N. Horspool ad N. Marovac. A approach to the problem of detraslatio of computer programs. The Computer Joural, 23(3):223{229, [15] H. Swartz. The case for reverse egieerig. Busiess Computer Systems, 3(12):22{25, December [16] M. Va Emmerik. Sigatures for library fuctios i executable les. Techical Report 2/94, Faculty of Iformatio Techology, Queeslad Uiversity of Techology, GPO Box 2434, Brisbae 4001, Australia, April [17] C. Cifuetes. Reverse Compilatio Techiques. PhD dissertatio, Queeslad Uiversity of Techology, School of Computig Sciece, July [18] E.S. Raymod. Plum-hall bechmarks. URL: ftp//plaza.aaret.edu.au/useet/comp.sources.uix/ volume20/plum-bechmarks.gz, [19] M.H. Halstead. Machie-idepedet computer programmig, chapter 11, pages 143{150. Sparta Books, [20] B.C. Housel. A Study of Decompilig Machie Laguages ito High-Level Machie Idepedet Laguages. PhD dissertatio, Purdue Uiversity, Computer Sciece, August [21] P. Barbe. The Piler system of computer program traslatio. Techical report, Probe Cosultats Ic., September [22] D.A. Workma. Laguage desig usig decompilatio. Techical report, Uiversity of Cetral Florida, December [23] G.L. Hopwood. Decompilatio. PhD dissertatio, Uiversity of Califoria, Irvie, Computer Sciece, [24] J. Reuter. URL: ftp//cs.washigto.edu/pub/ decomp.tar.z. Public domai software, [25] D.L. Brikley. Itercomputer trasportatio of assembly laguage software through decompilatio. Techical report, Naval Uderwater Systems Ceter, October 1981.