|
|
Tools for Executable File Format Conversions
Matula, Peter ; Husár, Adam (referee) ; Hruška, Tomáš (advisor)
This paper describes methods and procedures used for object file format conversions. It introduces several commonly used formats (ELF, PE, E32Image, DEX) and project Lissom's object file format (LOFF). It contains basic information about libraries manipulating these formats and a description of a new library managing E32Image. The primary objective is to implement a program converting files between common formats and LOFF. This problem is solved by mapping all critical information from one format structures to another. To accomplish this task, it was necessary to modify and extend some features of Lissom object format. The result is the plugin based application capable of creating valid and runnable executable files in mentioned formats.
|
|
|
A decompiler for Objective-C
Mráček, Jakub ; Yaghob, Jakub (advisor) ; Bednárek, David (referee)
Objective-C is a popular programming language primarily used on the OS X and iOS platforms. We present a practical approach to decompilation of programs written in Objective-C and compiled for the x86 and AArch64 architectures using LLVM. Based on already-known generic reverse engineering techniques and compiler theory, this thesis analyzes new challenges and opportunities that occur in Objective-C binaries. We then offer solutions and algorithms that allow a decompiler to better recognize the high-level structures commonly used in Objective-C source codes. The thesis introduces an implementation of a new decompiler called "Cricket", an interactive GUI application for OS X, which uses the described algorithms and pattern matching methods to reconstruct source code in Objective-C. The decompiler tries to maximize readability of the output and allows user interaction to further modify the generated source code. The implemented software is then evaluated on a popular open-source framework and the results are compared to a competing product. Powered by TCPDF (www.tcpdf.org)
|
|
| |
|
|
Binary-Code Decoding to a High-Level Representation
Macko, Lukáš ; Soukup, Ondřej (referee) ; Matula, Peter (advisor)
The thesis deals with reverse techniques in software engineering. It presents practical application of software reverse engineering, used tools and approaches. The topic of instruction decoding is discussed in detail. Two basic methods are presented-linear sweep and recursive descent. Their strengths and weaknesses are highlighted. Subsequently a decompiler developed by AVG Technologies is introduced. The decompiler is retargetable. This feature allows to decompile applications of multiple platforms into various target languages. The aim of the thesis is to design and implement algorithm for decoding binary files into high-level representation. The designed algorithm is based on modified recursive descent algorithm, which uses control flow information. In order to achieve more accurate decoding results, symbol table records and other additional information are used. The proposed algorithm was implemented for the AVG Technologies retargetable decompiler. The tests showed that the implemented algorithm improved the function detection in decoded programs. Furthermore, the implemented solution allows to decode files that could not be analysed using the previous version of the decompiler.
|
|
|
LLVM IR Optimizations for Decompilation
Kollár, Jaroslav ; Chaloupka, Jan (referee) ; Matula, Peter (advisor)
This master's thesis describes the design and implementation of optimizations in the middle-end part of a retargetable decompiler developed by AVG Technologies. The purpose of these optimizations is to improve readability of the produced source code and improve existing optimizations in the back-end part. In the introduction, basic information about reverse engineering and decompilation is provided. Then, a description of state of the retargetable decompiler before this work is given. After that, the main part of this work is presented, which describes the design and implementation of the proposed optimizations. Then, the techniques that were used for testing are described. This description is followed by a summary of the achieved results. The present work is concluded by a discussion of possible future development.
|
|
|
Retargetable Analysis of Machine Code
Křoustek, Jakub ; Janoušek, Jan (referee) ; Návrat,, Pavol (referee) ; Kolář, Dušan (advisor)
Analýza softwaru je metodologie, jejímž účelem je analyzovat chování daného programu. Jednotlivé metody této analýzy je možné využít i v dalších oborech, jako je zpětné inženýrství, migrace kódu apod. V této práci se zaměříme na analýzu strojového kódu, na zjištění nedostatků existujících metod a na návrh metod nových, které umožní rychlou a přesnou rekonfigurovatelnou analýzu kódu (tj. budou nezávislé na konkrétní cílové platformě). Zkoumány budou dva typy analýz - dynamická (tj. analýza za běhu aplikace) a statická (tj. analýza aplikace bez jejího spuštění). Přínos této práce v rámci dynamické analýzy je realizován jako rekonfigurovatelný ladicí nástroj a dále jako dva typy tzv. rekonfigurovatelného translátovaného simulátoru. Přínos v rámci statické analýzy spočívá v navržení a implementování rekonfigurovatelného zpětného překladače, který slouží pro transformaci strojového kódu zpět do vysokoúrovňové reprezentace. Všechny tyto nástroje jsou založeny na nových metodách navržených autorem této práce. Na základě experimentálních výsledků a ohlasů od uživatelů je možné usuzovat, že tyto nástroje jsou plně srovnatelné s existujícími (komerčními) nástroji a nezřídka dosahují i lepších výsledků.
|
|
|
Decompilation from Selected Object File Formats
Bandzi, Michal ; Láznička, Stanislav (referee) ; Matula, Peter (advisor)
Object files contain machine code that can be executed by processor unit. Structure of an object file is defined by its file format. In order to decompile an object file, it is necessary to process and convert file data to internal representation of decompiler. This thesis discusses design and implementation of new modules for file format processing that will be part of the Retargetable Decompiler project. The goal of this work is to add support for Intel HEX and Mach-O file formats and new implementation of already supported Portable Executable file format. Implementation of modules for file formats Intel HEX and Mach-O was successful and it is possible to use them for reverse compilation. Processing of PE file format is not possible in sufficient quality due to errors in used LLVM library.
|
|
|
C Language Source Files Similarity Detection
Rek, Petr ; Kučera, Jiří (referee) ; Matula, Peter (advisor)
This thesis deals with design, implementation and testing of the csim tool, which compares two C source files by their similarity. The primary purpose of this tool is testing of a decompiler developed by AVG Technologies s.r.o. Testing is based on comparing abstract syntax trees of the original and decompiled source files. The reader is introduced to the basics of reverse engineering, especially reverse engineering of a binary file into a high-level programming language source file. The process of compiling followed by decompiling of a file is described along with its effect on reverse engineering. The LLVM project and the Clang compiler is introduced to the reader, since its libraries are the foundation upon which the csim tool is built.
|
|
|
Decompilation of Selected C++ Constructions
Mihulka, Tomáš ; Zemek, Petr (referee) ; Matula, Peter (advisor)
This bachelor's thesis deals with the reconstruction of a hierarchy of classes and their virtual methods from programmes created by C++ language . The aim of this work is to extend a decompiler , which has been developed as a part of the Lissom project, by an analysis of those reconstructions for various decompilers . The reconstructions are created through detection of RTTI and virtual tables . The first part of this thesis involves a description of reverse engineering as well as of the Lissom project in terms of the decompiler . The following section of the paper explains the basics of C++ language , its structures and different possibilities of their decompilation . The final part of the paper deals with a design, implementation and testing of a recognition of RTTI and virtual tables .
|
|
|
Decompilation of PowerPC Applications
Mišák, Ján ; Matula, Peter (referee) ; Ďurfina, Lukáš (advisor)
This bachelor thesis deals with the implementing of decompilation of PowerPC applications feature into a decompiler´s front-end. It also contains basic information about PowerPC architecture and information about the Lissom decompiler, especially its front-end. The goal of this work is to implement a feature into the front-end of the decompiler, which provides decompilation of PowerPC binaries. As a result of this bachelor thesis I have created and implemented a couple of analyses as a C++ classes and I have also fixed some earlier implemented code to achieve the required functionality.
|
guest ::
