|
|
Interactive Disassembler
Mrva, Milan ; Přikryl, Zdeněk (referee) ; Křoustek, Jakub (advisor)
This thesis describes procedures and tools of reverse engineering in terms of software development. There are introduces different techniques of protection against decomposition of executables. The work also mentions some programs used for decomposition analysis. Furthermore it contains information about architecture of processing units, with emphasis on microprocessors Intel and Motorola. Variety of executable formats is shown. Generic retargetable disassembler was implemented. There is a description of its structure and plugins. These plugins represents three algorithms used for disassembling a program. One of them applies a multi-process parsing engine, which is an own design by author of the thesis. At the end, these techniques are compared and further development is outlined.
|
|
|
C Back-End for a Decompiler
Urban, Martin ; Ďurfina, Lukáš (referee) ; Zemek, Petr (advisor)
This thesis deals with the implementation of the back-end of the decompiler, which produces a code in C language. It contains basic information about the principals and using of the reverse engineering either in the area of information technology or apart from it. The main goal is to create the back-end of the decompiler which would generate a code that would be equivalent against the input and will be translatable into a binary code. Functionality of the output code will be conserved in state of the functionality of the source code. The output is the implementation of the classes in C++ language. It does described activity as a part of the general decompiler which is developed in terms of the project Lissom.
|
|
|
Decompiler Front-End Optimizations
Odaloš, Matej ; Ďurfina, Lukáš (referee) ; Křoustek, Jakub (advisor)
Decompiler is a reverse engineering tool for translation of binary codes into one of the higher level languages. This bachelor thesis describes such a tool paying special attention on decompiler of the Lissom project. There are proposed several techniques for translation optimalization like static LLVM IR code interpretation and memory for its results. Other optimalizations are conserning addition of platform dependent features like delay slot support or memory datalayout and endianness detection. Finally implemented techniques are demostrated on several examples.
|
|
|
Enhancement of Decompilation Results
Končický, Jaromír ; Ďurfina, Lukáš (referee) ; Křoustek, Jakub (advisor)
As a part of the Lissom project, a retargetable decompiler is being developed. Its main purpose is to decompile programs for any particular microprocessor architecture into any high-level programming language. At this thesis's beginning time, its results are not optimal because the decompiler doesn't utilize all program's additional information during decompilation that can improve the results. In this thesis, reverse engineering and Lissom decompiler is described. Techniques of using additional information to enhance decompilation results are proposed. These are data section content analysis and debug information analysis (specifically the debug information in PDB format which is proprietary format). Exploration of internal PDB structure and its content is a part of this thesis. The implementation of data section analysis and debug information utilizing is described and in the end, final decompilation results are discussed.
|
|
| |
|
|
Code Analysis and Transformation To a High-Level Language
Křoustek, Jakub ; Masařík, Karel (referee) ; Meduna, Alexandr (advisor)
This paper describes methods and procedures used for code analysis and transformation. It contains basic information of a science discipline called reverse engineering and its use in information technologies. The primary objective is a construction of a generic reverse compiler or decompiler, i.e. tool that can recompile from binary form (optionally from symbolic machine code) to a high level language. This operation is highly dependent on the concrete instruction set and processor architecture. This problem is solved with description of semantic of each instruction by a special language designed for this use. The output is the high level language code and is functionally equivalent to the input. The program is therefore able to work with each instruction set and code written by it can be transformed into the chosen high level language. This proposal is implemented in practice as a part of project Lissom. Generic decompiler is completely new idea. The thesis contains entirely new techniques from theory of compilers and optimizations made by the author.
|
|
|
Functions Detection in Decompilation
Kábele, Břetislav ; Ďurfina, Lukáš (referee) ; Křoustek, Jakub (advisor)
This work describes methods of functions detection in decompilation. It contains basic information about reverse engineering and its applications in computer science and beyond. Decompiler developed by research group Lissom at FIT VUT Brno is introduced. The main objective is to elucidate several methods of functions detection, discuss their advantages and disadvantages, and identify the problems of functions detection. After detecting the start, end and body of function, it is needed to find the parameters and return values. There are some algorithms presented in this area. The output of this thesis is design and implementation of architecture independent function detection and parameter detection.
|
|
|
Reconstruction of Data Types for Decompilation
Matula, Peter ; Ďurfina, Lukáš (referee) ; Křoustek, Jakub (advisor)
This document describes methods for a reconstruction of data types in the decompilation problem. It defines the concept of reverse engineering and introduces decompiler developed by the Lissom project. It presents existing methods of reconstruction of the simple and complex data types, and explains in detail approaches based on data-flow analysis and analysis of the memory operation offsets. The core of this thesis is the design of a new technique of reconstructing simple and complex data types, suitable for deployment in a retargetable decompiler environment of the Lissom project. Basic principles of the new technique, its implementation and related changes in decompiler and intermediate language are described. The solution is tested and the conclusion discusses the achievements, shortcomings and direction of the further work.
|
|
|
Enhancement of Decompilation by Using Dynamic Code Analysis
Končický, Jaromír ; Zemek, Petr (referee) ; Ďurfina, Lukáš (advisor)
As a part of the Lissom project, a retargetable decompiler is being developed. Its main purpose is to decompile programs for a particular microprocessor architecture into a high-level programming language. In present, methods of dynamic code analysis are not used during decompilation. However, we can significantly improve the decompilation results by using these methods. Design of dynamic-analysis methods is the main task of this thesis. In this thesis, reverse engineering and Lissom decompiler are described. Furthermore, general dynamic analysis methods, such as instrumentation and emulation, are described. The information we can obtain by using dynamic analysis and its usage during decompilation is proposed.
|
|
|
Java decompiler
Žamberský, Zdeněk ; Heriban, Pavel (referee) ; Roupec, Jan (advisor)
The goal was to create decompiler for Java programing language. Decompiler should reconstruct original Java source code from class files, representing its compiled form. First part of thesis focuses on Java langage, its compilation and structure of class file. Then Java Virtual Machine and its instruction set is discussed. After that thesis focuses on decompilation and algoritms designed and used for decompiler realization. Examples of decompiled code are presented.
|
guest ::
