|
|
Data Type Reconstruction Improvements in RetDec Decompiler
Venger, Adam ; Ryšavý, Ondřej (referee) ; Kolář, Dušan (advisor)
New malware is being continuosly developed. For its effective analysis and fight against it, tools such as decompilers are needed. Decompilation, however, is difficult problem to solve. For the improvement of its results, all of the information contained in binary files needs to be used. Some programming languages require encoding of some symbols in order to be compiled correctly. For example, when compiling functions, the parameter data types and the calling convention are encoded to the function name. This process is called mangling. Thesis deals with reverse process called demangling and its utilization for improvement of the RetDec decompiler. Created library allows demangling of symbols created by popular C++ and Delphi compilers. It combines custom solution with an existing one in the form of LLVM project demangler. Existing demangler library in RetDec was replaced with the new one, results of which are much more reliable. The reconstruction of data types was expanded to use the information obtained from encoded symbols, which resulted in more accurate decompilation.
|
|
|
Data Type Reconstruction Improvements in RetDec Decompiler
Venger, Adam ; Ryšavý, Ondřej (referee) ; Kolář, Dušan (advisor)
New malware is being continuosly developed. For its effective analysis and fight against it, tools such as decompilers are needed. Decompilation, however, is difficult problem to solve. For the improvement of its results, all of the information contained in binary files needs to be used. Some programming languages require encoding of some symbols in order to be compiled correctly. For example, when compiling functions, the parameter data types and the calling convention are encoded to the function name. This process is called mangling. Thesis deals with reverse process called demangling and its utilization for improvement of the RetDec decompiler. Created library allows demangling of symbols created by popular C++ and Delphi compilers. It combines custom solution with an existing one in the form of LLVM project demangler. Existing demangler library in RetDec was replaced with the new one, results of which are much more reliable. The reconstruction of data types was expanded to use the information obtained from encoded symbols, which resulted in more accurate decompilation.
|
guest ::
