|
|
C Language Source Files Similarity Detection
Rek, Petr ; Kučera, Jiří (referee) ; Matula, Peter (advisor)
This thesis deals with design, implementation and testing of the csim tool, which compares two C source files by their similarity. The primary purpose of this tool is testing of a decompiler developed by AVG Technologies s.r.o. Testing is based on comparing abstract syntax trees of the original and decompiled source files. The reader is introduced to the basics of reverse engineering, especially reverse engineering of a binary file into a high-level programming language source file. The process of compiling followed by decompiling of a file is described along with its effect on reverse engineering. The LLVM project and the Clang compiler is introduced to the reader, since its libraries are the foundation upon which the csim tool is built.
|
|
|
Java decompiler
Žamberský, Zdeněk ; Heriban, Pavel (referee) ; Roupec, Jan (advisor)
The goal was to create decompiler for Java programing language. Decompiler should reconstruct original Java source code from class files, representing its compiled form. First part of thesis focuses on Java langage, its compilation and structure of class file. Then Java Virtual Machine and its instruction set is discussed. After that thesis focuses on decompilation and algoritms designed and used for decompiler realization. Examples of decompiled code are presented.
|
|
|
Retargetable Analysis of Machine Code
Křoustek, Jakub ; Janoušek, Jan (referee) ; Návrat,, Pavol (referee) ; Kolář, Dušan (advisor)
Analýza softwaru je metodologie, jejímž účelem je analyzovat chování daného programu. Jednotlivé metody této analýzy je možné využít i v dalších oborech, jako je zpětné inženýrství, migrace kódu apod. V této práci se zaměříme na analýzu strojového kódu, na zjištění nedostatků existujících metod a na návrh metod nových, které umožní rychlou a přesnou rekonfigurovatelnou analýzu kódu (tj. budou nezávislé na konkrétní cílové platformě). Zkoumány budou dva typy analýz - dynamická (tj. analýza za běhu aplikace) a statická (tj. analýza aplikace bez jejího spuštění). Přínos této práce v rámci dynamické analýzy je realizován jako rekonfigurovatelný ladicí nástroj a dále jako dva typy tzv. rekonfigurovatelného translátovaného simulátoru. Přínos v rámci statické analýzy spočívá v navržení a implementování rekonfigurovatelného zpětného překladače, který slouží pro transformaci strojového kódu zpět do vysokoúrovňové reprezentace. Všechny tyto nástroje jsou založeny na nových metodách navržených autorem této práce. Na základě experimentálních výsledků a ohlasů od uživatelů je možné usuzovat, že tyto nástroje jsou plně srovnatelné s existujícími (komerčními) nástroji a nezřídka dosahují i lepších výsledků.
|
|
|
Binary-Code Decoding to a High-Level Representation
Macko, Lukáš ; Soukup, Ondřej (referee) ; Matula, Peter (advisor)
The thesis deals with reverse techniques in software engineering. It presents practical application of software reverse engineering, used tools and approaches. The topic of instruction decoding is discussed in detail. Two basic methods are presented-linear sweep and recursive descent. Their strengths and weaknesses are highlighted. Subsequently a decompiler developed by AVG Technologies is introduced. The decompiler is retargetable. This feature allows to decompile applications of multiple platforms into various target languages. The aim of the thesis is to design and implement algorithm for decoding binary files into high-level representation. The designed algorithm is based on modified recursive descent algorithm, which uses control flow information. In order to achieve more accurate decoding results, symbol table records and other additional information are used. The proposed algorithm was implemented for the AVG Technologies retargetable decompiler. The tests showed that the implemented algorithm improved the function detection in decoded programs. Furthermore, the implemented solution allows to decode files that could not be analysed using the previous version of the decompiler.
|
|
|
Binary-Code Decoding to a High-Level Representation
Macko, Lukáš ; Soukup, Ondřej (referee) ; Matula, Peter (advisor)
The thesis deals with reverse techniques in software engineering. It presents practical application of software reverse engineering, used tools and approaches. The topic of instruction decoding is discussed in detail. Two basic methods are presented-linear sweep and recursive descent. Their strengths and weaknesses are highlighted. Subsequently a decompiler developed by AVG Technologies is introduced. The decompiler is retargetable. This feature allows to decompile applications of multiple platforms into various target languages. The aim of the thesis is to design and implement algorithm for decoding binary files into high-level representation. The designed algorithm is based on modified recursive descent algorithm, which uses control flow information. In order to achieve more accurate decoding results, symbol table records and other additional information are used. The proposed algorithm was implemented for the AVG Technologies retargetable decompiler. The tests showed that the implemented algorithm improved the function detection in decoded programs. Furthermore, the implemented solution allows to decode files that could not be analysed using the previous version of the decompiler.
|
|
|
LLVM IR Optimizations for Decompilation
Kollár, Jaroslav ; Chaloupka, Jan (referee) ; Matula, Peter (advisor)
This master's thesis describes the design and implementation of optimizations in the middle-end part of a retargetable decompiler developed by AVG Technologies. The purpose of these optimizations is to improve readability of the produced source code and improve existing optimizations in the back-end part. In the introduction, basic information about reverse engineering and decompilation is provided. Then, a description of state of the retargetable decompiler before this work is given. After that, the main part of this work is presented, which describes the design and implementation of the proposed optimizations. Then, the techniques that were used for testing are described. This description is followed by a summary of the achieved results. The present work is concluded by a discussion of possible future development.
|
|
|
Retargetable Analysis of Machine Code
Křoustek, Jakub ; Janoušek, Jan (referee) ; Návrat,, Pavol (referee) ; Kolář, Dušan (advisor)
Analýza softwaru je metodologie, jejímž účelem je analyzovat chování daného programu. Jednotlivé metody této analýzy je možné využít i v dalších oborech, jako je zpětné inženýrství, migrace kódu apod. V této práci se zaměříme na analýzu strojového kódu, na zjištění nedostatků existujících metod a na návrh metod nových, které umožní rychlou a přesnou rekonfigurovatelnou analýzu kódu (tj. budou nezávislé na konkrétní cílové platformě). Zkoumány budou dva typy analýz - dynamická (tj. analýza za běhu aplikace) a statická (tj. analýza aplikace bez jejího spuštění). Přínos této práce v rámci dynamické analýzy je realizován jako rekonfigurovatelný ladicí nástroj a dále jako dva typy tzv. rekonfigurovatelného translátovaného simulátoru. Přínos v rámci statické analýzy spočívá v navržení a implementování rekonfigurovatelného zpětného překladače, který slouží pro transformaci strojového kódu zpět do vysokoúrovňové reprezentace. Všechny tyto nástroje jsou založeny na nových metodách navržených autorem této práce. Na základě experimentálních výsledků a ohlasů od uživatelů je možné usuzovat, že tyto nástroje jsou plně srovnatelné s existujícími (komerčními) nástroji a nezřídka dosahují i lepších výsledků.
|
|
|
C Language Source Files Similarity Detection
Rek, Petr ; Kučera, Jiří (referee) ; Matula, Peter (advisor)
This thesis deals with design, implementation and testing of the csim tool, which compares two C source files by their similarity. The primary purpose of this tool is testing of a decompiler developed by AVG Technologies s.r.o. Testing is based on comparing abstract syntax trees of the original and decompiled source files. The reader is introduced to the basics of reverse engineering, especially reverse engineering of a binary file into a high-level programming language source file. The process of compiling followed by decompiling of a file is described along with its effect on reverse engineering. The LLVM project and the Clang compiler is introduced to the reader, since its libraries are the foundation upon which the csim tool is built.
|
|
|
Decompilation of Selected C++ Constructions
Mihulka, Tomáš ; Zemek, Petr (referee) ; Matula, Peter (advisor)
This bachelor's thesis deals with the reconstruction of a hierarchy of classes and their virtual methods from programmes created by C++ language . The aim of this work is to extend a decompiler , which has been developed as a part of the Lissom project, by an analysis of those reconstructions for various decompilers . The reconstructions are created through detection of RTTI and virtual tables . The first part of this thesis involves a description of reverse engineering as well as of the Lissom project in terms of the decompiler . The following section of the paper explains the basics of C++ language , its structures and different possibilities of their decompilation . The final part of the paper deals with a design, implementation and testing of a recognition of RTTI and virtual tables .
|
|
|
Decompiler Front-End Optimizations
Odaloš, Matej ; Ďurfina, Lukáš (referee) ; Křoustek, Jakub (advisor)
Decompiler is a reverse engineering tool for translation of binary codes into one of the higher level languages. This bachelor thesis describes such a tool paying special attention on decompiler of the Lissom project. There are proposed several techniques for translation optimalization like static LLVM IR code interpretation and memory for its results. Other optimalizations are conserning addition of platform dependent features like delay slot support or memory datalayout and endianness detection. Finally implemented techniques are demostrated on several examples.
|
guest ::
