|
|
Decompilation of Specialized and Advanced Instruction Sets
Holub, Juraj ; Kolář, Dušan (referee) ; Křivka, Zbyněk (advisor)
V dnešnej dobe je proces analýzy nebezpečného softvéru dôležitou súčasťou informačných technológií. Jedna z kľúčových techník je spätný preklad škodlivých binárnych programov. Spätný preklad je komplexný proces, ktorý rieši niekoľko projektov. Projekt RetDec sa zameriava na flexibilný návrh a riešenie spätného prekladača s možnosťou znovupoužiteľnosti. Cieľom tejto práce je zlepšenie spätného prekladu pokročilých inštrukčných sád pre architektúru x86. Bola navrhnutá nová optimalizácia pre FPU registrový zásobník. Bola rozšírená podpora prekladu inštrukčných sád jednotiek FPU a SSE. Nové rozšírenia boli implementované a otestované z hľadiska efektivity a kvality spätného prekladu.
|
|
|
C Language Source Files Similarity Detection
Rek, Petr ; Kučera, Jiří (referee) ; Matula, Peter (advisor)
This thesis deals with design, implementation and testing of the csim tool, which compares two C source files by their similarity. The primary purpose of this tool is testing of a decompiler developed by AVG Technologies s.r.o. Testing is based on comparing abstract syntax trees of the original and decompiled source files. The reader is introduced to the basics of reverse engineering, especially reverse engineering of a binary file into a high-level programming language source file. The process of compiling followed by decompiling of a file is described along with its effect on reverse engineering. The LLVM project and the Clang compiler is introduced to the reader, since its libraries are the foundation upon which the csim tool is built.
|
|
|
Tools for Executable File Format Conversions
Matula, Peter ; Husár, Adam (referee) ; Hruška, Tomáš (advisor)
This paper describes methods and procedures used for object file format conversions. It introduces several commonly used formats (ELF, PE, E32Image, DEX) and project Lissom's object file format (LOFF). It contains basic information about libraries manipulating these formats and a description of a new library managing E32Image. The primary objective is to implement a program converting files between common formats and LOFF. This problem is solved by mapping all critical information from one format structures to another. To accomplish this task, it was necessary to modify and extend some features of Lissom object format. The result is the plugin based application capable of creating valid and runnable executable files in mentioned formats.
|
|
|
Java decompiler
Žamberský, Zdeněk ; Heriban, Pavel (referee) ; Roupec, Jan (advisor)
The goal was to create decompiler for Java programing language. Decompiler should reconstruct original Java source code from class files, representing its compiled form. First part of thesis focuses on Java langage, its compilation and structure of class file. Then Java Virtual Machine and its instruction set is discussed. After that thesis focuses on decompilation and algoritms designed and used for decompiler realization. Examples of decompiled code are presented.
|
|
|
Retargetable Analysis of Machine Code
Křoustek, Jakub ; Janoušek, Jan (referee) ; Návrat,, Pavol (referee) ; Kolář, Dušan (advisor)
Analýza softwaru je metodologie, jejímž účelem je analyzovat chování daného programu. Jednotlivé metody této analýzy je možné využít i v dalších oborech, jako je zpětné inženýrství, migrace kódu apod. V této práci se zaměříme na analýzu strojového kódu, na zjištění nedostatků existujících metod a na návrh metod nových, které umožní rychlou a přesnou rekonfigurovatelnou analýzu kódu (tj. budou nezávislé na konkrétní cílové platformě). Zkoumány budou dva typy analýz - dynamická (tj. analýza za běhu aplikace) a statická (tj. analýza aplikace bez jejího spuštění). Přínos této práce v rámci dynamické analýzy je realizován jako rekonfigurovatelný ladicí nástroj a dále jako dva typy tzv. rekonfigurovatelného translátovaného simulátoru. Přínos v rámci statické analýzy spočívá v navržení a implementování rekonfigurovatelného zpětného překladače, který slouží pro transformaci strojového kódu zpět do vysokoúrovňové reprezentace. Všechny tyto nástroje jsou založeny na nových metodách navržených autorem této práce. Na základě experimentálních výsledků a ohlasů od uživatelů je možné usuzovat, že tyto nástroje jsou plně srovnatelné s existujícími (komerčními) nástroji a nezřídka dosahují i lepších výsledků.
|
|
|
Interactive Disassembler
Mrva, Milan ; Přikryl, Zdeněk (referee) ; Křoustek, Jakub (advisor)
This thesis describes procedures and tools of reverse engineering in terms of software development. There are introduces different techniques of protection against decomposition of executables. The work also mentions some programs used for decomposition analysis. Furthermore it contains information about architecture of processing units, with emphasis on microprocessors Intel and Motorola. Variety of executable formats is shown. Generic retargetable disassembler was implemented. There is a description of its structure and plugins. These plugins represents three algorithms used for disassembling a program. One of them applies a multi-process parsing engine, which is an own design by author of the thesis. At the end, these techniques are compared and further development is outlined.
|
|
|
Decompilation from Selected Object File Formats
Bandzi, Michal ; Láznička, Stanislav (referee) ; Matula, Peter (advisor)
Object files contain machine code that can be executed by processor unit. Structure of an object file is defined by its file format. In order to decompile an object file, it is necessary to process and convert file data to internal representation of decompiler. This thesis discusses design and implementation of new modules for file format processing that will be part of the Retargetable Decompiler project. The goal of this work is to add support for Intel HEX and Mach-O file formats and new implementation of already supported Portable Executable file format. Implementation of modules for file formats Intel HEX and Mach-O was successful and it is possible to use them for reverse compilation. Processing of PE file format is not possible in sufficient quality due to errors in used LLVM library.
|
|
|
Binary-Code Decoding to a High-Level Representation
Macko, Lukáš ; Soukup, Ondřej (referee) ; Matula, Peter (advisor)
The thesis deals with reverse techniques in software engineering. It presents practical application of software reverse engineering, used tools and approaches. The topic of instruction decoding is discussed in detail. Two basic methods are presented-linear sweep and recursive descent. Their strengths and weaknesses are highlighted. Subsequently a decompiler developed by AVG Technologies is introduced. The decompiler is retargetable. This feature allows to decompile applications of multiple platforms into various target languages. The aim of the thesis is to design and implement algorithm for decoding binary files into high-level representation. The designed algorithm is based on modified recursive descent algorithm, which uses control flow information. In order to achieve more accurate decoding results, symbol table records and other additional information are used. The proposed algorithm was implemented for the AVG Technologies retargetable decompiler. The tests showed that the implemented algorithm improved the function detection in decoded programs. Furthermore, the implemented solution allows to decode files that could not be analysed using the previous version of the decompiler.
|
|
|
Decompilation of Specialized and Advanced Instruction Sets
Holub, Juraj ; Kolář, Dušan (referee) ; Křivka, Zbyněk (advisor)
V dnešnej dobe je proces analýzy nebezpečného softvéru dôležitou súčasťou informačných technológií. Jedna z kľúčových techník je spätný preklad škodlivých binárnych programov. Spätný preklad je komplexný proces, ktorý rieši niekoľko projektov. Projekt RetDec sa zameriava na flexibilný návrh a riešenie spätného prekladača s možnosťou znovupoužiteľnosti. Cieľom tejto práce je zlepšenie spätného prekladu pokročilých inštrukčných sád pre architektúru x86. Bola navrhnutá nová optimalizácia pre FPU registrový zásobník. Bola rozšírená podpora prekladu inštrukčných sád jednotiek FPU a SSE. Nové rozšírenia boli implementované a otestované z hľadiska efektivity a kvality spätného prekladu.
|
|
|
Tools for Executable File Format Conversions
Matula, Peter ; Husár, Adam (referee) ; Hruška, Tomáš (advisor)
This paper describes methods and procedures used for object file format conversions. It introduces several commonly used formats (ELF, PE, E32Image, DEX) and project Lissom's object file format (LOFF). It contains basic information about libraries manipulating these formats and a description of a new library managing E32Image. The primary objective is to implement a program converting files between common formats and LOFF. This problem is solved by mapping all critical information from one format structures to another. To accomplish this task, it was necessary to modify and extend some features of Lissom object format. The result is the plugin based application capable of creating valid and runnable executable files in mentioned formats.
|
guest ::
