REcompile: A decompilation framework for static analysis of binaries

Yakdan, Khaled; Eschweiler, Sebastian; Gerhards-Padilla, Elmar

doi:10.1109/malware.2013.6703690

Cited by 6 publications

(8 citation statements)

References 9 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The authors implemented a prototype called DREAM++ as an IDA Pro 6.5 plugin and improved it by adding readability enhancements. They also conducted a user survey to evaluate the approach [44].…”

Section: Related Workmentioning

confidence: 99%

dewolf: Improving Decompilation by leveraging User Surveys

Enders¹,

C.²,

Bergmann³

et al. 2023

Proceedings 2023 Workshop on Binary Analysis Research

View full text Add to dashboard Cite

Analyzing third-party software such as malware is a crucial task for security analysts. Although various approaches for automatic analysis exist and are the subject of ongoing research, analysts often have to resort to manual static analysis to get a deep understanding of a given binary sample. Since the source code of provided samples is rarely available, analysts regularly employ decompilers for easier and faster comprehension than analyzing a binary's disassembly.In this paper, we introduce our decompilation approach dewolf. We describe a variety of improvements over the previous academic state-of-the-art decompiler and some novel algorithms to enhance readability and comprehension, focusing on manual analysis. To evaluate our approach and to obtain a better insight into the analysts' needs, we conducted three user surveys. The results indicate that dewolf is suitable for malware comprehension and that its output quality noticeably exceeds Ghidra and Hex-Rays in certain aspects. Furthermore, our results imply that decompilers aiming at manual analysis should be highly configurable to respect individual user preferences. Additionally, future decompilers should not necessarily follow the unwritten rule to stick to the code-structure dictated by the assembly in order to produce readable output. In fact, the few cases where dewolf already cracks this rule leads to its results considerably exceeding other decompilers. We publish a prototype implementation of dewolf and all survey results [1], [2].

show abstract

Section: Related Workmentioning

confidence: 99%

dewolf: Improving Decompilation by leveraging User Surveys

Enders¹,

C.²,

Bergmann³

et al. 2023

Proceedings 2023 Workshop on Binary Analysis Research

View full text Add to dashboard Cite

show abstract

“…Yakdan et al [12] proposed REcompile, an efficient and extensible decompilation framework. REcompile to produce wellreadable decompiled code compare to previous work.…”

Section: Related Workmentioning

confidence: 99%

Detection of the Hardcoded Login Information from Socket and String Compare Symbols

Yoda¹,

Sakuraba²,

Sei³

et al. 2021

AETiC

View full text Add to dashboard Cite

Internet of Things (IoT) for smart homes enhances convenience; however, it also introduces the risk of the leakage of private data. TOP10 IoT of OWASP 2018 shows that the first vulnerability is ”Weak, easy to predict, or embedded passwords.” This problem poses a risk because a user can not fix, change, or detect a password if it is embedded in firmware because only the developer of the firmware can control an update. In this study, we propose a lightweight method to detect the hardcoded username and password in IoT devices using a static analysis called Socket Search and String Search to protect from first vulnerability from 2018 OWASP TOP 10 for the IoT device. The hardcoded login information can be obtained by comparing the user input with strcmp or strncmp. Previous studies analyzed the symbols of strcmp or strncmp to detect the hardcoded login information. However, those studies required a lot of time because of the usage of complicated algorithms such as symbolic execution. To develop a lightweight algorithm, we focus on a network function, such as the socket symbol in firmware, because the IoT device is compromised when it is invaded by someone via the Internet. We propose two methods to detect the hardcoded login information: string search and socket search. In string search, the algorithm finds a function that uses the strcmp or strncmp symbol. In socket search, the algorithm finds a function that is referenced by the socket symbol. In this experiment, we measured the ability of our proposed method by searching six firmware in the real world that has a backdoor. We ran three methods: string search, socket search, and whole search to compare the two methods. As a result, all methods found login information from five of six firmware and one unexpected password. Our method reduces the analysis time. The whole search generally takes 38 mins to complete, but our methods finish the search in 4-6 min.

show abstract

“…Yakdan et al [40] developed REcompile, a decompiler that employs interval analysis to recover control structure. The authors also proposed node splitting to reduce the number of goto statements.…”

Section: Related Workmentioning

confidence: 99%

No More Gotos: Decompilation Using Pattern-Independent Control-Flow Structuring and Semantics-Preserving Transformations

Yakdan¹,

Eschweiler²,

Gerhards-Padilla³

et al. 2015

Proceedings 2015 Network and Distributed System Security Symposium

Self Cite

View full text Add to dashboard Cite

Decompilation is important for many security applications; it facilitates the tedious task of manual malware reverse engineering and enables the use of source-based security tools on binary code. This includes tools to find vulnerabilities, discover bugs, and perform taint tracking. Recovering high-level control constructs is essential for decompilation in order to produce structured code that is suitable for human analysts and sourcebased program analysis techniques. State-of-the-art decompilers rely on structural analysis, a pattern-matching approach over the control flow graph, to recover control constructs from binary code. Whenever no match is found, they generate goto statements and thus produce unstructured decompiled output. Those statements are problematic because they make decompiled code harder to understand and less suitable for program analysis. In this paper, we present DREAM, the first decompiler to offer a goto-free output. DREAM uses a novel patternindependent control-flow structuring algorithm that can recover all control constructs in binary programs and produce structured decompiled code without any goto statement. We also present semantics-preserving transformations that can transform unstructured control flow graphs into structured graphs. We demonstrate the correctness of our algorithms and show that we outperform both the leading industry and academic decompilers: Hex-Rays and Phoenix. We use the GNU coreutils suite of utilities as a benchmark. Apart from reducing the number of goto statements to zero, DREAM also produced more compact code (less lines of code) for 72.7% of decompiled functions compared to Hex-Rays and 98.8% compared to Phoenix. We also present a comparison of Hex-Rays and DREAM when decompiling three samples from Cridex, ZeusP2P, and SpyEye malware families. Permission to freely reproduce all or part of this paper for noncommercial purposes is granted provided that copies bear this notice and the full citation on the first page. Reproduction for commercial purposes is strictly prohibited without the prior written consent of the Internet Society, the first-named author (for reproduction of an entire paper only), and the author's employer if the paper was prepared within the scope of employment.

show abstract

REcompile: A decompilation framework for static analysis of binaries

Cited by 6 publications

References 9 publications

dewolf: Improving Decompilation by leveraging User Surveys

dewolf: Improving Decompilation by leveraging User Surveys

Detection of the Hardcoded Login Information from Socket and String Compare Symbols

No More Gotos: Decompilation Using Pattern-Independent Control-Flow Structuring and Semantics-Preserving Transformations

Contact Info

Product

Resources

About