Journal
SOFTWARE-PRACTICE & EXPERIENCE
Volume 43, Issue 11, Pages 1337-1358Publisher
WILEY
DOI: 10.1002/spe.2138
Keywords
reverse engineering; decompilation; C language
Categories
Funding
- Program for PCSIRT and NCET of MOE
- National Natural Science Foundation of China [61073151]
- 863 Program [2011AA01A202, 2012AA010905]
- 973 Program [2012CB723401]
- International Cooperation Program of China [2011DFA10850]
- Sino-Swiss Science and Technology Cooperation (SSSTC) [EG26-032010, IP04-092010]
- [MOE-INTEL-11-05]
Ask authors/readers for more resources
As a key part of reverse engineering, decompilation plays a very important role in software security and maintenance. A number of tools, such as Boomerang and IDA Hex_rays, have been developed to translate executable programs into source code in a relatively high-level language. Unfortunately, most existing decompilation tools suffer from low accuracy in identifying variables, functions, and composite structures, resulting in poor readability. To address these limitations, we present a practical decompiler called C-Decompiler for Windows C programs that (i) uses a shadow stack to perform refined data flow analysis, (ii) adopts inter-basic-block register propagation to reduce redundant variables, and (iii) recognizes library (i.e., Standard Template Library) functions by signatures. We evaluate and compare the decompilation quality of C-Decompiler with two existing tools, Boomerang and IDA Hex_rays, considering four aspects: function analysis, variable expansion rate, total percentage reduction, and cyclomatic complexity. Our experimental results show that on average, C-Decompiler has the highest total percentage reduction of 55.91%, lowest variable expansion rate of 55.79%, and the same cyclomatic complexityastheoriginal source code for each considered application. Furthermore, in our experiments, C-Decompiler is able to recognize functions with a lower false positive and false negative rate than the other decompilers. A case study and our evaluation results confirm that C-Decompiler is a practical tool to produce highly readable C-style code. Copyright (c) 2012 John Wiley & Sons, Ltd.
Authors
I am an author on this paper
Click your name to claim this paper and add it to your profile.
Reviews
Recommended
No Data Available