An environment for the reverse engineering of executable programs

Reverse engineering of software systems has traditionally centered upon the generation of high level abstractions or specifications from high level code or databases. We report on a reverse engineering environment for low level executable code: a reverse compilation or decompilation environment that aids in the understanding of the underlying executable program. The reverse compilation process recovers high level code from executable programs at a higher representation level than that produced by disassemblers; in fact, disassembly is part of the first stage in this process. Several tools aid in the process of reverse compilation, these are: loaders, signature generators, library prototype generators, disassemblers, library bindings, and language to language translators. The integration of these tools in the whole process is presented in this paper. The results obtained by the prototype reverse compilation system dcc are encouraging: high level code is regenerated with correct use of expressions and control structures, and the complete elimination of registers and condition codes. An elimination rate of low level instructions of over 75% was reached, representing the overall improvement this decompiler system has made over previous decompilers and disassemblers (where the rate tends to be nil). A sample decompilation program is given.