On decompilation of VLIW executable files

K. Jakub

Abstract


Machine-code decompilation (i.e. reverse program compilation) is a process often used in reverse engineering. Its task is to transform a platform-specific executable file into a high-level language representation, which is usually the C language. In present, we can find several such tools that support different target architectures (e.g. Intel x86, MIPS, ARM). These architectures can be classified either as RISC (reduced instruction set computing) or CISC (complex instruction set computing). However, none of the existing decompilers support another major architecture type – VLIW (very long instruction word). In this paper, we briefly describe the VLIW architecture together with its unique features and we present several novel approaches how to handle these VLIW-specific features in the decompilation process. We focus on handling of instruction lengths, instruction bundling, and data hazards.

Keywords


RISC; CISC; VLIW

References


Ďurfina L., Křoustek J., Zemek P., and Ká-bele B. Detection and recovery of functions and their arguments in a retargetable decompiler // In 19-th Working Conference on Reverse Engineering (WCRE’12), (King-ston, ON, CA). IEEE Computer Society, 2012. – P. 51–60.

Eilam E. Reversing: Secrets of Reverse En-gineering. Wiley, 2005.

Ďurfina L., Křoustek J., and Zemek P. Ge-neric source code migration using decompi-lation // In 10-th Annual Industrial Simulation Conference (ISC’2012). EUROSIS, 2012. – P. 38–42.

Fisher J.A., Faraboschi P., and Young C. Embedded Computing a VLIW Approach to Architecture, Compilers and Tools. – San Francisco, US-CA: Morgan Kaufmann Pub-lishers, 2005.

Křoustek J., Židek S., Kolář D., and Meduna A. Exploitation of Scattered Context Gram-mars to Model VLIW Instruction Constraints // In 12-th Biennial Baltic Electron-ics Conference (BEC’10). IEEE Computer Society, 2010. – P. 165–168.

Faraboschi P., Brown G., Fisher J.A., Des-oll G. and Homewood F. Lx: A Technology Platform for Customizable VLIW Embed-ded Processing // In 27-th International Symposium on Computer Architecture (IS-CA’00), (New York, US-NY). IEEE Com-puter Society, 2000. – P. 203–213.

The LLVM Compiler Infrastructure. http://llvm.org/, 2013.

Křoustek J. and Kolář D. Preprocessing of binary executables towards retargetable decompilation // In 8-th International Mul-ti-Conference on Computing in the Global Information Technology (ICCGI’13), (Nice, FR). International Academy, Research, and Industry Association (IARIA), 2013. – P. 259–264.

Křoustek J., Matula P., and Ďurfina L. Ge-neric plugin-based convertor of executable formats and its usage in retargetable decompilation // In 6-th International Scien-tific and Technical Conference (CSIT’11). Ministry of Education, Science, Youth and Sports of Ukraine, Lviv Polytechnic Na-tional University, Institute of Computer Science and Information Technologies, 2011. – P. 127–130.

Ďurfina L., Křoustek J., and Zemek P. Psyb0t malware: A step-by-step decompila-tion case study // In 20-th Working Confer-ence on Reverse Engineering (WCRE’13), (Koblenz, DE). IEEE Computer Society, 2013. – P. 449–456.

http://decompiler.fit.vutbr.cz/decompilation/

Fisher J.A. Very long instruction word ar-chitectures and the ELI-512 // In 10-th An-nual International Symposium on Computer Architecture (ISCA ’83), (New York, US-NY). ACM, 1983. – P. 140–150.

http://gmplib.org/

http://www.mpir.org/

Přikryl Z., Křoustek J., Hruška T., Kolář D., Masařík K., and Husár A. Design and de-bugging of parallel architectures using the ISAC language // In Annual International Conference on Advanced Distributed and Parallel Computing and Real-Time and Embedded Systems (RTES’10). Global Sci-ence and Technology Forum (GTSF), 2010. – P. 213–221.

Emmerik M. van and Waddington T. Using a decompiler for realworld source recovery // In Proceedings of the 11-th Working Confer-ence on Reverse Engineering (WCRE’04), (Washington, DC, USA). IEEE Computer Society, 2004. – P. 27–36.


Refbacks

  • There are currently no refbacks.