This is the most unsafe pass and should be walked through with caution! Now that control flow is structured and basic SSA types are resolved, we must tackle the most unsafe aspect of decompilation...
We will be utilizing Z3 SMT solver for this chapter. All reasoning in this chapter assumes fixed-width bit-vector semantics (e.g., 32-bit, 64-bit) with wraparound behavior.* Mixed Boolean Arithme...
As decompilation progresses into structural recovery, one of the most notoriously difficult hurdles is reversing the compiler’s function inlining pass. The Inlining Problem When a compiler inline...
Page starts are typically known or inferred correctly. However, page end boundaries are often incomplete, incorrect, or missing entirely. Because of this, page termination must be inferred through...
The idea of modeling abstract concepts is to represent them in a form that is easy to analyze and transform, while still preserving all semantics necessary to handle side effects. Architecture-Spe...
Branch simplification and recovery are not complicated conceptually, but doing them correctly without breaking semantics is where things can get fairly weird. At the low level, control flow is jus...
Before performing any transformation, you need to make sure every mutable statement and expression is safe, ALWAYS CHECK ENVIRONMENT FLAGS!!! Dead Code Elimination Removes statements that do not ...
A completely FOSS tool I have developed lets you achieve this: Lura-DBI. When analyzing assembly statically, we cannot always precisely determine execution behavior. Will a branch be taken? Wher...
Open source implementation can be found: here. This series describes a full decompiler pipeline that lifts machine code into an intermediate representation, reconstructs control flow, and incremen...