PLACEHOLDER Next Chapter: Chapter 18 - Practical Decompilation Results and Pipeline Evaluation Prev Chapter: Chapter 16 - Deobfuscation Mixed Boolean Arithmetic and Opaque Predicate Removal
We will be utilizing Z3 SMT solver for this chapter. All reasoning in this chapter assumes fixed-width bit-vector semantics (e.g., 32-bit, 64-bit) with wraparound behavior.* Mixed Boolean Arithme...
PLACEHOLDER Next Chapter: Chapter 16 - Deobfuscation Mixed Boolean Arithmetic and Opaque Predicate Removal Prev Chapter: Chapter 14 - Modeling Inlined Functions as Virtual Function
Next Chapter: Chapter 15 - Recovering Virtual Functions Prev Chapter: Chapter 13 - Safe Page-Level Optimization
Page starts are typically known or inferred correctly. However, page end boundaries are often incomplete, incorrect, or missing entirely. Because of this, page termination must be inferred through...
The idea of modeling abstract concepts is to represent them in a form that is easy to analyze and transform, while still preserving all semantics necessary to handle side effects. Architecture-Spe...
Branch simplification and recovery are not complicated conceptually, but doing them correctly without breaking semantics is where things can get fairly weird. At the low level, control flow is jus...
Before performing any transformation, you need to make sure every mutable statement and expression is safe, ALWAYS CHECK ENVIRONMENT FLAGS!!! Dead Code Elimination Removes statements that do not ...
When analyzing assembly statically, we cannot always precisely determine execution behavior. Will a branch be taken? Where does this indirect jump go to? Which instructions are actually executed...
This series describes a full decompiler pipeline that lifts machine code into an intermediate representation, reconstructs control flow, and incrementally simplifies it into readable high-level cod...