Order of Decompilation

Which order you decompile the procedures of a program in can determine how much information you have available to make good analysis. In Boomerang we've developed a system of depth first search of the call graph, which takes into account recursion, to have the most information about parameters available when needed. For example, if a program consists of two procedures, one called by the other, it makes the most sense to decompile the procedure which is the leaf in the call graph so that the procedure that calls it has the most information about what parameters it needs to pass to it.

What happens if the way the leaf procedure takes a parameter that is a pointer to a compound type? By the parameter's usage the decompiler may be able to determine that it is a pointer, it might even be able to determine that it is a pointer to a compound, but unless every member in the compound is accessed in a way that restricts that member's type sufficiently, the type that the decompiler can determine for the parameter is going to be very vague.

On the other hand, the value that the calling procedure is passing to the leaf procedure may be the result of a library call, or in some other way have a well defined type. As such, from a typing perspective, it would appear to make more sense to do top down processing of procedures in the call graph. However, this can only be done once a bottom up processing has been completed.

As such, I am currently looking at implementing an analysis that determines when additional type information for a called procedure that has been decompiled is discovered and marks that procedure as requiring additional processing. Hopefully no processing in the called procedure will need to be "undone".

Comments

Post a Comment

Popular posts from this blog

Disabling OS-X Device Removal Warnings In Yosemite

Image
If you're anything like me you've probably seen the Disk Not Ejected Properly message so many times that you've forgotten how annoying it is.. despite the fact that you never even wrote anything to the usb drive that you're yanking out of your Mac the operating system insists that you remove it "correctly". You're supposed to click the eject button. Why? I dunno, Apple seems to think that if you can write to it then the operating system might have written to it - and being Apple, they probably have. Well ya know what? Fuck you, I won't do what you tell me. Note: this will not fix your external drive disconnecting when your Mac goes to sleep. For that problem try disabling "put hard drive to sleep when possible" in both the Battery and Power Adapter tabs of the OS energy saver settings. What appears below is a dirty hack for deliberately removing a warning that Apple insists on showing you every single time you yank out a usb stick. ...
Read more

Rebirth Of The Spaceship

Image
Over the last year the space advocate community has splintered into two major groups in answering the question "where should we go next?" Moon First or Mars First . This division was present in the Review of Human Spaceflight (aka Augustine) committee's final report in late 2009, with the surprising conclusion that there isn't the funds for either, suggesting a number of intermediate destinations first - including asteroids. However, as few people consider asteroids to be truly interesting destinations for the human utilization of space ( except me! ), the debate rages on. Many Moon First advocates are "Mars Next" advocates while most Mars First advocates are "Moon Again?" detractors. The former claim that Mars exploration will benefit from lunar exploration, particularly in experience and risk reduction, and perhaps the procurement of propellant. The latter claim that lunar exploration is just a distraction and want to avoid the risk of be...
Read more

Living Inside An Asteroid

Image
Deriders of the new NASA direction have latched on to the announced human asteroid mission in the 2025 timeframe as something they "can't imagine" and therefore is not worth doing. Of course, the administration is talking up the "science" that can be done on an asteroid, and how this could better inform us should the need arise to divert or destroy one that threatens Earth. This is good politics as nothing motivates like fear, but for those of us who think the human spaceflight program is really about preparing us to live at the future homes of humanity, asteroids would seem to be just a stop on the way - I disagree. As I've written previously, the new NASA direction isn't about asteroids - it isn't about destinations - it's about going and specifically, it's about going to Mars. I'm not sure NASA knows yet why they're going to Mars, but they're focusing on the technology to get there and get back safely, and some of the ...
Read more