6
$\begingroup$

I would like to learn more whether it is possible and how to write a program which decompiles executable binary (an object file) to the C source. I'm not asking exactly 'how', but rather how this can be achieved.

Given the following hello.c file (as example):

#include <stdio.h>
int main() {
  printf("Hello World!");
}

Then after compilation (gcc hello.c) I've got the binary file like:

$ hexdump -C a.out | head
00000000  cf fa ed fe 07 00 00 01  03 00 00 80 02 00 00 00  |................|
00000010  0f 00 00 00 b0 04 00 00  85 00 20 00 00 00 00 00  |.......... .....|
00000020  19 00 00 00 48 00 00 00  5f 5f 50 41 47 45 5a 45  |....H...__PAGEZE|
00000030  52 4f 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |RO..............|
00000040  00 00 00 00 01 00 00 00  00 00 00 00 00 00 00 00  |................|
00000050  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000060  00 00 00 00 00 00 00 00  19 00 00 00 d8 01 00 00  |................|
00000070  5f 5f 54 45 58 54 00 00  00 00 00 00 00 00 00 00  |__TEXT..........|
$ wc -c hello.c a.out 
  60 hello.c
8432 a.out

For the learning dataset I assume I'll have to have thousands of source code files along with its binary representation, so algorithm can learn about moving parts on certain changes.

My concerns are:

  • do my algorithm needs to be aware about the header file, or it's "smart" enough to figure it out,
  • if it needs to know about the header, how do I tell my algorithm 'here is the header file',
  • what should be input/output mapping (whether some section to section or file to file),
  • do I need to divide my source code into some sections,
  • do I need to know exactly how decompilers work or AI can figure it out for me,
  • or should I've two networks, one for header, another for body it-self,
  • or more separate networks, each one for each logical component (e.g. byte->C tag, etc.)

How would you tackle this?

$\endgroup$
  • 1
    $\begingroup$ Imagine what would happen to those programs which are closed-source if this decompiler is created! $\endgroup$ – skrtbhtngr Nov 12 '16 at 19:10
3
$\begingroup$

In-between your input and desired output, there's obviously a huge space to search. The more relevant domain information you include as features, the higher chance that the Deep Learning (DL) algorithm can find the desired mapping.

At this early stage in DL research, there aren't so many rules of thumb to tell you what features to explicitly encode - not least because it depends on the size of your training corpus. My suggestion would be: obtain (or generate) a large corpus of C code, train on that with the most naive feature representation that you think might work, then repeatedly gather data and add more feature preprocessing as necessary.

This following paper describes a DL approach to what is almost the 'reverse problem' to yours - generating the source code for a program described in natural language.

I found the strength of the results reported in this paper surprising, but it does give me some hope that what you are asking might be possible.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.