Skip to main content

Solvers for Type Recovery and Decompilation of Binaries

Robbins, Ed (2017) Solvers for Type Recovery and Decompilation of Binaries. Doctor of Philosophy (PhD) thesis, University of Kent,.

Download (1MB) Preview


Reconstructing the meaning of a program from its binary is known as reverse engineering. Since reverse engineering is ultimately a search for meaning, there is growing interest in inferring a type (a meaning) for the elements of a binary in a consistent way. Currently there is no consensus on how best to achieve this, with the few existing approaches utilising ad-hoc techniques which lack any formal basis. Moreover, previous work does not answer (or even ask) the fundamental question of what it means for recovered types to be correct. This thesis demonstrates how solvers for Satisfiability Modulo Theories (SMT) and Constraint Handling Rules (CHR) can be leveraged to solve the type reconstruction problem. In particular, an approach based on a new SMT theory of rational tree constraints is developed and evaluated. The resulting solver, based on the reification mechanisms of Prolog, is shown to scale well, and leads to a reification driven SMT framework that supports rapid implementation of SMT solvers for different theories in just a few hundred lines of code. The question of how to guarantee semantic relevance for reconstructed types is answered with a new and semantically-founded approach that provides strong guarantees for the reconstructed types. Key to this approach is the derivation of a witness program in a type safe high-level language alongside the reconstructed types. This witness has the same semantics as the binary, is type correct by construction, and it induces a (justifiable) type assignment on the binary. Moreover, the approach, implemented using CHR, yields a type-directed decompiler. Finally, to evaluate the flexibility of reificiation-based SMT solving, the SMT framework is instantiated with theories of general linear inequalities, integer difference problems and octagons. The integer difference solver is shown to perform competitively with state-of-the-art SMT solvers. Two new algorithms for incremental closure of the octagonal domain are presented and proven correct. These are shown to be both conceptually simple, and offer improved performance over existing algorithms. Although not directly related to reverse engineering, these results follow from the work on SMT solver construction.

Item Type: Thesis (Doctor of Philosophy (PhD))
Thesis advisor: King, Andy
Uncontrolled keywords: Satisfiability Modulo Theories, SMT, SAT, SMT, framework, constraint solving, reification, type recovery, reverse engineering, decompilation, reversing, verification, CHR, Constraint Handling Rules, type reconstruction, rational trees, octagon domain, integer difference logic, theory of rational trees, rational tree unification,
Divisions: Faculties > Sciences > School of Computing
Depositing User: Users 1 not found.
Date Deposited: 13 Apr 2017 15:00 UTC
Last Modified: 29 May 2019 18:57 UTC
Resource URI: (The current URI for this page, for reference purposes)
  • Depositors only (login required):


Downloads per month over past year