Decompilation apparatus and recompilation system for a processor architecture
A decompilation apparatus includes a matcher that divides captured first program code for a processor of a first processor architecture into a sequence of code sections based on a predetermined set of at least partially parameterized code patterns, wherein the first program code implements a program logic and has been generated by compiling a computer program defined in a high-level language by a compiler, and the matcher captures for each code section specific parameter values for each parameter of a corresponding parameterized code pattern and assigns to each code section a terminal symbol of an intermediate language; and a parser that reduces a sequence of terminal symbols assigned to the sequence of code sections to non-terminal symbols of the intermediate language, wherein a totality of the non-terminal symbols generated by the parser by reduction describes the program logic of the computer program in the intermediate language.
1. A decompilation apparatus comprising:
a processor of a first processor architecture comprising:
a matcher that divides captured first program code for the processor of the first processor architecture into a sequence of code sections based on matching the captured first program code to a predetermined set of at least partially parameterized code patterns, wherein the captured first program code implements a program logic and has been generated by compiling a computer program defined in a high-level language by a compiler, and the matcher captures for each code section of the sequence of code sections specific parameter values for each parameter of a corresponding parameterized code pattern and assigns to each code section of the sequence of code sections a terminal symbol of an intermediate language, and wherein the matcher is further adapted to capture binary code or assembly code during the compilation of the computer program for the first processor architecture and to extract machine code of the captured first program code contained therein; and
a parser that reduces a sequence of terminal symbols assigned to the sequence of code sections to non-terminal symbols of the intermediate language by parsing the sequence of terminal symbols, wherein a totality of the non-terminal symbols of the intermediate language generated by the parser by the reduction describes the program logic of the computer program in the intermediate language.
2. The decompilation apparatus of claim 1 , wherein:
the matcher is further adapted to perform a first run and a second run over the binary code or the assembly code for the first processor architecture,
in the first run, the matcher generates jump labels corresponding to jump targets of jump instructions contained in individual code patterns of the predetermined set of at least partially parameterized code patterns, and
in the second run, the matcher generates the sequence of code sections used in the computer program on a basis of the jump labels generated in the first run.
3. The decompilation apparatus of claim 1 , wherein the parser is further adapted to check compliance with at least one contextual condition when reducing to a non-terminal symbol and reject a possible reduction to the non-terminal symbol as incorrect if the at least one contextual condition is not satisfied by the parameter values for each parameter of the corresponding parameterized code pattern.
4. The decompilation apparatus of claim 1 , wherein the parser is a bottom-up parser adapted to reduce the sequence of terminal symbols using reduction rules of a context-free grammar.
5. The decompilation apparatus of claim 4 , wherein the parser is a LR parser.
6. The decompilation apparatus of claim 4 , wherein the bottom-up parser is further adapted to check compliance with at least one contextual condition when reducing to a non-terminal symbol and reject a possible reduction to the non-terminal symbol as incorrect if the at least one contextual condition is not satisfied by the parameter values for each parameter of the corresponding parameterized code pattern.
7. The decompilation apparatus of claim 1 , further comprising a pattern parser that reads in at least one text file having therein definitions of the predetermined set of at least partially parameterized code patterns.
8. The decompilation apparatus of claim 1 , wherein the non-terminal symbols of the intermediate language are characteristic of an at least one imperative higher programming language.
9. The decompilation apparatus of claim 1 , wherein the non-terminal symbols of the intermediate language represent at least one program construct of the at least one imperative higher programming language; a check of a condition; a conditional execution of a program section; an evaluation of an arithmetic expression; an assignment of a value to a variable; a call to another program section with or without passing of one or more parameter values or references; a call to a subroutine; a return from a subroutine;
and a traversal of a program loop.
10. A recompilation system comprising the decompilation apparatus according to claim 1 and at least one code generation apparatus that translates the program logic represented in the intermediate language into machine code corresponding to the computer program for a second processor architecture.
11. The recompilation system of claim 10 , wherein the at least one code generation apparatus generates executable x86 binary code.
12. A computer program product comprising machine code stored in a memory of a computer system, the machine code having been generated by the recompilation system according to claim 10 and being suitable for execution on a processor of the computer system having the second processor architecture.
13. A computer program product comprising program code stored in a memory of a computer system, wherein the program code implements a decompiler, and wherein the program code causes a processor of the computer system to perform at least steps a) and b) when the program code is executed by the processor of the computer system:
a) dividing, by a matcher, captured first program code for a processor of a first processor architecture into a sequence of code sections based on matching the captured first program code to a predetermined set of at least partially parameterized code patterns, wherein the captured first program code implements a program logic and has been generated by compiling a computer program defined in a high-level language by a compiler, and the matcher captures for each code section of the sequence of code sections specific parameter values for each parameter of a corresponding parameterized code pattern and assigns to each code section of the sequence of code sections a terminal symbol of an intermediate language, and wherein the matcher is further adapted to capture binary code or assembly code during the compilation of the computer program for the first processor architecture and to extract machine code of the captured first program code contained therein; and
b) reducing, by a parser, a sequence of terminal symbols assigned to the sequence of code sections to non-terminal symbols of the intermediate language by parsing the sequence of terminal symbols, wherein a totality of the non-terminal symbols of the intermediate language generated by the parser by the reduction describes the program logic of the computer program in the intermediate language.
14. The computer program product of claim 13 , wherein the program code further causes the processor of the computer system to perform at least steps c) and d) when the program code is executed by the processor of the computer system:
c) checking compliance with at least one contextual condition when reducing a first sequence of terminal symbols assigned to the sequence of code sections to a first non-terminal symbol; and
d) rejecting a possible reduction to the first non-terminal symbol as incorrect if the at least one contextual condition is not satisfied by the parameter values for each parameter of the corresponding parameterized code pattern.
15. The computer program product of claim 14 , wherein the program code further causes the processor of the computer system to repeatedly perform at least steps e), f), and g) when the program code is executed by the processor of the computer system:
e) when a possible reduction to the first non-terminal symbol is rejected as incorrect, finding another sequence of terminal symbols that can be translated into a second non-terminal symbol;
f) checking compliance with the at least one contextual condition when reducing the first sequence of terminal symbols assigned to the sequence of code sections to the second non-terminal symbol; and
g) terminating the reduction with an error if no non-terminal symbol can be successfully assigned according to rules of grammar used for parsing the sequence of terminal symbols.
16. The computer program product of claim 13 , wherein the program code further causes the processor of the computer system to perform at least step h) when the program code is executed by the processor of the computer system:
h) recursively reducing first terminal symbols or first non-terminal symbols to a higher-level, second non-terminal symbol to build a syntax tree corresponding to the program logic, wherein a root of the syntax tree corresponds to a start symbol of grammar from which the program logic can be derived.