Falke Diploma Summary

Raimar Falke's Diploma Thesis is written in German. For English readers, I have translated the final section using Google's translation facility and some hand editing.

It strikes me that natural language translation is at a somewhat equivalent stage as decompilation: automatic translators exist, and you can get a sense of the original text, sometimes clearly, at other times quite muddled. Often hand editing is required to produce a clean translation. The automatic translator is useful despite its low quality, because at least initially, you have very little idea of what the input text means.

-- MikeVanEmmerik - 13 Jan 2005

5 Summary and Conclusion

In this paper a type analysis system for a decompiler was presented. Characteristics were defined, which contain all type-relevant information about the examined program. Furthermore a multitude of possibilities of the user were modelled for influencing the type analysis. The presented type system supports the complex types array, struct and sum types in addition to integers and pointers. Sum types are used to model conflicts. The presented methods for the recognition of arrays work for all compiler optimizations except two (loop unrolling and loop collapsing).

Multidimensional array types, classes, floating-point numbers, 64-Bit integers, enumerated types and bit fields were not considered in this paper. These types offer challenges for the future. A procedure which measures the quality of the extraction of type-relevant information and the type reconstruction, would also be useful. Without this, one cannot formally measure the quality of a type analysis. A graphical interface for the input of the user instructions would simplify the use of the decompiler.

With the help of clone detection, it would be possible to recognise compiler optimisations such as loop unrolling, and also improve statements relating to array parameters. As became evident, aliases limit the decompiler in many ways. This can be improved by the employment of an alias analysis component. Compilers usually include additional information for debugging in the examined program. Using these information is a also possible task. Harmful programs such as worms and viruses are partially polymorphic, i.e. they change their form (e.g. the sequence of assembler instructions) during their propagation. It would be interesting to find out to what extent these transformations are still visible after decompilation.

---

CategoryDecompilation