DEWOLF: IMPROVING DECOMPILATIONBY LEVERAGING USER SURVEYS
Steffen Enders, Eva-Maria C. Behner, Niklas Bergmann, Mariia Rybalka,Elmar Padilla, Er Xue Hui, Henry Low, Nicholas Sim
steffen.enders@fkie.fraunhofer.de

Slide 0March 3rd 2023, Workshop on Binary Analysis Research (BAR) 2023, San Diego, CA, USA© Cyber Analysis & Defense Department, Fraunhofer FKIE

2023-03-03 | BAR Workshop, San DiegoSlide 1
March 3rd 2023, Workshop on Binary Analysis Research (BAR) 2023, San Diego, CA, USA© Cyber Analysis & Defense Department, Fraunhofer FKIERelated Work / Decompilers
n Essential for many binary analysis approachesn Each decompiler has a different focus!

https://github.com/revng
https://www.qbssoftware.com/jeb-decompiler.html
https://mobile.twitter.com/retdec

n There is still plenty of room for improvements!

https://ghidra-sre.org
https://hex-rays.com
https://github.com/USECAP/dream
https://binary.ninja

Slide 2
March 3rd 2023, Workshop on Binary Analysis Research (BAR) 2023, San Diego, CA, USA© Cyber Analysis & Defense Department, Fraunhofer FKIEDecompilation can be done differently!
Output 1undefined4 dividability_rules(void) {int iVar1; int local_10 [3];printf("Enter a number: ");__isoc99_scanf(&DAT_0804c025,local_10);
iVar1 = local_10[0];printf("A number is dividable by %d:\n",local_10[0]);if (local_10[0] == 0x7d) {printf("last three digits dividable by 125",iVar1);
return 0; }if (local_10[0] < 0x7e) {if (local_10[0] < 0xb) {switch(local_10[0]) {case 0:
printf("not possible",iVar1);
return 0;...
case 10:printf("last digit is 0",iVar1);
return 0;}} else {if (local_10[0] == 100) {printf("the last two digits are 0",iVar1);
return 0;}}}
printf("we have no rule",iVar1); return 0; }Slide 3
March 3rd 2023, Workshop on Binary Analysis Research (BAR) 2023, San Diego, CA, USA© Cyber Analysis & Defense Department, Fraunhofer FKIE

Output 2
int dividability_rules() {int var_0; int * var_1;
printf("Enter a number: ");var_1 = &var_0;__isoc99_scanf("%d", var_1);
printf("A number is dividable by %d:\n", var_0);
switch(var_0) {case 0x0:printf("not possible");break;...
case 0xa:
printf("last digit is 0");break;
case 100:printf("the last two digits are 0");break;
case 125:
printf("last three digits dividable by 125");
break;
default:
printf("we have no rule");}return 0;}

User Surveys

Slide 4
March 3rd 2023, Workshop on Binary Analysis Research (BAR) 2023, San Diego, CA, USA© Cyber Analysis & Defense Department, Fraunhofer FKIE

User Surveys Metadata

Survey Respondents

Respondents Skills (Survey 3)250605054474030

Time (min)1154200

442337150

3120100

1050200Survey 1Survey 2Complete

Incomplete

Slide 5
March 3rd 2023, Workshop on Binary Analysis Research (BAR) 2023, San Diego, CA, USA© Cyber Analysis & Defense Department, Fraunhofer FKIE

Survey 3
Reversing + CCNone0Survey 1 Survey 2 Survey 3

User Survey 1

n Research Questions:n What decompilation aspects should be improved to enhance manual analysis?
n What readability aspects are important to users?
n What are the limitations of current approaches and the state-of-the-art?

Slide 6
March 3rd 2023, Workshop on Binary Analysis Research (BAR) 2023, San Diego, CA, USA© Cyber Analysis & Defense Department, Fraunhofer FKIEExample 1Respondents
liked switch

Slide 7
March 3rd 2023, Workshop on Binary Analysis Research (BAR) 2023, San Diego, CA, USA© Cyber Analysis & Defense Department, Fraunhofer FKIE

They didn‘tlike the goto

Example 2+ Short & Clean+ For-Loop- Long & Complex- Too many Veriables

Slide 8March 3rd 2023, Workshop on Binary Analysis Research (BAR) 2023, San Diego, CA, USA© Cyber Analysis & Defense Department, Fraunhofer FKIESurvey 1 TL;DRn Readability depends on user preference and the given analysis task
Ø Users crave configurable decompilers
n Readability > Assembly Structuren Identified many aspects with room for improvements
n Instruction Idioms, Switch Reconstruction, …

Slide 9March 3rd 2023, Workshop on Binary Analysis Research (BAR) 2023, San Diego, CA, USA© Cyber Analysis & Defense Department, Fraunhofer FKIE

Contributions

n Various improvements for DREAM to get academia “back on track”
with commercial state-of-the-art decompilers
n dewolf Decompilern highly configurable, easily expandable, and open-sourcen Available in Binary Ninja’s Plugin Manager and on dogbolt.org
n We publish all survey results [1][1] https://github.com/steffenenders/dewolf-surveys
Slide 10
March 3rd 2023, Workshop on Binary Analysis Research (BAR) 2023, San Diego, CA, USA© Cyber Analysis & Defense Department, Fraunhofer FKIEdewolf Overview
Frontend(Preprocessing/) Pipeline Stages

Backend0010 1110
1100 0001

Dataflowalgorithms

Control-flow
algorithms

Lifting

Slide 11
March 3rd 2023, Workshop on Binary Analysis Research (BAR) 2023, San Diego, CA, USA© Cyber Analysis & Defense Department, Fraunhofer FKIE

CodeGenerator

+dewolf Improvements over DREAM
Switch Variable Detection
For-loop Recovery
Elimination of Dead Paths and Loops
Custom Logic Engine

Subexpression Elimination
Instruction Idiom Handling
Elimination of Redundant Casts
Improved Out-of-SSA+

Constant Representation
Array Access Detection
Continue in Loops=

int64_t xor(int64_t arg1, int64_t arg2, int64_t arg3, int64_t arg4) {printf("%lu",arg2);
int32_t var_c = 0x0L;
while(true) {long xor(void * arg1, long arg2, long arg3, long arg4) {int64_t rax_14 = var_c /* sx None */;int i;
if ((arg2 <= var_c /* sx None */)) {int var_1;
break;
void * var_0;}
printf(/* format */ "%lu\n", arg2);
char* rax_4 = (arg1 + var_c /* sx None */);for (i = 0; arg2 > i; i++) {uint64_t rsi_1 = *rax_4 /* zx char */ /* zx uint32_t */;var_0 = arg1 + i;
int64_t rax_6 = var_c /* sx None */;*var_0 = *var_0 ^ *(arg3 + (i + (0L << 0x40)) % arg4);
int64_t rdx_1 = 0x0L;}
char* rax_9 = (arg3 + ((rdx_1:rax_6) % arg4));
var_1 = i;uint64_t rcx = *rax_9 /* zx char */ /* zx uint32_t */;return var_1;
int64_t rax_12 = (arg1 + var_c /* sx None */);}
uint64_t rdx_4 = (rsi_1.esi ^ rcx.ecx) /* zx None */;*rax_12 = rdx_4.dl;
int32_t var_c = (var_c + 0x1L);}
return rax_14;}

vs.

Slide 12
March 3rd 2023, Workshop on Binary Analysis Research (BAR) 2023, San Diego, CA, USA© Cyber Analysis & Defense Department, Fraunhofer FKIE

User Survey 2+3 Research Questionsn Research Questions:n Does dewolf produce readable & comprehensible output to qualify as a base for future research?
n (Can dewolf exceed state-of-the-art decompilers in certain cases?)n To what extent do respondents tolerate diverging from the assembly during decompilation?
n What are further areas to improve readability in future research?

Slide 13
March 3rd 2023, Workshop on Binary Analysis Research (BAR) 2023, San Diego, CA, USA© Cyber Analysis & Defense Department, Fraunhofer FKIEComprehension Questionsn What is the purpose of the function?
n What TLDs does the DGA utilize?
n What is the most used TLD?
n Which of the provided domains could begenerated by the DGA?
n How many different domains can begenerated by the DGA?

Slide 14
March 3rd 2023, Workshop on Binary Analysis Research (BAR) 2023, San Diego, CA, USA© Cyber Analysis & Defense Department, Fraunhofer FKIEComprehension Results Divided by C-Skills (self assessment)

Slide 15March 3rd 2023, Workshop on Binary Analysis Research (BAR) 2023, San Diego, CA, USA© Cyber Analysis & Defense Department, Fraunhofer FKIEDecompiler Comparison

50403020…

100Rank 1

Slide 16
March 3rd 2023, Workshop on Binary Analysis Research (BAR) 2023, San Diego, CA, USA© Cyber Analysis & Defense Department, Fraunhofer FKIE

Rank 2Rank 3

What participants (dis)liked in state-of-the-art decompilers

Positive
Switch-Recovery

Deeply Nested If/ElseLow Nesting DepthHigh Nesting Depthfor-loops, if possible
Good Type Recovery
Less CastsArray Access Detection
Constant Annotations

Slide 17
March 3rd 2023, Workshop on Binary Analysis Research (BAR) 2023, San Diego, CA, USA© Cyber Analysis & Defense Department, Fraunhofer FKIE

Negativevs.

While-loops instead of for-loops
Bad Type Recovery
Explicit Casts
Too many unnecessary variables
String Parameters

Introducing Copies during Restructuring?
If-Else?

Multi-Exit

5 Instructions

10 Instructions

15 Instructions

Multi-Entry

5 Instructions 10 Instructions15 Instructions

Slide 18
March 3rd 2023, Workshop on Binary Analysis Research (BAR) 2023, San Diego, CA, USA© Cyber Analysis & Defense Department, Fraunhofer FKIETL;DRn Future decompilers (focusing on manual analysis) should:
n Favor readability over sticking to the assemblyn Be highly configurable!

n If you are into decompilation, you should:
n Check out dewolf (great base for new research, imho)n Read the paper and survey results

Slide 19
March 3rd 2023, Workshop on Binary Analysis Research (BAR) 2023, San Diego, CA, USA© Cyber Analysis & Defense Department, Fraunhofer FKIE

steffen.enders@fkie.fraunhofer.de

Q&A
Slide 20
March 3rd 2023, Workshop on Binary Analysis Research (BAR) 2023, San Diego, CA, USA© Cyber Analysis & Defense Department, Fraunhofer FKIE

@steffenenders_
https://github.com/fkie-cad/dewolf