Exploiting C++ Mechanisms in Retargetable Machine-Code Decompilation

decompilation, reverse engineering, executable analysis, C++ reversing, virtual table, RTTI

Retargetable machine-code decompilation transforms a platform independent executable into a high level language (HLL). Decompilers may be used by reverse engineers to manually inspect suspicious binaries (e.g. malicious software). Most existing decompilers are translating low-level machine code into the C language, since it is simple, yet more readable. Until recently, combination of a high-level C and low-level assembly representations was enough to reverse most applications. However, due to the increasing usage of C++ programming language in creation of more complex malware, understanding reversed programs have become much more difficult. Decompilation of C++ programs into C often produces huge and enigmatic outputs. Therefore, new techniques reconstructing C++ features have to be developed.