Publication Details

Design of a Retargetable Decompiler for a Static Platform-Independent Malware Analysis

ĎURFINA, L.; KŘOUSTEK, J.; ZEMEK, P.; KOLÁŘ, D.; HRUŠKA, T.; MASAŘÍK, K.; MEDUNA, A. Design of a Retargetable Decompiler for a Static Platform-Independent Malware Analysis. The 5th International Conference on Information Security and Assurance. Communications in Computer and Information Science, Volume 200. Brno: Springer Verlag, 2011. p. 72-86. ISBN: 978-3-642-23140-7.
Czech title
Návrh rekonfigurovatelného dekompilátoru pro statickou, platformě nezávislou analýzu škodlivého kódu
Type
conference paper
Language
English
Authors
Ďurfina Lukáš, Ing., Ph.D.
Křoustek Jakub, Ing., Ph.D.
Zemek Petr, Ing., Ph.D.
Kolář Dušan, doc. Dr. Ing. (DIFS)
Hruška Tomáš, prof. Ing., CSc. (DIFS)
Masařík Karel, Ing., Ph.D. (CM-SDE)
Meduna Alexandr, prof. RNDr., CSc. (DIFS)
URL
Keywords

decompilation, reverse engineering, malware, LLVM, Lissom, ISAC

Abstract

Together with the massive expansion of smartphones, tablets, and other smart
devices, we can notice a growing number of malware threats targeting these
platforms. Software security companies are not prepared for such diversity of
target platforms and there are only few techniques for platform-independent
malware analysis. This is a major security issue these days. In this paper, we
propose a concept of a retargetable reverse compiler (i.e. a decompiler), which
is in an early stage of development. The retargetable decompiler transforms
platform-specific binary applications into a high-level language (HLL)
representation, which can be further analyzed in a uniform way. This tool will
help with a static platform-independent malware analysis. Our unique solution is
based on an exploitation of two systems that were originally not intended for
such an application - the architecture description language (ADL) ISAC for
a platform description and the LLVM Compiler System as the core of the
decompiler. In this study, we show that our tool can produce highly readable HLL
code.

Published
2011
Pages
72–86
Proceedings
The 5th International Conference on Information Security and Assurance
Series
Communications in Computer and Information Science, Volume 200
Conference
The 5th International Conference on Information Security and Assurance, Brno, CZ
ISBN
978-3-642-23140-7
Publisher
Springer Verlag
Place
Brno
DOI
BibTeX
@inproceedings{BUT76329,
  author="Lukáš {Ďurfina} and Jakub {Křoustek} and Petr {Zemek} and Dušan {Kolář} and Tomáš {Hruška} and Karel {Masařík} and Alexandr {Meduna}",
  title="Design of a Retargetable Decompiler for a Static Platform-Independent Malware Analysis",
  booktitle="The 5th International Conference on Information Security and Assurance",
  year="2011",
  series="Communications in Computer and Information Science, Volume 200",
  pages="72--86",
  publisher="Springer Verlag",
  address="Brno",
  doi="10.1007/978-3-642-23141-4\{_}8",
  isbn="978-3-642-23140-7",
  url="http://link.springer.com/chapter/10.1007%2F978-3-642-23141-4_8"
}
Back to top