A Framework for Assessing Decompiler Inference Accuracy of Source-Level Program Constructs

Jace Kline, Prasad Kulkarni

2023

Abstract

Decompilation is the process of reverse engineering a binary program into an equivalent source code representation with the objective to recover high-level program constructs such as functions, variables, data types, and control flow mechanisms. Decompilation is applicable in many contexts, particularly for security analysts attempting to decipher the construction and behavior of malware samples. However, due to the loss of information during compilation, this process is naturally speculative and prone to inaccuracy. This inherent speculation motivates the idea of an evaluation framework for decompilers. In this work, we present a novel framework to quantitatively evaluate the inference accuracy of decompilers, regarding functions, variables, and data types. We develop a domain-specific language (DSL) for representing such program information from any “ground truth” or decompiler source. Using our DSL, we implement a strategy for comparing ground truth and decompiler representations of the same program. Subsequently, we extract and present insightful metrics illustrating the accuracy of decompiler inference regarding functions, variables, and data types, over a given set of benchmark programs. We leverage our framework to assess the correctness of the Ghidra decompiler when compared to ground truth information scraped from DWARF debugging information. We perform this assessment over all the GNU Core Utilities (Coreutils) programs and discuss our findings.

Paper Citation

in Harvard Style

Kline J. and Kulkarni P. (2023). A Framework for Assessing Decompiler Inference Accuracy of Source-Level Program Constructs. In Proceedings of the 9th International Conference on Information Systems Security and Privacy - Volume 1: ICISSP, ISBN 978-989-758-624-8, pages 228-239. DOI: 10.5220/0011872600003405

in Bibtex Style

@conference{icissp23,
author={Jace Kline and Prasad Kulkarni},
title={A Framework for Assessing Decompiler Inference Accuracy of Source-Level Program Constructs},
booktitle={Proceedings of the 9th International Conference on Information Systems Security and Privacy - Volume 1: ICISSP,},
year={2023},
pages={228-239},
publisher={SciTePress},
organization={INSTICC},
doi={10.5220/0011872600003405},
isbn={978-989-758-624-8},
}

in EndNote Style

TY - CONF

JO - Proceedings of the 9th International Conference on Information Systems Security and Privacy - Volume 1: ICISSP,
TI - A Framework for Assessing Decompiler Inference Accuracy of Source-Level Program Constructs
SN - 978-989-758-624-8
AU - Kline J.
AU - Kulkarni P.
PY - 2023
SP - 228
EP - 239
DO - 10.5220/0011872600003405