DISASSEMBLING AN EXECUTABLE BINARY

• US 20090235054A1
• Filed: 03/17/2008
• Published: 09/17/2009
• Est. Priority Date: 03/17/2008
• Status: Active Grant

• Current Assignee: Zhigu Holdings Limited
• Original Assignee: Microsoft Corporation
• Inventors: Zhang, Kaimin, Zhu, Bin, Pan, Aimin
• Granted Patent: US 8,869,109 B2
• Time in Patent Office: Days
• US Class Current: 712/208
• CPC Class Codes: G06F 8/53 Decompilation; Disassembly

Abstract

A method for disassembling an executable binary (binary). In one implementation, a plurality of potential address references may be identified based on the binary and a plurality of storage addresses containing the binary. A plurality of assembler source code instructions (instructions) may be generated by disassembling the binary. The binary may be disassembled at one or more sequential addresses starting at each of the plurality of potential address references.

Claims

1. A method for disassembling an executable binary (binary), comprising:

identifying a plurality of potential address references based on the binary and a plurality of storage addresses containing the binary; and

generating a plurality of assembler source code instructions (instructions) by disassembling the binary at one or more sequential addresses starting at each of the plurality of potential address references.

2. The method of claim 1, wherein the binary is disassembled using a recursive traversal algorithm.

3. The method of claim 1, further comprising:

associating each of the potential address references with the generated instructions for the respective potential address references.

4. The method of claim 3, further comprising:

determining whether each of the potential address references is valid based on locations of code sections, data sections, the respective potential address reference in the binary, or combinations thereof.

5. The method of claim 3, further comprising:

identifying one of the potential address references in an address-holding structure within the binary, or an entry point location in the binary.

6. The method of claim 5, wherein the address-holding structure is a jump table or a virtual table.

7. The method of claim 3, further comprising determining that a potential address reference is invalid if bytes referred to by the potential address reference include a pattern of a valid string.

8. The method of claim 3, further comprising determining that a potential address reference is invalid if the bytes following a last instruction of the generated instructions do not include a valid instruction.

9. The method of claim 3, further comprising:

resolving conflicts between the generated instructions based on a likelihood that the potential address references associated with the generated instructions are valid address references; and

discarding the generated instructions associated with the potential address reference that is less likely to be valid.

10. The method of claim 9, wherein determining whether the potential address references are more likely to be valid is based on a type of one of the potential address references.

11. The method of claim 9, wherein determining whether the potential address references are more likely to be valid is based on an amount of branch instructions in the generated instructions associated with one of the address references.

12. The method of claim 9, wherein determining whether the potential address references are more likely to be valid is based on an amount of instructions in the generated instructions associated with one of the potential address references.

13. The method of claim 3, further comprising:

validating the potential address references based on consistency of the generated instructions; and

discarding the invalid potential address references and the associated generated instructions.

14. The method of claim 13, wherein determining whether one of the potential address references is valid is based on whether the one potential address reference is an operand in one of the generated instructions associated with the one potential address reference.

15. The method of claim 13, wherein determining whether one of the potential address references is valid comprises performing a virtual execution of at least one of the generated instructions associated with the one potential address reference of the binary.

16. The method of claim 1, wherein generating the generated instructions comprises at least one of:

virtually executing at least one instruction of the binary;

or

virtually executing at least one of the generated instructions.

17. A computer-readable medium having stored thereon computer-executable instructions which, when executed by a computer, cause the computer to:

identify a plurality of potential address references based on an executable binary (binary) and a plurality of storage addresses containing the binary; and

generate a plurality of assembler source code instructions (instructions) by disassembling the binary based on the plurality of potential address references.

18. The computer-readable medium of claim 17, further comprising:

determining whether one of the generated instructions is a valid instruction by virtually executing at least one of the generated instructions.

19. A computer system, comprising:

a processor; and

a memory comprising program instructions executable by the processor to;

identify a plurality of potential address references based on an executable binary (binary) and a plurality of storage addresses containing the binary;

generate a plurality of assembler source code instructions (instructions) by disassembling the binary based on the plurality of potential address references.

20. The computer system of claim 19, wherein the memory further comprises program instructions executable by the processor to:

associate each of the potential address references with the generated instructions for the respective potential address references;

determine whether each of the potential address references is valid;

run a recursive traversal algorithm;

resolve conflicts between the generated instructions based on the likelihood that the potential address references associated with the generated instructions are valid address references;

validate the potential address references based on the generated instructions;

discard invalid potential address references and the associated generated instructions; and

execute virtually at least one instruction of the binary.