avast-tl/retdec
Retdec
Retdec is an LLVM-based machine code decompiler and static binary analysis tool designed for binary reverse engineering. It translates binary executable code into high-level representations to facilitate the reconstruction of program logic from compiled machine code.
The system utilizes a retargetable frontend architecture and a multi-stage lifting pipeline to convert raw bytes into a common intermediate language. It differentiates custom program logic from known library code through signature-based identification and provides utilities for binary symbol demangling to restore human-readable names.
The toolkit covers a broad range of static analysis capabilities, including the reconstruction of high-level functions, types, and class hierarchies. It also provides visualization tools to generate call graphs and control-flow diagrams to map the execution structure of decompiled binaries.
Features
- Decompilers - Translates compiled binary machine code back into higher-level source code to facilitate reverse engineering.
- Reverse Engineering Tools - Provides comprehensive tools for analyzing the internal logic and structure of compiled binaries.
- Program Logic Recovery - Recovers original function calls, data types, and class hierarchies from stripped binary executables.
- Intermediate Representation Lifting - Translates machine code into a common intermediate representation to facilitate cross-architecture analysis and optimization.
- Static Binary Analysis - Analyzes compiled binaries without execution to extract debugging information and determine program structure.
- Binary Logic Analysis - Analyzes compiled binaries to reconstruct high-level functions, types, and execution logic.
- Control Flow Analysis Tools - Reconstructs logical execution paths and branching structures from binary code via static analysis.
- Decompiled Project Reconstructions - Recovers functions, types, and class hierarchies from machine code to restore original program logic.
- Library Code Identification - Identifies and filters out known library code using signature matching to isolate custom program logic.
- Retargetable Binary Frontends - Provides a pluggable architecture to support various CPU architectures through a shared decompilation backend.
- Symbol Demanglers - Restores human-readable function and variable names from compiled binaries to improve code readability.
- Malware Analysis - Supports malware analysis by identifying malicious patterns and unpacking binaries to isolate logic.
- Linked Library Stripping - Identifies and strips statically linked library code using signature-based detection to isolate custom logic.
- Control-Flow Graph Generation - Generates visual call graphs and control-flow graphs representing the logical execution paths of functions.
- Symbolic Type Inference - Infers original data structures and class hierarchies by analyzing memory access patterns and offsets.
- Binary Analysis - Decompiles machine code into C-like output using LLVM.
- Reverse Engineering Tools - Retargetable machine-code decompiler based on LLVM.
