avast/retdec
Retdec
RetDec is a reverse engineering framework and static binary analysis tool. Its primary purpose is to function as an LLVM-based machine code decompiler that translates binary machine code from multiple architectures into high-level C source code.
The system employs a multi-stage lifting pipeline to recover program logic, using an intermediate representation to apply optimizations before emitting source code. It distinguishes itself through the ability to identify compilers and packers, perform executable unpacking, and reconstruct class hierarchies and original program structures.
The framework covers broad capability areas including binary metadata extraction from formats like DWARF and PDB, symbol demangling, and the generation of call and control-flow graphs. It also provides tools for object file extraction and binary signature generation.
The analysis and decompilation components can be embedded into external software projects using provided headers and build scripts.
Features
- Binary Decompilers - Translates binary machine code from multiple architectures into high-level C source code via an intermediate representation.
- Machine Code Decompilers - Translates binary machine code from multiple architectures into high-level C source code using an LLVM-based pipeline.
- Reverse Engineering Frameworks - Provides a comprehensive framework for recovering program logic, class hierarchies, and control-flow graphs from binaries.
- Decompilers - Translates compiled binary machine code back into higher-level source code using LLVM infrastructure.
- Intermediate Representation Lifting - Lifts machine code into a common intermediate representation to enable cross-architecture analysis and optimizations.
- Retargetable Binary Frontends - Provides a retargetable architecture that decouples binary parsing from the decompilation engine to support multiple CPU instruction sets.
- Static Binary Analysis - Analyzes compiled binaries without execution to detect compilers, identify packers, and extract structural metadata.
- Binary Lifting - Implements a multi-stage pipeline to translate architecture-specific machine code into a portable intermediate representation.
- Reverse Engineering Tools - Analyzes compiled machine code to recover high-level C source code and reconstruct program logic.
- Control Flow Analysis Tools - Reconstructs logical execution paths and function boundaries through static analysis of binary branching structures.
- Control-Flow Graph Generation - Generates call and control-flow graphs to visualize logical execution paths from binary code.
- Packer Detection Tools - Detects the specific compilers used and identifies whether a binary was processed by a packer.
- Executable Unpackers - Removes packing layers from executable files to reveal the original machine code for analysis.
- Symbol Reference Mapping - Maps DWARF and PDB debugging symbols to lifted code to restore original variable and function names.
- Program Logic Recovery - Recovers functions, types, and class hierarchies to restore the original structure of analyzed binary code.
- Binary Metadata Inspection - Parses object file formats to extract and represent the structural composition of compiled binary images.
- Binary Signature Matchers - Identifies compilers and packers by matching binary byte sequences against known structural signatures.
- Debug Symbol Parsers - Extracts metadata and symbolic information from PDB and DWARF files to resolve binary structures.
- Symbol Demanglers - Restores human-readable function and variable names from mangled identifiers generated by compilers.
- Binary Signature Engines - Extracts binary patterns and library signatures to create identification rules for scanning compiled files.
- Malware Analysis - Identifies packers and unpacks binaries to reveal hidden code for security-oriented reverse engineering.
- Binary Metadata - Extracts structural metadata and function names from compiled binaries using DWARF and PDB formats.
- Decompilation Tools - Retargetable machine-code decompiler based on LLVM.
- Code Analysis - Retargetable machine-code decompiler.
- Reverse Engineering Tools - Retargetable machine-code decompiler based on LLVM.
