Retdec

Retdec is an LLVM-based machine code decompiler and static binary analysis tool designed for binary reverse engineering. It translates binary executable code into high-level representations to facilitate the reconstruction of program logic from compiled machine code.

The system utilizes a retargetable frontend architecture and a multi-stage lifting pipeline to convert raw bytes into a common intermediate language. It differentiates custom program logic from known library code through signature-based identification and provides utilities for binary symbol demangling to restore human-readable names.

The toolkit covers a broad range of static analysis capabilities, including the reconstruction of high-level functions, types, and class hierarchies. It also provides visualization tools to generate call graphs and control-flow diagrams to map the execution structure of decompiled binaries.

Features

Decompilers - Translates compiled binary machine code back into higher-level source code to facilitate reverse engineering.

Reverse Engineering Tools - Provides comprehensive tools for analyzing the internal logic and structure of compiled binaries.

Program Logic Recovery - Recovers original function calls, data types, and class hierarchies from stripped binary executables.

Intermediate Representation Lifting - Translates machine code into a common intermediate representation to facilitate cross-architecture analysis and optimization.

Static Binary Analysis - Analyzes compiled binaries without execution to extract debugging information and determine program structure.

Binary Logic Analysis - Analyzes compiled binaries to reconstruct high-level functions, types, and execution logic.

Control Flow Analysis Tools - Reconstructs logical execution paths and branching structures from binary code via static analysis.

Decompiled Project Reconstructions - Recovers functions, types, and class hierarchies from machine code to restore original program logic.

Library Code Identification - Identifies and filters out known library code using signature matching to isolate custom program logic.

Retargetable Binary Frontends - Provides a pluggable architecture to support various CPU architectures through a shared decompilation backend.

Symbol Demanglers - Restores human-readable function and variable names from compiled binaries to improve code readability.

Malware Analysis - Supports malware analysis by identifying malicious patterns and unpacking binaries to isolate logic.

Linked Library Stripping - Identifies and strips statically linked library code using signature-based detection to isolate custom logic.

Control-Flow Graph Generation - Generates visual call graphs and control-flow graphs representing the logical execution paths of functions.

Symbolic Type Inference - Infers original data structures and class hierarchies by analyzing memory access patterns and offsets.

Reverse Engineering Tools - Retargetable machine-code decompiler based on LLVM.

avast-tlretdec

Features

Star history