反编译中用户函数与库函数同名的区分技术研究  

Study of User and Library Functions Distinguishing Technology in Decompilation

作　　者：吴伟峰[1] 赵荣彩[1] 

机构地区：[1]信息工程大学信息工程学院,郑州450002

出　　处：《计算机学报》2011年第4期738-747,共10页Chinese Journal of Computers

基　　金：国家核高基重大专项基金(2009ZX01036-001-2);国家"八六三"高技术研究发展计划项目基金(2006AA01Z408;2009AA01Z434)资助

摘　　要：ITC反编译系统应用了基于动态链接信息的库函数快速识别技术,对于绝大部分待翻译IA-64二进制可执行程序中的库函数它都能正确识别,但是当二进制可执行程序包含有与库函数同名的用户函数时,就可能会出现问题.作者在深入分析基于动态链接信息的库函数快速识别技术所导致的问题原因的基础上,充分研究了ELF64格式二进制文件的具体组织及编译链接策略,针对反编译及二进制翻译在此方面的问题,给出了准确区分用户函数和库函数的区分算法.ITC decompilation System,which adopts the fast library functions recognizing technology that is based upon dynamic linking information,can obtains correct recognition for library functions in the most of the IA-64＇s binary executable programs that we have.However,it is likely to lead problems when binary executable program contains user function which has the same name with some library function.Based on thoroughly analyzing the reasons caused by the fast library functions recognizing technology which is based on dynamic linking information,the authors fully study the organizing strategy of ELF-64 object file and the working policy of compilers and linkers to deal it.Then an algorithm is presented to solve the problem led by user function which has the same name with library function,and it fills the gap of decompilation or binary translation in this aspect.

关 键 词：反编译 IA-64 ELF64 动态链接 用户函数 库函数 同名 

分 类 号：TP311[自动化与计算机技术—计算机软件与理论]