反编译中用户函数与库函数同名的区分技术研究

Study of User and Library Functions Distinguishing Technology in Decompilation

ITC反编译系统应用了基于动态链接信息的库函数快速识别技术,对于绝大部分待翻译IA-64二进制可执行程序中的库函数它都能正确识别,但是当二进制可执行程序包含有与库函数同名的用户函数时,就可能会出现问题.作者在深入分析基于动态链接信息的库函数快速识别技术所导致的问题原因的基础上,充分研究了ELF64格式二进制文件的具体组织及编译链接策略,针对反编译及二进制翻译在此方面的问题,给出了准确区分用户函数和库函数的区分算法.

ITC decompilation System,which adopts the fast library functions recognizing technology that is based upon dynamic linking information,can obtains correct recognition for library functions in the most of the IA-64＇s binary executable programs that we have.However,it is likely to lead problems when binary executable program contains user function which has the same name with some library function.Based on thoroughly analyzing the reasons caused by the fast library functions recognizing technology which is based on dynamic linking information,the authors fully study the organizing strategy of ELF-64 object file and the working policy of compilers and linkers to deal it.Then an algorithm is presented to solve the problem led by user function which has the same name with library function,and it fills the gap of decompilation or binary translation in this aspect.