CAREER: Re-configurable, Source-Language-Agnostic Decompilation for Binary Programs

在现代，软件安全至关重要。无论有没有人们的意识，从个人电脑到智能手机，从关键基础设施到网络物理系统，软件正在为数百亿台设备和系统提供动力。这些系统通常受到一种敌对类型的软件恶意软件的攻击，该软件由网络犯罪分子开发和部署。不幸的是，软件源代码的不可获得性从两个方面严重阻碍了使软件和系统更加安全的努力：(A)无法获得通用软件的源代码使软件审计员更难发现和减少软件缺陷和后门；(B)无法获得恶意软件的源代码使安全分析员更难及时了解和击败网络威胁。尽管进行了多年的研究，但该领域的现代工具和技术不足以从软件构件中恢复可读的源代码。因此，开发新的技术和工具来有效地从软件中恢复源代码将大大提高现代软件的安全性，进而有利于整个社会的安全。反编译是指从已经编译成机器码的软件中恢复源代码的过程。这个研究项目包括三个主要的研究项目，最终目标是开发一套新的技术来支持特定用途和与源语言无关的二进制反编译器。首先，认识到安全分析中的不同任务可能有不同的最终目标(例如，单个函数的可读性与程序级数据流的可理解性)，该项目将系统地研究反编译的常见安全特定目的。对于每个目的，该项目都将开发特定的反编译和优化技术。其次，该研究项目将产生新的理论和方法，将单片二进制反编译实践转换为模块化、可插拔和可配置的技术和步骤。最后，这个项目的关键将是研究编译器特定模型和技术的自动生成，以将用高级语言(例如，Visual Basic 6、C++、Go和Rust)编译的二进制代码转换为显示原始高级编程语言功能的高质量伪源代码输出。除了研究出版物，这个项目还将产生一个完全开源的、与源语言无关的二进制反编译框架，它将促进安全行业、研究、教育和爱好者的活动。该奖项反映了NSF的法定使命，并通过使用基金会的智力优势和更广泛的影响审查标准进行评估，被认为值得支持。

Software security is crucial in modern times. With or without people’s awareness, from personal computers to smart phones, from critical infrastructure to cyber-physical systems, software is powering tens of billions of devices and systems. These systems are commonly attacked by an adversarial type of software, malware, which is developed and deployed by cyber criminals. Unfortunately, the inaccessibility of source code of software severely hampers the effort of making software and systems more secure from two aspects: (a) Not having access to source code of common software makes it harder for software auditors to discover and mitigate software defects and backdoors; (b) Not having access to source code of malware makes it harder for security analysts to understand and defeat cyber threats in a timely manner. Despite years of research, modern tools and techniques in the field are insufficient in recovering readable source code from software artifacts. Therefore, developing new technologies and tools to effectively recover source code from software will greatly improve the security of modern software, which will in turn benefit the security of the entire society. Decompilation refers to the process of recovering source code from software that is already compiled into machine code. This research project consists of three major research thrusts with the final goal of developing a set of new techniques to support a purpose-specific and source-language-agnostic binary decompiler. First, recognizing different tasks in security analysis may have different end goals (e.g., the readability of a single function versus the understandability of program-level data flows), this project will systematically study common security-specific purposes for decompilation. For each purpose, this project will develop specific decompilation and optimization techniques. Second, this research project will generate new theories and methods to transform monolithic binary decompilation practices into modular, pluggable, and configurable techniques and steps. Finally, the crux of this project will be studying the automated generation of compiler-specific models and techniques for transforming binaries compiled in high-level languages (e.g., Visual Basic 6, C++, Go, and Rust) into high-quality pseudo-source code output that exhibits features in the original high-level programming languages. Besides research publications, this project will produce a fully open-sourced, source-language-agnostic binary decompilation framework, which will facilitate activities in security industry, research, education, and among enthusiasts.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.