A system for generating reverse engineering tools

Abstract

Most current reverse engineering techniques start with an analysis of the system's source code to derive structural information, based on compiler technology. As a consequence of the maturity of the field, several formal program models exist that have allowed the automatic generation of language processing front-ends. However, the software engineer has to code the data structures that implement the program model and the algorithms that implement the desired analysis. Thus, while the domain of code analysis is well understood, economic convenience very often leads to rigid code analysers that perform a fixed set of analyses and produce standard reports that users can only customise marginally. We have implemented a system for developing code analysers that uses a unique database to store both a no-loss fine-grained intermediate representation and the analysis results. The analysers are automatically generated from a very high-level specification of the desired analyses expressed in a domain-oriented language. We use an algebraic representation, called F(p), as the user-visible intermediate representation. Analysers are specified in a logic-based language, called F(p)-l, which allows the specification of an analysis in the form of a traversal of an algebraic expression, with accesses to, and stores of, the database information that the algebraic expression indexes. A foreign-language interface allows the analysers to be embedded into C programs to facilitate interoperation with other tools.