2017 · Conference paper
rev.ng: A Unified Binary Analysis Framework to Recover CFGs and Function Boundaries
rev.ng lifts binaries to LLVM IR through QEMU's tiny code generator, so one front end covers every architecture QEMU supports and the output is compilable IR. On that IR the authors build architecture-independent analyses that recover a program's control-flow graph and function boundaries without symbols or debugging information. A value-range analysis (OSRA) bounds indirect jump targets such as switch tables, and further analyses handle predicated instructions, noreturn functions, tail calls and context-dependent control flow. On coreutils built for MIPS, ARM and x86-64 with GCC and clang at -O2, -O3 and -Os, its function-boundary accuracy is close to IDA Pro and better than BAP/ByteWeight and angr.
Scope and limitations
The evaluation measures function boundaries, not the CFG directly: the authors could not collect CFG ground truth from GCC or LLVM, so boundary accuracy (Jaccard index against ELF function symbols) is presented as a lower bound on CFG quality. It covers 105 statically linked, stripped coreutils programs for Linux on three of the architectures QEMU supports; the other architectures and dynamically linked binaries were not evaluated. The prototype misses some nested-switch jump tables on x86-64 and jump-table addresses spilled to the stack on MIPS, needs more memory than the other tools on ARM and MIPS, and does not report dead code that IDA Pro finds through prologue heuristics, which the authors treat as a design choice. Baselines are IDA Pro 6.6, BAP 0.9.9 and angr as of November 2016. The paper does not decompile to C.
Why it fits this collection
Adds lifting of machine code to compiler IR with architecture-independent CFG and function-boundary recovery, the analysis layer beneath the collection's curated rev.ng decompiler.
Publication and review details
- Venue
- CC 2017
- Status
- Conference paper
- Publication / posting date
- February 5, 2017
- Date source
- ACM’s Crossref deposit records both print and online publication on 2017-02-05. This entry uses that date, not the conference schedule.
- DOI
- 10.1145/3033019.3033028
Crossref gives the three-author order and pages 131–141; Crossref writes the title in lowercase, and this entry follows the capitalization of the author-hosted 11-page PDF, the same length as the ACM version. The paper reports a C++ prototype of 8,011 lines built on LLVM 3.8 and QEMU 2.5.0, and its acknowledgements give https://rev.ng/ as the Free Software release. The revng/revng repository has since become the full rev.ng decompiler: at the commit the curated revng record pins (57d81a3), the README describes a decompiler developed by rev.ng Labs, licensed GPLv2 as a whole with individual files under MIT. Those behavior and license notes describe the current project, not the evaluated 2017 prototype. Nothing was built or run.
Sources reviewed
Source review only; experiments were not rerun for this collection. Cite the original authors using the linked paper or BibTeX.
Related entries
Matched by the same code repository or publication identifier.
- rev.ng Curated resource