逆向工程中基于投机的反向优化技术研究

投机机制通过改善内存操作效能提高程序的执行性能,但是它需要大量复杂的代码处理投机失败及恢复,增加了程序的理解和投机代码再工程的复杂性。文中提出了一个算法,在安腾的二进制代码中消除投机指令并保证程序的语义,使得投机消除后的程序更容易理解,更易于应用传统逆向工程的技术进行代码再工程。     

IA-64逆向工程中投机代码消除技术研究

投机机制通过改善内存操作的效能而提高程序执行性能,但是它需要大量复杂的代码处理投机失败及恢复,增加了程序的理解和代码重建工作的复杂性。文章提出了投机代码消除技术,描述了如何应用该技术消除优化后的IA-64二进制代码中的投机指令,并证明了程序的语义不变,最终使得投机消除后的代码更容易理解,提高了对IA-64代码进行再工程的效率和代码质量。     

一种IA-64下的反软件流水算法

软件流水是一种循环程序的优化技术,它可以有效地提高指令级并行性。由于处理机的实现方法各不相同,在一种处理机上经过软件流水优化后的循环代码很难在其它处理机中移植和使用。反软件流水是软件流水的逆向操作,它可以消除循环代码中的软件流水特性,以便于代码在不同平台上的移植。基于IA-64体系结构,分析了软件流水的代码特点,提出了反流水算法,用于将ICC编译器编译后的可执行二进制代码消除软件流水特性,转换成语义等价的C代码。     

控制与数据投机优化技术的研究

控制投机和数据投机是提高程序指令级并行度的有效方法．为了保证投机指令的正确执行，须解决两个问题，即延迟触发控制投机指令导致的异常和数据投机中的别名歧义．这需要硬件的支持才能做到，所以以前在这方面的研究大多是在模拟器上进行的，侧重于描述对模拟器结构的扩展．而IA-64是第一个同时支持这两种优化的体系结构．基于此，作者用一个统一的框架在IA-64开放源码研究编译器(ORC)中首次实现了控制与投机优化．该文以编译器为侧重点，介绍了投机优化中的几个核心问题及其解决方法，其中包括一种新的用来维护投机代码正确性的算法．实验结果表明这种方法是有效的．     

IA-64逆向工程中谓词消除技术研究

IA-64体系结构支持判断执行,提高指令级并行性,但是编译器为了充分利用该特性而做的优化将程序代码进行深度重构,对逆向工程来说很难从优化后的可执行代码中恢复原程序逻辑。该文提出了消除谓词的反优化技术,提高了可执行代码逆向工程的质量。     

IA-64二进制翻译中优化代码消除技术

IA-64架构为获得高性能支持许多先进体系结构的特性,例如显式指令级并行,指令判定执行,以及投机装入等,这些特性对编译器是可见的,但是为了充分利用这些体系结构的特性,编译器优化往往将程序的代码进行深度重构,使得从优化后的可执行代码中很难恢复源程序逻辑。本文提出了在IA-64二进制翻译中应用优化代码消除技术,提高翻译效率和生成目标机代码的质量。     

基于VLIW的机器相关优化编译技术研究

VLIW体系结构性能的发挥在很大程度上依赖于其相应的编译器。编译优化主要包括两个方面:一方面是传统的编译器优化技术;另一方面是针对具体机器平台特定的优化技术。VLIW机器相关的编译优化技术应该针对具体的机器平台,基于超长指令字体系结构的特点,考虑如何充分利用机器提供的硬件资源,以达到软件(编译器)和硬件(CPU)的最大匹配,从而生成高效率高并行度的目标代码。论文从超长指令字的特点出发,探讨了在VLIW体系结构下与机器相关的编译优化的实现方案,同时提出了几点在具体进行与机器相关的优化编译时的关键技术。     

一种软件流水的反流水算法

软件流水是一种循环程序的优化技术,已经广泛应用于现代优化编译器中.为了充分利用VLIW DSP处理机的指令级并行性,必须使用软件流水技术对DSP程序进行优化.然而,在串行源代码不存在的情况下,对软件流水后的原始代码进行变换、理解、测试和调试,并转换成其他处理机的代码是非常困难的.提出了一种反流水技术,它能够将软件流水后的优化汇编代码反向转换成语义等价的相应代码.通过20个程序的初步实验,验证了所提出的反流水算法的正确性.     

IA-64软件流水的反流水算法研究

软件流水是一种开发循环程序指令级并行性的技术, 它通过并行执行连续的多个迭代来加快循环的执行速度。而在逆向工程中,软件流水却为逆向翻译带来了困难。为此,基于IA-64平台,提出了一种反流水算法,针对循环中包含软件流水的汇编代码进行处理,将其反向转换成语义等价的串行代码,并通过实验验证了该算法的有效性,为在二进制翻译中处理软件流水代码奠定了基础。     

可重构指令集处理器的代码优化生成算法研究

可重构指令集处理器能够适应多变的计算任务在性能和灵活性两方面的要求,而传统的编译后端技术无法为其生成高效的可执行代码,需要有新的代码生成方法.针对传统编译后端代码生成三阶段方法进行扩展的代码混合优化生成算法正是这样一种方法.该算法很大程度地复用了原有的三阶段代码生成过程,同时针对可重构指令集具有动态性的特点,根据系统硬件资源和重构配置,扩展了针对可重构指令代码生成的优化处理,从而能够获得切合可重构指令集处理器体系结构特性的可执行代码.相关实验与分析说明了该算法针对硬件重构得到的新平台所做的可重构指令代码生成是有效的,能够较好地提高应用程序在新平台上的执行性能.     

Run-Time Validation of Speculative Optimizations using CVC.

Translation validation is an approach for validating the output of optimizing compilers. Rather than verifying the compiler itself, translation validation mandates that every run of the compiler generate a formal proof that the produced target code is a correct implementation of the source code. Speculative loop optimizations are aggressive optimizations which are only correct under certain conditions which cannot be validated at compile time. We propose using an automatic theorem prover together with the translation validation framework to automatically generate run-time tests for such speculative optimizations. This run-time validation approach must not only detect the conditions under which an optimization generates incorrect code, but also provide a way to recover from the optimization without aborting the program or producing an incorrect result. In this paper, we apply the run-time validation technique to a class of speculative reordering transformations and give some initial results of run-time tests generated by the theorem prover CVC.     

Unpredication, unscheduling, unspeculation: reverse engineering Itanium executables

EPIC (explicitly parallel instruction computing) architectures, exemplified by the Intel Itanium, support a number of advanced architectural features, such as explicit instruction-level parallelism, instruction predication, and speculative loads from memory. However, compiler optimizations that take advantage of these features can profoundly restructure the program's code, making it potentially difficult to reconstruct the original program logic from an optimized Itanium executable. This paper describes techniques to undo some of the effects of such optimizations and thereby improve the quality of reverse engineering such executables.     

Hardware Atomicity: An Effective Abstraction for Reliable Software Speculation

Technology trends and shrinking power envelopes have forced microprocessor designers to focus on hardware techniques that efficiently improve single-thread performance without superlinear increases in power and silicon area. In this article, we identify hardware atomic execution - the execution of a region of code completely or not at all - as such a feature for simplifying existing and enabling new speculative compiler optimizations. Specifically, we propose that microprocessors expose atomic execution as a hardware primitive to the compiler. Doing so lets the compiler generate a speculative version of the code where infrequently executed code paths are removed.     

反编译器中针对不同编译器的过程识别技术

过程识别技术及相关参数的提取是二进制翻译中过程调用恢复的基础.为较好实现对过程的识别,首先设计了针对GCC编译的ELF(executable and linkable format)文件的过程识别技术,取得了良好的效果.不过随着研究的深入,要求对C编译器和ICC(Intel C compiler)编译器同时具有良好的支持,但在测试中发现这种识别技术在处理ICC编译的ELF程序指令流时存在的一些问题,为此提出了改进算法,这个算法已经在IA-64-Alpha反编译中实现,从而使系统对C编译器和ICC编译器编译的ELF文件都能进行正确的过程识别和参数提取.     

动态二进制翻译中动态优化的成本与收益分析

传统的静态编译器优化存在着各种限制,为此,提出了一种运行期动态优化的对策。在程序的执行过程中,持续检测程序运行的profile信息,并根据这些信息对程序代码进行优化变换,创建并运行程序代码的优化版本。这种运行期动态优化操作是直接针对程序的二进制代码的,不针对程序语言或编译器。这不仅带来优化的透明性,还使得老版本的源代码即遗留代码也可以从优化技术中获得性能提升。     

对用户交互响应进行加速的即时编译技术

对于影响用户交互响应速度的瓶颈代码段,现有即时编译器存在无法准确选取和在程序启动阶段没有可用的本地码进行加速的问题,这影响了即时编译技术在用户交互响应方面的加速效果。为此,对即时编译器原有的代码选择策略和编译模式进行了改进。在代码选择策略方面,应用程序可以根据实际运行情况主动选择要编译的代码段,保证所有影响用户交互响应速度的瓶颈代码段都能被选取并被加速;在编译模式方面,本次编译得到的本地码可以保存并供程序下次运行时使用,保证在程序启动阶段也有本地码可用来加速。应用程序启动速度的实验表明,改进的即时编译器能够提升1倍的用户响应速度。     

Steady-state compilers

Passing compilers through themselves is a well known technique whose major benefit is that any improvement in code generation will result in an improved compiler. Previous reports of work in this area have mentioned that it is possible to validate the compiler by running the compiler through itself a second time and comparing the resulting binary files. This paper is designed to clarify this technique which has received little attention and is often misleadingly described.     

Certifying Compilation and Run-Time Code Generation

A certifying compiler takes a source language program and produces object code, as well as a certificate that can be used to verify that the object code satisfies desirable properties, such as type safety and memory safety. Certifying compilation helps to increase both compiler robustness and program safety. Compiler robustness is improved since some compiler errors can be caught by checking the object code against the certificate immediately after compilation. Program safety is improved because the object code and certificate alone are sufficient to establish safety: even if the object code and certificate are produced on an unknown machine by an unknown compiler and sent over an untrusted network, safe execution is guaranteed as long as the code and certificate pass the verifier.Existing work in certifying compilation has addressed statically generated code. In this paper, we extend this to code generated at run time. Our goal is to combine certifying compilation with run-time code generation to produce programs that are both fast and verifiably safe. To achieve this goal, we present two new languages with explicit run-time code generation constructs: Cyclone, a type safe dialect of C, and TAL/T, a type safe assembly language. We have designed and implemented a system that translates a safe C program into Cyclone, which is then compiled to TAL/T, and finally assembled into executable object code. This paper focuses on our overall approach and the front end of our system; details about TAL/T will appear in a subsequent paper.