FINDING COMPILER-GENERATED FUNCTIONS IN PASCAL EXECUTABLES

Abstract

Executables are compiled binaries based on source code. One can decompile an executable. This means that the source code where the executable was compiled from, is reconstructed. This is particularly useful when the source code or documentation of a project is missing. An executable that was written in Pascal can be decompiled to C source code. This source code can sometimes not be compiled at first instance. This is due to issues that have to be fixed with human intervention. Once these issues have been addressed, the resulted code from the decompilation process can be compiled to an executable. Since code from the Pascal standard library is heavily optimized, solving these issues in code that was de-compiled from parts of the Pascal standard library could be more time-consuming and error-prone than C source code that was decompiled from code that was written in a Pas-cal source code file.
.
A binary contains functional code snippets (FCS). An FCS is a piece of code within the binary that implements a function, i.e., it is callable and it either returns normally or termi-nates. If one would know which FCSs come from the Pascal standard library, one replace code that was decompiled from those FCSs with equivalent C code. As a result, less hu-man intervention is required. This is because there are no more decompilation errors to be fixed in that decompiled code, as it is replaced with different code. In order to do this, one needs to be able to make a distinction between FCSs that were compiled from source code files, which we call source-defined FCSs, and other FCSs that come from the Pascal standard library, which we call compiler-generated FCSs.
Making this distinction is the problem we are trying to solve in this thesis. We pro-pose two metrics that help us approximate whether an FCS is source-defined or compiler-generated. We call these metrics n-common and cascading n-common. To prove the valid-ity of our method for approximation, we propose a ground truth Γ that tells us whether an FCS is source-defined or compiled-generated. The difference between our approximation method and ground truth Γ is that in order to generate ground truth Γ, we need the source code of the executables that we use in our data set. Our approximation method does not require source code. So if our approximation method is valid, we can use a method to ap-proximate whether an FCS is source-defined or compiler-generated without the need for source code.
Looking at our results, we see that our metrics provide the same results. We there-fore advocate to use n-common instead of cascading n-common, as n-common is sim-pler to implement than cascading n-common. If we look at validity of n-common, we see for the project in our data set with the highest F1-Score, a score of 0.82778, in contrast to the project with the lowest F1-Score in our data set, which is a score of 0.44209. We con-clude that the validity of our metric n-common in an executable is highly dependent on the amount of FCSs in that executable.

Date of Award	19 Mar 2025
Original language	English
Supervisor	Nico Naus (Examiner) & Freek Verbeek (Co-assessor)