1. Krakatoa: Decompilation in Java “Does Bytecode Reveal Source?” Todd A. Proebsting Scott A. Watterson The University of Arizona Presented by Karl von Randow

2. Introduction n Decompilation u Transforms low-level language into high-level language. u Inverse of Compilation..class.java Java bytecodeJava source

3. Outline n Recovering source-level expressions. u a = ( 3 * b ) + method( c + 9 ); n Synthesising high-level control constructs. u while ( a < b ) { … } FOCUS: Recovering source-level expressions

4. The Java (Dis)advantage n Java bytecodes closely correspond to Java source. n Class files contain type and name information on variables and methods. n Bytecode must be verifiable.

5. Expression Recovery n The Java VM is Stack based. u Bytecode instructions pop arguments off the stack, and push results. n Local variables are stored in an array. n To recover expressions, simulate running the bytecode, stack and local variable array.

6. Symbolic Execution n Instead of pushing values, push strings to represent the values (source-level expressions). n For example...

7. iload n iload_1 takes the value in the 1st local variable and pushes it onto the stack. n Instead we push the name of the variable. u ie. push “a” rather than 7.

8. imul n Pops two ints off the stack, multiplies them, then pushes the result. n Instead we push a string containing the two popped strings with a “*” in between. String right = pop(); String left = pop(); push( left + “*” + right );

9. Example of a Method public void bar( int a, int b ) { iload_1 iload_2 imul iconst_2 iadd istore_2 }

10. Example of a Method public void bar( int a, int b ) { è iload_1 è iload_2 imul iconst_2 iadd istore_2 } “a” “b”

11. Example of a Method public void bar( int a, int b ) { iload_1 iload_2 è imul iconst_2 iadd istore_2 } “(a*b)” String right = pop(); String left = pop(); push( left + “*” + right ); “a” “b”

12. Example of a Method public void bar( int a, int b ) { iload_1 iload_2 imul è iconst_2 iadd istore_2 } “(a*b)” “2”

13. Example of a Method public void bar( int a, int b ) { iload_1 iload_2 imul iconst_2 è iadd istore_2 } “((a*b)+2)”“(a*b)” “2” String right = pop(); String left = pop(); push( left + “+” + right );

14. Example of a Method public void bar( int a, int b ) { iload_1 iload_2 imul iconst_2 iadd è istore_2 } public void bar( int a, int b ) { b = ((a*b)+2); }

15. Conclusions n It is possible to automate the decompilation of Java bytecode, and to recover high-level, readable code. n How do we protect Java bytecode against decompilation? n How much harder does this make decompilation?