Jakstab is an Abstract Interpretation-based, integrated disassembly and static analysis framework for designing analyses on executables and recovering reliable control flow graphs. It is designed to be adaptable to multiple hardware platforms using customized instruction decoding and processor specifications similar to the Boomerang decompiler. It is written in Java, and in its current state supports x86 processors and 32-bit Windows PE or Linux ELF executables.
Jakstab translates machine code to a low level intermediate language on the fly as it performs data flow analysis on the growing control flow graph. Data flow information is used to resolve branch targets and discover new code locations. Other analyses can either be implemented in Jakstab to run together with the main control flow reconstruction to improve precision of the disassembly, or they can work on the resulting preprocessed control flow graph. Analyses are implemented using the Configurable Program Analysis (CPA) approach.
The whole system was developed as part of Johannes Kinder's dissertation work on static analysis of x86 executables at TU München and TU Darmstadt. As of March 2011, he has moved to EPFL, but is still maintaining and extending Jakstab as part of ongoing research projects.
发表于 2013-2-3 01:09
