Implement "Meaningful Variables Names for Decompiled Code A Machine Translation Approach" in retdec

[ghost]

See http://www.contrib.andrew.cmu.edu/~apjaffe/smt/decompilation-renaming-2.pdf

Quote from @apjaffe's abstract:

Decompiled code lacks meaningful variable names. We used statistical machine translation to suggest variable names that are natural given the context. This technique has previously been successfully applied to obfuscated JavaScript code, but decompiled C code poses unique challenges in constructing an aligned corpus and selecting the best translation from among several candidates.

In @apjaffe's paper, they use Hex-Rays Decompiler to generate training dataset and raw decompiled C code, with some effort the solution could be ported to RetDec as well.

[s3rvac]

Actually, RetDec already implements a lot of nifty tricks to produce variables with meaningful names. Some of them are:

• (Obvious but still...) When there is symbolic/debugging information available, use it to produce the same function or variable names as were used in the original source code.
• Induction variables in loops are named i, j, k, ...
• If only a single local variable is returned from a function, name it result.
• Variables storing return values of some well-known functions are given more meaningful names (e.g. int c = getchar(); or int pid = getpid()).
• Variables passed as arguments to some well-known functions are given more meaningful names (e.g. fopen(file_path, mode)).
• We even try to reconstruct the original symbolic names of integral constants so that instead of e.g.

  socket(2, 3, 255)

  we get

  socket(PF_INET, SOCK_RAW, IPPROTO_RAW)

  or instead of

  flock(fd, 7);

  we get

  flock(fd, LOCK_SH | LOCK_EX | LOCK_NB);

  Of course, there is always room for improvement :-).