Roadmap
Where we are, where want to go
Building a decompiler is a big endeavour. Follow our latest advancements and the plan for the months to come towards the 1.0 release.
Tier 2: Closed beta (part 1)
Adopt new Hub frontend
Dismiss the old Web 1.0 Hub frontend in favor of the new Next.js-based Hub frontend.
Tier 2 Public Relations
Publish the new website, release a blog post, send newsletter, write tutorial for Tier 2 participants.
No timeouts/crashes on selected binaries
Make sure we can run the whole pipeline on a predetermined set reasonably-sized x86-64 Linux binaries without crashes and within a reasonable time frame.
Perform in-depth QA on `hostname`
Make sure the hostname binary is decompiled in a sensible way.
Tier 2.5: Closed beta (part 2)
Clift backend
Implement a the new C backend, using our custom Clift MLIR Dialect to generate decompiled code.
Adapt variable producers
Migrate all the passes of the old decompilation pipeline to use LLVM alloca/load/store to represent C local variables. This is preliminary work for the new Clift-based C backend.
Clifter
Implement LLVM-to-Clift conversion for the new C decompilation backend.
Handle all the forms of memcpy
Ensure we emit memcpy gracefully for all the various architectures we support.
Comments in function's body
Enable users to input comments associated to a specific instruction of the program and show it in both the decompiled code and the disassembly.
Mass testing
Test on a massive amount of binaries and promote binaries that are decompiled without crashes and withing a reasonable time frame to the regression suite.
Implicit conversions
Detect and remove casts that in C would be implicit. This will significantly reduce the number of casts the user sees in the decompiled code.
Push variable declarations ALAP
In decompiled C code, make sure we declare local variables as late as possible.
Primitives inlining
Change the model layout so that primitive types (e.g., uint32_t) are defined inline, instead of having an entry in model::Binary::Types.
EFA4
Implement the 4th version of Early Function Analysis, which will significantly improve detection of register-based arguments and return values.
Invalidation logic
Implement the logic to detect what artifacts needs to be recomputed, instead of recomputing everything at every change.
Documentation
Provide public documentation of the model, the CLI and our Python/TypeScript wrappers.
Declutter the UI
Make the necessary changes to VSCode to remove everything that's not strictly necessary for our use case.
Tier 3: Open beta (part 1)
Emit strings in clift
The Clift backend should emit string literals.
CLI should support the daemon
The rev.ng CLI should be able to communicate with the rev.ng daemon, which is what the UI uses.
Offline rev.ng UI
Provide a fully offline, Electron-based version of the rev.ng UI
Drop old pipeline
The old C++-based pipeline infrastructure has to be dropped in favor of the new Python-based one.
Improve import of dynamic functions in PE/COFF
Review and improve the import of dynamic functions in Windows executables.
Emit segment references at lift time
Right now we turn literal integers into references to segments rather late in the pipeline. We need to anticipate that and make the new MLIR-based backend aware of them.
New backend: comments and local names
Enable the new MLIR-based backend to apply user-provided names to local variables and to insert user-provided comments.
New backend: emit headers
Make the new MLIR-based backend emit the C headers for the decompiled code, which mainly contain types and globals.
Dismiss old branch of pipeline
Dismiss the old-string based C decompiler backend in favor of the new MLIR-based backend.
Switch to clift backend
Drop the old C backend emitting text directly with the one based on our MLIR dialect, clift.
Scope-inducing transformations
Implement a set of transformations of the CFG to detect loops and nested scopes.
Mass testing goals
Reduce the amount of failures (crash, time outs, OOM) in mass testing results.
Adopt alias analysis in SwitchToStatements
Inform the Clift-based C decompilation pipeline that the stack frame does not alias other memory, to avoid redundant accesses to it in decompiled C code.
EmitFieldAccesses
Transform integer arithmetic into field accesses expression in the new Clift-based C backend.
New backend: optimizations
Improve C emission in the new MLIR-based backend: fold &*, fold *&, two's complement arithmetic normalization, remove empty branches of if-statements, hide implicit casts, match advanced loops (while, do-while), handle noreturn.
Initial auto-analyses twice
We need to be able to run the analysis pipeline twice without crashing.
Rebase QEMU
Rebase QEMU to the latest version. This will enable us to support additional architectures and start working on for proper floating point support.
Preserve debug info
Review the decompilation pipeline to ensure that debug information, which we use to trace decompiled code back to assembly instructions, are preserved as much as possible. This ensure we don't lose the link between decompiled code and assembly in most situations.
Drop kinds
Get rid of kinds from revng-pipeline.
Collaboration QA
Ensure collaboration works smoothly.
Hub: expose snippets
Implement in Hub a feature to embed decompiled code snippets.
Rename local variables
Enable users to customize local variable names.
Reorganize repositories
Merge the revng and revng-c repositories.
revng-pypeline
Implement a more git-like CLI for revng and move most of the revng-pipeline logic to Python.
Python client
Implement a dev-friendly Python library to interact with revng-daemon's GraphQL API.
Detect strings
Add analysis to detect string literals in segments.
Tier 3.5: Open beta (part 2)
macOS port
Port the rev.ng backend to macOS.
Windows port
Port the rev.ng backend to Windows.
Calls to dynamic functions should have no suffixes
Right now we emit calls to dynamic functions with an _2 due to collision between the dynamic function and the PLT entry. We need to find a proper solution to this.
Type refinement on clift
Propagate types from arguments and other well known places to the rest of the decompiled code.
Reduce the number of assignments due to ExitSSA
We need to reduce the number of assignments introduced by leaving the SSA form.
New backend: declare local variables ALAP
Move the declaration of local variables to the innermost scope where they preserve semantic.
Retype and rename local variables
Enable users to customize the type and the name of local variables displayed in the decompiled C code.
Minimal error reporting in UI
Ensure we have a minimal error reporting when editing types or the model directly.
DLA2
Design and implement the second version of Data Layout Analysis (DLA).
All analyses should import model
Some analysis are currently designed to be run only once. We need to upgrade them to be able to incrementally improve the model given its current state.
`goto` optimization
Implement algorithm for reducing the number of emitted gotos, with heuristic for preventing excessive code duplication.
VMA2
Implement type propagation within the body of a function.
Floating point support
Improve support for floating point instruction and data types.
Implement undo/redo
Implement the undo/redo feature.
Tier 4: 1.0 release
Upgrade LLVM
We need to update the LLVM version we're based on. This will enables us to use all the new MLIR features and get rid of tecnical debt.
Artifacts doc
Document in detail what users can expect to find in each artifact.
Detection of well-known static libraries
Automatically detect functions that belong to a well-known static library such as OpenSSL.
Import C headers
Make sure we can import a C header into the model. Core idea: compile the header with debug info, and then import via DWARF importer.
ConvertToCABI QA
Perform Quality Assurance on the result of converting RawFunctionTypes to CABIFunctionTypes.
Background artifacts production
Implement logic to asynchronously produce artifacts in background.
Patches raw bytes in model
Add support for patching the binary from the model.
HexView
Implement a basic hexadecimal view.
Metaview
Implement a view that shows, as a single document, the whole binary.
Support multiple binaries
Make sure a single project can handle multiple projects. Also, switch to record hashes of binaries in the model, instead of asking the user to provide it.
Shop
Implement an online shop to buy subscriptions/licenses.
Import stack frames from DWARF
Exploit information in DWARF debug info to automatically populate the stack frame of functions.
Register to the UI closed beta!
Want to try the UI? We're now inviting people on a FIFO basis.