HBGary proved during Phase I that instructions could be obtained from obfuscated programs with runtime data flow tracing and single-step debugging. Control flows were recovered with intelligent mutations made deterministically using an algorithmic process called Automated Flow Resolution. The software prototype was successful. During Phase II HBGary will develop a decompiler that goes beyond existing reverse engineering tools, which rely heavily on static analysis and are ineffective against protected and self-modifying codes. This next generation decompiler will evolve from the success of Phase I research to truly observe a program at runtime, while collecting instructions and behavior dynamically, and operate in stealth-mode from self-protecting codes. While collecting instructions, the decompiler will manipulate the program to observe new behaviors without detection and collect instruction flows for reverse engineering and program understanding. The primary goals of Phase II will be to extend, apply, and make robust Automated Flow Resolution against larger and more complex real world software. Advanced debuggers will be developed to defeat and overcome more difficult obfuscated and self-modifying programs. Phase II will focus heavily on data flow analysis.
