I have a proprietary executable (no code source), and I’d like to confirm that a particular string is vulnerable to buffer overflows (security audit). But I need its algorithms for that. (I don’t know how assembly work at all outside what I know from C).
It’s a custom low used http server part of a larger commercial product that only process queries when the content type is equal to certain strings (otherwise it’s the well-known nginx who process the response). So I doubt fuzzing would be an appropriate technique for detecting flaws in http header parsing.
I know the program is written in C, and that there are several tools that aim at producing pseudocode. But in my case, I have got a debug build with debug information for gdb (lines numbers ; source files paths ; variable names).
In the meantime the program was compiled with
-g2 -fvar-trackinginstead of
objdump ‑Sdoesn’t work because the symbols don’t contains source code of each line.
So is there a C decompiler which is able to to take advantage of full debug symbols in the elf binary ?
The expected result is C preprocessed source without assembly, where each line of each file contains the corresponding Pseudocode according to the debug symbols.
By the way, the binary is compiled for the amd64 architecture.