Recovering high-level control-flow structures is a crucial part of modern reverse engineering, especially in fields like binary and malware analysis. Here, analysts often use decompilers to convert functions of binary programs into a more human-readable C-like representation. Among these control-flow structures, switch statements have unique significance because of their ability to represent complex decision-making and branching behavior in a concise and readable manner. Consequently, the successful recovery of switch statements during decompilation can greatly enhance the readability of the resulting decompiler output, making it a highly desired goal in the field of reverse engineering.

In this paper, we present a new technique for identifying abstract syntax tree components that can be transformed into semantically equivalent switch constructs, thus improving code readability. In contrast to other approaches, our approach does not rely on jump tables that have or have not been emitted during compilation. Instead, we identify clusters of comparisons involving the same expression but with varying constant values within the abstract syntax tree to be transformed into switch constructs. Because this approach is inherently linked to the semantic definition of switch statements, it only generates meaningful switches by design.

We evaluated our approach on the coreutils-9.3 dataset and compared it to the leading decompilers Ghidra and Hex-Rays, both of which attempt to recover switch statements as well. Our evaluation results indicate that our approach outperforms both Ghidra and Hex-Rays by successfully recovering more than twice as many switch constructs in the given dataset.