A method to identify input-dependent jumps from the execution of obfuscated machine code is presented. Input-dependent jumps, which are defined as jumps whose target addresses can be changed depending on the input, co...
详细信息
ISBN:
(纸本)9781450360968
A method to identify input-dependent jumps from the execution of obfuscated machine code is presented. Input-dependent jumps, which are defined as jumps whose target addresses can be changed depending on the input, correspond to decision points in program execution. By investigating how a target address is calculated, it is possible to pinpoint the triggering conditions of a given behavior, and new execution paths can be discovered by finding input values that change the target address. Obfuscators hinder such analysis by inserting numerous artificial jumps that use opaque predicates with constant values into the code. One important obfuscation approach is virtualization-obfuscation, in which entire blocs of control flow information are replaced with bytecode interpreter code. Using the fact that the semantics of the original program must be preserved under obfuscation, we propose an obfuscation mitigation approach that exploits the relationship between the original and obfuscated executions using dynamic data flow graphs that represent output computation using concrete and symbolic information. These graphs are generated from execution traces that are recorded using dynamic binary instrumentation and simplified using pattern-based rules based on algebraic identities and the general properties of well-behaved programs. To identify input-dependent jumps, a dynamic data flow graph is generated and simplified for each write access to the program counter;if the node for the target address is reachable from a node for an input value in the resulting graph, the jump is input-dependent. Experimental application of the proposed approach to code treated with various obfuscators successfully revealed the relationship between input-dependent jumps in the original and obfuscated executions, confirming that information obtained from dynamic data flow graphs is useful in understanding branch conditions.
In this paper we indicate the concept of dynamic data flow graph based on the dynamicdata dependency during execution of software. On this basis, we propose a dynamic software watermarking algorithm, which embeds wat...
详细信息
ISBN:
(纸本)9781424448982
In this paper we indicate the concept of dynamic data flow graph based on the dynamicdata dependency during execution of software. On this basis, we propose a dynamic software watermarking algorithm, which embeds watermarking information into DDFG of software, and discuss the implementation of embedding and extracting watermark. Finally we analyze the performance of this algorithm.
In this paper we indicate the concept of dynamic data flow graph based on the dynamicdata dependency during execution of software. On this basis, we propose a dynamic software watermarking algorithm, which embeds wat...
详细信息
ISBN:
(纸本)9781424448999
In this paper we indicate the concept of dynamic data flow graph based on the dynamicdata dependency during execution of software. On this basis, we propose a dynamic software watermarking algorithm, which embeds watermarking information into DDFG of software, and discuss the implementation of embedding and extracting watermark. Finally we analyze the performance of this algorithm.
Computation-intensive image processing applications need to be implemented on multicore architectures. If they are to be executed efficiently on such platforms, the underlying data and/or functions should be partition...
详细信息
ISBN:
(纸本)9780769549392;9781467353212
Computation-intensive image processing applications need to be implemented on multicore architectures. If they are to be executed efficiently on such platforms, the underlying data and/or functions should be partitioned and distributed among the processors. The optimal partitioning approach is the one which aims to minimize the inter-processor communication while maximizing the load balance. With the continuously increasing number of cores which exacerbates the demand for more complex memory hierarchies, non-uniform memory access, etc., on-chip communication has gained a significant role in taking advantage of the multicore chips. Therefore, making partitioning decisions just based on conventional performance results and without communication profiling is suboptimal. In this paper, we explore the behavior of a mesh decoder as a case study in terms of communication and computation, and propose models that allow early prediction of the application's behavior. Using these models, profiling the application for all of the input samples is not necessary anymore. As a result, communication-and computation-aware parallelization could be performed faster and easier.
暂无评论