检索结果-内蒙古大学图书馆

DECAF: A Platform-Neutral Whole-System dynamic binary analysis Platform

IEEE TRANSACTIONS ON SOFTWARE ENGINEERING 2017年第2期43卷 164-184页

作者： Henderson, Andrew Yan, Lok Kwong Hu, Xunchao Prakash, Aravind Yin, Heng McCamant, Stephen Syracuse Univ Dept Elect Engn & Comp Sci Syracuse NY 13244 USA Rome Lab Dept RIG Rome NY 13441 USA Univ Minnesota Twin Cities Dept Comp Sci & Engn Minneapolis MN 55455 USA

dynamic binary analysis is a prevalent and indispensable technique in program analysis. While several dynamic binary analysis tools and frameworks have been proposed, all suffer from one or more of: prohibitive performance degradation, a semantic gap between the analysis code and the program being analyzed, architecture/OS specificity, being user-mode only, and lacking APIs. We present DECAF, a virtual machine based, multi-target, whole-system dynamic binary analysis framework built on top of QEMU. DECAF provides Just-In-Time Virtual Machine Introspection and a plugin architecture with a simple-to-use event-driven programming interface. DECAF implements a new instruction-level taint tracking engine at bit granularity, which exercises fine control over the QEMU Tiny Code Generator (TCG) intermediate representation to accomplish on-the-fly optimizations while ensuring that the taint propagation is sound and highly precise. We perform a formal analysis of DECAF's taint propagation rules to verify that most instructions introduce neither false positives nor false negatives. We also present three platform-neutral plugins-Instruction Tracer, Keylogger Detector, and API Tracer, to demonstrate the ease of use and effectiveness of DECAF in writing cross-platform and system-wide analysis tools. Implementation of DECAF consists of 9,550 lines of C++ code and 10,270 lines of C code and we evaluate DECAF using CPU2006 SPEC benchmarks and show average overhead of 605 percent for system wide tainting and 12 percent for VMI.

关键词： dynamic binary analysis dynamic taint analysis virtual machine introspection

来源：评论

学校读者我要写书评

暂无评论

On the detection of custom memory allocators in C binaries

引用

EMPIRICAL SOFTWARE ENGINEERING 2016年第3期21卷 753-777页

作者： Chen, Xi Slowinska, Asia Bos, Herbert Vrije Univ Amsterdam Network & Syst Secur Grp Amsterdam Netherlands Vrije Univ Amsterdam Syst & Network Secur Grp Amsterdam Netherlands Vrije Univ Amsterdam Syst & Network Secur Amsterdam Netherlands

Many reverse engineering techniques for data structures rely on the knowledge of memory allocation routines. Typically, they interpose on the system's malloc and free functions, and track each chunk of memory thus allocated as a data structure. However, many performance-critical applications implement their own custom memory allocators. Examples include webservers, database management systems, and compilers like gcc and clang. As a result, current binary analysis techniques for tracking data structures fail on such binaries. We present MemBrush, a new tool to detect memory allocation and deallocation functions in stripped binaries with high accuracy. We evaluated the technique on a large number of real world applications that use custom memory allocators. We demonstrate that MemBrush can detect allocators/deallocators with a high accuracy which is 52 out of 59 for allocators, and 29 out of 31 for deallocators in SPECINT 2006. As we show, we can furnish existing reverse engineering tools with detailed information about the memory management API, and as a result perform an analysis of the actual application specific data structures designed by the programmer. Our system uses dynamic analysis and detects memory allocation and deallocation routines by searching for functions that comply with a set of generic characteristics of allocators and deallocators.

关键词： Custom memory allocation dynamic binary analysis

来源：评论

学校读者我要写书评

暂无评论

Accelerating Data Dependence Profiling Through Abstract Interpretation of Loop Instructions

引用

IEEE ACCESS 2022年 10卷 31626-31640页

作者： Abbas, Mostafa Soliman, Mostafa, I Rabia, Sherif, I Kimura, Keiji El-Mahdy, Ahmed Egypt Japan Univ Sci & Technol Dept Comp Sci & Engn New Borg El Arab City 21934 Egypt Aswan Univ Dept Elect Engn Aswan 81528 Egypt Alexandria Univ Dept Comp & Syst Engn Alexandria 21544 Egypt Waseda Univ Dept Comp Sci & Engn Tokyo 1698555 Japan

Data dependence analysis is a must-do operation for parallelisation since it reveals the safe parallelisable regions of serial codes. Generally, it relies on dynamic analysis, which incurs substantial execution time and memory space overheads. As a result, there have been many efforts in the literature to strike a balance between accuracy and runtime overhead. The approaches generally rely on random instruction sampling, parallelising analysis, as well as filtering statically determined dependencies and independencies. This paper considers an alternate approach of conducting static analysis at runtime, exploiting available states just before executing loops, potentially improving precision. In particular, the paper adopts abstract interpretation using interval, congruent, and bisector domains for detecting memory data dependencies in binary programs at runtime. Abstract interpretation has the advantage of being associated with the execution semantics, making it more natural to model binary instruction execution. The profiler is implemented on top of the Pin framework and evaluated using the Polyhedral, NPB, and SPEC 2006 benchmarks suites. Results show a mean accuracy of 90.4% with an average 16.3 x speedup in time in comparison with related work, making it a promising approach.

关键词： Abstract interpretation data dependence profiling dynamic binary analysis interval domain congruent domain bisector domain

来源：评论

学校读者我要写书评

暂无评论

Implementation of an effective dynamic concolic execution framework for analyzing binary programs

引用

COMPUTERS & SECURITY 2019年 86卷 1-27页

作者： Zhu, Erzhou Wen, Peng Ni, Kanqi Ma, Ruhui Anhui Univ Sch Comp Sci & Technol Hefei 230601 Anhui Peoples R China Shanghai Jiao Tong Univ Dept Comp Sci & Engn Shanghai 200240 Peoples R China

With the increasing availability of the computational power and constraint solving technology, the symbolic execution technology has regained interest in recent years. However, it still suffers from state explosion and low efficiency issues due to the large number of paths that need to be analyzed and the complexity of the constraints generated. Meanwhile, most of the present symbolic execution techniques are working on the source code, but the source code of most software is hard to acquire in practice. In order to cope with these issues, this paper presents BinSE, a lightweight dynamic symbolic execution framework for analyzing x86 binary programs. The framework adapts the dynamic analysis model, which combines symbolic execution with concrete execution to simplify the complexity of the path conditions. Furthermore, the hierarchical backward program slicing and the revised irrelevant API filtration mechanisms are introduced to optimize the performance of the framework. According to the experimental results, the proposed framework is efficient and can cover almost all the effective paths of the target program. Meanwhile, it also holds a promise to provide novel solutions to a broad spectrum of security problems. To demonstrate our technique, we apply the framework to detect buffer overflow vulnerability from binary executables. (C) 2019 Elsevier Ltd. All rights reserved.

关键词： dynamic binary analysis Symbolic execution Process virtual machine Program security Vulnerability detection

来源：评论

学校读者我要写书评

暂无评论

Scalable data structure detection and classification for C/C plus plus binaries

引用

EMPIRICAL SOFTWARE ENGINEERING 2016年第3期21卷 778-810页

作者： Haller, Istvan Slowinska, Asia Bos, Herbert Vrije Univ Amsterdam Syst & Network Secur Grp Amsterdam Netherlands Vrije Univ Amsterdam Syst & Network Secur Amsterdam Netherlands

Many existing techniques for reversing data structures in C/C++ binaries are limited to low-level programming constructs, such as individual variables or structs. Unfortunately, without detailed information about a program's pointer structures, forensics and reverse engineering are exceedingly hard. To fill this gap, we propose MemPick, a tool that detects and classifies high-level data structures used in stripped binaries. By analyzing how links between memory objects evolve throughout the program execution, it distinguishes between many commonly used data structures, such as singly-or doubly-linked lists, many types of trees (e.g., AVL, red-black trees, B-trees), and graphs. We evaluate the technique on 10 real world applications, 4 file system implementations and 16 popular libraries. The results show that MemPick can identify the data structures with high accuracy.

关键词： Data structures dynamic binary analysis

来源：评论

学校读者我要写书评

暂无评论

Reverse extraction of protocol model from network applications

引用

INTERNATIONAL JOURNAL OF INTERNET PROTOCOL TECHNOLOGY 2013年第4期7卷 228-245页

作者： Li, Meijian Wang, Yongjun Jin, Shangjie Xie, Peidai Natl Univ Def Technol Comp Coll Changsha 410073 Hunan Peoples R China Acad Mil Transportat Inst Mil Transportat Tianjin 300161 Peoples R China

The reverse extraction of the protocol model from a network application is performed to understand network behaviour and detect vulnerabilities. In this paper, we propose a framework that automatically extracts the described formal protocol model using a state machine. The proposed system, which is based on a dynamic binary analysis technique, is suited to the reverse analysis of network applications implemented with closed and encrypted protocols. We evaluate the technique by conducting experiments on the extracting protocol models from two secure socket layer implementation programs to demonstrate the strength of this technique. The results show that the proposed approach can produce a corresponding approximate protocol model from network applications. However, exhibiting high practice in the aspect of network behaviour analysis does not make sense for real-world applications.

关键词： dynamic binary analysis DBA specification mining protocol reverse engineering

来源：评论

学校读者我要写书评

暂无评论

Extending Valgrind framework with the MIPS MSA support

Extending Valgrind framework with the MIPS MSA support

引用

Zooming Innovation in Consumer Electronics International Conference (ZINC)

作者： Vlahovic, Tamara Misic, Marko Tomasevic, Milo Karadzic, Aleksandra Rikalo, Aleksandar Univ Belgrade Sch Elect Engn Belgrade Serbia RT RK Inst Comp Based Syst Novi Sad Serbia

ISBN: (纸本)9781538608654

This paper presents an extension of Valgrind framework for dynamic binary code analysis to support MIPS MSA instruction set which includes instructions for vector (SIMD) processing of integer and floating-point data of different widths. First, a background on MIPS and its MSA extention is given. Then, Valgrind features for code instrumentation are described. Several changes have been made to Valgrind intermediate representation in order to support new instruction set. The implementation issues regarding the structures, formats, and functions needed for extension are discussed. Some low-level details and examples are also presented. Upgraded Valgrind tools are verified using dedicated regression test suite on the Linux platform.

关键词： dynamic binary analysis embedded systems MIPS MSA Valgrind

来源：评论

学校读者我要写书评

暂无评论

TLTracer: dynamically Detecting Cache Side Channel Attacks with a Timing Loop Tracer 59

TLTracer: Dynamically Detecting Cache Side Channel Attacks w...

引用

59th Annual IEEE International Conference on Communications (IEEE ICC)

作者： Wang, Mingyu Meng, Lingjia Zheng, Fangyu Lin, Jingqiang Jia, Shijie Ma, Yuan Fan, Haoling Chinese Acad Sci Inst Informat Engn Key Lab Cyberspace Secur Def Beijing Peoples R China Univ Chinese Acad Sci Sch Cyber Secur Beijing Peoples R China Univ Chinese Acad Sci Sch Cryptol Beijing Peoples R China Univ Sci & Technol China Sch Cyber Secur Hefei Peoples R China

ISBN: (纸本)9781728190549

Recently, cache side-channel attacks have gained increasing attention due to the significant threat they pose to data security. As research advances, these attacks have become more covert and their impact has been widened. To mitigate the threat posed by cache side-channel attacks, numerous detection approaches have been proposed. However, they struggle to capture runtime features or depend heavily on hardware performance counters (HPCs), resulting in a significant number of false negatives or false positives. To address this issue, this paper proposes a broadly applicable runtime feature for identifying cache side-channel attack programs and introduces a dynamic binary analysis approach, TLTracer. TLTracer is runtime trace-based, independent of HPCs and capable of scanning and detecting whether a binary program is malicious before it is deployed in the real world. We implement a prototype of TLTracer and evaluate it with a set of malicious and benign programs. The results show that it can effectively detect the latest cache side-channel attacks without false positives, and offer increased resilience against adversarial evasion compared to other detection tools.

关键词： Cache side-channel attacks Intel Pin dynamic binary analysis

来源：评论

学校读者我要写书评

暂无评论

Approximate Data Dependence Profiling Based on Abstract Interval and Congruent Domains 33rd

Approximate Data Dependence Profiling Based on Abstract Inte...

引用

33rd International Conference on Architecture of Computing Systems (ARCS)

作者： Abbas, Mostafa Omar, Rasha El-Mandy, Ahmed Rohou, Erven Egypt Japan Univ Sci & Technol E JUST Alexandria Egypt Univ Rennes INRIA CNRS IRISA Rennes France Alexandria Univ Alexandria Egypt

ISBN: (纸本)9783030527938;9783030527945

Although parallel processing is mainstream, existing programs are often serial, and usually re-engineering cost is high. Data dependence profiling allows for automatically assessing parallelisation potential;Yet, data dependence profiling is notoriously slow and requires large memory, as it generally requires keeping track of each memory access. This paper considers employing a simple abstract single-trace analysis method using simple interval and congruent modulo domains to track dependencies at lower time and memory costs. The method gathers and abstracts the set of all memory reference addresses for each static memory access instruction. This method removes the need for keeping a large shadow memory and only requires a single pair-wise analysis pass to detect dependencies among memory instructions through simple intersection operations. Moreover, the combination of interval and congruent domains improves precision when compared with only using an interval domain representation, mainly when the data is not accessed in a dense access pattern. We further improve precision through partitioning memory space into blocks, where references in each block abstracted independently. An initial performance study is conducted on SPEC CPU2006 benchmark programs and polyhedral benchmark suite. Results show that the method reduces execution time overhead by 1.4x for polyhedral and 10.7x for SPEC2006 on average;and significantly reduces memory by 109780x and 6981x for polyhedral and SPEC2006 respectively;the method has an average precision of 99.05% and 61.37% for polyhedral and SPEC respectively. Using memory partitioning resulted in improving mean precision to be 82.25% and decreasing memory reduction to be 47x for SPEC2006 suite.

关键词： Data dependence profiling dynamic binary analysis Congruent domains Interval domains

来源：评论

学校读者我要写书评

暂无评论

POLLUX : Safely Upgrading Dependent Application Libraries 24

POLLUX : Safely Upgrading Dependent Application Libraries

引用

24th ACM SIGSOFT International Symposium on Foundations of Software Engineering (FSE)

作者： Kalra, Sukrit Goel, Ayush Khanna, Dhriti Dhawan, Mohan Sharma, Subodh Purandare, Rahul IIIT Delhi Delhi India IBM Res New Delhi Delhi India IIT Delhi New Delhi Delhi India

ISBN: (纸本)9781450342186

Software evolution in third-party libraries across version upgrades can result in addition of new functionalities or change in existing APIs. As a result, there is a real danger of impairment of backward compatibility. Application developers, therefore, must keep constant vigil over library enhancements to ensure application consistency, i.e., application retains its semantic behavior across library upgrades. In this paper, we present the design and implementation of POLLUX, a framework to detect application-affecting changes across two versions of the same dependent non-adversarial library binary, and provide feedback on whether the application developer should link to the newer version or not. POLLUX leverages relevant application test cases to drive execution through both versions of the concerned library binary, records all concrete effects on the environment, and compares them to determine semantic similarity across the same API invocation for the two library versions. Our evaluation with 1 6 popular, open-source library binaries shows that POLLUX is accurate with no false positives and works across compiler optimizations.

关键词： Software maintenance Library upgrade dynamic binary analysis

来源：评论

学校读者我要写书评

暂无评论

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案：

请选择收藏分类：

通借通还

建议与咨询 留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案： 新增检索档案 确定 取消

请选择收藏分类： 新增自定义分类 确定 取消

通借通还

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

请选择保存的检索档案：

请选择收藏分类：