Filters








63 Hits in 5.6 sec

Native x86 Decompilation using Semantics-Preserving Structural Analysis and Iterative Control-Flow Structuring

Edward J. Schwartz, JongHyup Lee, Maverick Woo, David Brumley
2018
Specifically, existing structuring algorithms are not semantics-preserving, which means that they cannot safely be used for decompilation without modification.  ...  Previous work in control-flow structuring, an abstraction recovery problem used in decompilers, does not provide either of these properties.  ...  We also identify a new property, semantics-preservation, that control flow structuring algorithms must have to be safely used in decompilers.  ... 
doi:10.1184/r1/6469064 fatcat:nwyvsl62wrgbpnq4q63v2tmcsy

Scalable validation of binary lifters

Sandeep Dasgupta, Sushant Dinesh, Deepan Venkatesh, Vikram S. Adve, Christopher W. Fletcher
2020 Proceedings of the 41st ACM SIGPLAN Conference on Programming Language Design and Implementation  
to an intermediate representation (IR) using a binary lifter, and (3) performing various analysis and transformations on the IR pertaining to the specific goals of the decompiler.  ...  The semantic equivalence check between the reference and the lifter output is then reduced to a graph-isomorphism check through the use of semantic preserving transformations.  ...  [31] proposed control-flow structure recovery by employing semantics preventing schema and tested their binary-to-C decompiler, Phoenix on a set of 107 real world programs from GNU coreutils.  ... 
doi:10.1145/3385412.3385964 dblp:conf/pldi/DasguptaDVAF20 fatcat:3khjl5gbmnetjay23fk3sc2ktu

Extracting Conditional Formulas for Cross-Platform Bug Search

Qian Feng, Minghua Wang, Mu Zhang, Rundong Zhou, Andrew Henderson, Heng Yin
2017 Proceedings of the 2017 ACM on Asia Conference on Computer and Communications Security - ASIA CCS '17  
We have implemented a prototype, XMATCH, and evaluated it using well-known software, including OpenSSL and BusyBox.  ...  In this paper, we propose to extract conditional formulas as higher-level semantic features from the raw binary code to conduct the code search.  ...  Any opinions, findings, and conclusions in this paper are those of the authors and do not necessarily reflect the views of the funding agencies.  ... 
doi:10.1145/3052973.3052995 dblp:conf/ccs/FengWZZHY17 fatcat:y7moxnp55rd5bkdkyp6jrxbs3a

Android Code Protection via Obfuscation Techniques: Past, Present and Future Directions [article]

Parvez Faruki (Malaviya National Institute of Technology Jaipur, India) and Hossein Fereidooni and Vijay Laxmi and Mauro Conti, Manoj Gaur (Malaviya National Institute of Technology Jaipur, India)
2016 arXiv   pre-print
Furthermore, we review and analyse the obfuscation techniques used by malware authors to evade analysis efforts.  ...  Obfuscation is an action that modifies an application (app) code, preserving the original semantics and functionality to evade anti-malware. Code obfuscation is a contentious issue.  ...  Hence, a plagiarist can misuse the goto bytecode and obfuscate with an arbitrary control-flow transformation. Java language can only express a structured control flow.  ... 
arXiv:1611.10231v1 fatcat:qvx7bm553vcutfhclemlpwaozi

Protecting Software through Obfuscation

Sebastian Schrittwieser, Stefan Katzenbeisser, Johannes Kinder, Georg Merzdovnik, Edgar Weippl
2016 ACM Computing Surveys  
On the other hand, more expensive analysis techniques, in particular when used interactively by a human analyst, can easily defeat many obfuscations.  ...  Still, it remains largely unexplored to what extent today's software obfuscations keep up with state-of-the-art code analysis, and where we stand in the arms race between software developers and code analysts  ...  It uses semantics-preserving transformations to restore structured control flow graphs.  ... 
doi:10.1145/2886012 fatcat:6ze4t4rrzjfr3lhmgp2kvmqblq

Obfuscation resilient binary code reuse through trace-oriented programming

Junyuan Zeng, Yangchun Fu, Kenneth A. Miller, Zhiqiang Lin, Xiangyu Zhang, Dongyan Xu
2013 Proceedings of the 2013 ACM SIGSAC conference on Computer & communications security - CCS '13  
Thus, TOP can be used for malware analysis, especially for malware function analysis and identification.  ...  in malware analysis and identification, and binary function transplanting.  ...  Any opinions, findings, and conclusions in this paper are those of the authors only and do not necessarily reflect the views of the funding agencies.  ... 
doi:10.1145/2508859.2516664 dblp:conf/ccs/ZengFMLZX13 fatcat:3qob5amrfbdhrnk4ugu4p77jdm

The Security Risk of Lacking Compiler Protection in WebAssembly [article]

Quentin Stiévenart, Coen De Roover, Mohammad Ghafari
2021 arXiv   pre-print
We compiled 4,469 C programs with known buffer overflow vulnerabilities to x86 code and to WebAssembly, and observed the outcome of the execution of the generated code to differ for 1,088 programs.  ...  WebAssembly is increasingly used as the compilation target for cross-platform applications.  ...  Stiévenart and De Roover propose a static analysis framework [16] for WebAssembly, used to build an information flow analysis [17] to detect higher-level security concerns such as leaks of sensitive  ... 
arXiv:2111.01421v1 fatcat:egqrvb7ppra33b2o5hmfnkbvma

Runtime Vectorization Transformations of Binary Code

Nabil Hallou, Erven Rohou, Philippe Clauss
2016 International journal of parallel programming  
For this purpose, we use open source frameworks that we have tuned and integrated to (1) dynamically lift the x86 binary into the Intermediate Representation form of the LLVM compiler, (2) abstract hot  ...  loops in the polyhedral model, (3) use the power of this mathematical framework to vectorize them, and (4) finally  ...  The analysis is completely static in our case (i.e., does not use dynamic control flow). Re-vectorization happens on this reconstructed CFG.  ... 
doi:10.1007/s10766-016-0480-z fatcat:2a3xnzyxdbfmnlxmjlcjalkax4

Reverse engineering of binary device drivers with RevNIC

Vitaly Chipounov, George Candea
2010 Proceedings of the 5th European conference on Computer systems - EuroSys '10  
We use RevNIC to reverse engineer four proprietary Windows drivers and port them to four different OSes, both for PCs and embedded systems.  ...  Drivers are often proprietary and available for only one or two operating systems, thus restricting the range of device support on all other OSes.  ...  Acknowledgments We are indebted to our shepherd, Julia Lawall, and the anonymous reviewers for helping us improve our paper.  ... 
doi:10.1145/1755913.1755932 dblp:conf/eurosys/ChipounovC10 fatcat:t6sebw55yvdjhg5htr2cgodcv4

Mostly static program partitioning of binary executables

Efe Yardimci, Michael Franz
2009 ACM Transactions on Programming Languages and Systems  
We describe how such additional control flow edges are discovered and handled at run-time, so that an incomplete static analysis never leads to an incorrect optimization result.  ...  Key to this remarkable performance is an off-line preprocessing step that extracts a mostly correct control flow graph (CFG) from the binary program ahead of time.  ...  do we actually require from the control flow information in order for it to support a useful IR structure.  ... 
doi:10.1145/1538917.1538918 fatcat:yxmliifntzfynaafetepvyovsy

Replacement attacks against VM-protected applications

Sudeep Ghosh, Jason Hiser, Jack W. Davidson
2012 SIGPLAN notices  
In a replacement attack, the adversary replaces the protecting PVM with an attack VM thereby rendering the application vulnerable to analysis and modification.  ...  We present a general description of the replacement attack methodology and two attack implementations against a protected application using freely available tools.  ...  Acknowledgments This research is supported by National Science Foundation grants CNS-00716446 and CCF-0811689 and the Air Force Research Laboratory (AFRL) under contract FA8650-10-C-7025.  ... 
doi:10.1145/2365864.2151051 fatcat:ybiejivn7ng4pebpavlpzizj64

Replacement attacks against VM-protected applications

Sudeep Ghosh, Jason Hiser, Jack W. Davidson
2012 Proceedings of the 8th ACM SIGPLAN/SIGOPS conference on Virtual Execution Environments - VEE '12  
In a replacement attack, the adversary replaces the protecting PVM with an attack VM thereby rendering the application vulnerable to analysis and modification.  ...  We present a general description of the replacement attack methodology and two attack implementations against a protected application using freely available tools.  ...  Acknowledgments This research is supported by National Science Foundation grants CNS-00716446 and CCF-0811689 and the Air Force Research Laboratory (AFRL) under contract FA8650-10-C-7025.  ... 
doi:10.1145/2151024.2151051 dblp:conf/vee/GhoshHD12 fatcat:pnkjc54cnbgjva6gtrtguyi5n4

HotpathVM

Andreas Gal, Christian W. Probst, Michael Franz
2006 Proceedings of the 2nd international conference on Virtual execution environments - VEE '06  
Our novel use of SSA form in this context allows to hoist instructions across trace side-exits without necessitating expensive compensation code in off-trace paths.  ...  The overall memory consumption (code and data) of our system is only 150 kBytes, yet benchmarks show a speedup that in some cases rivals heavy-weight just-in-time compilers.  ...  Technology Center (BacaTec), and the National Science Foundation (NSF) under grants TC-0209163 and ITR-0205712.  ... 
doi:10.1145/1134760.1134780 dblp:conf/vee/GalPF06 fatcat:re7nnbmeprglxd2ubjnateinne

Deep Learning Based Cryptographic Primitive Classification [article]

Gregory D. Hill, Xavier J. A. Bellekens
2017 arXiv   pre-print
The model blueprint, a DCNN, is fittingly configured to learn from variable-length control flow diagnostics output from a dynamic trace.  ...  The following manuscript presents a novel approach for the classification of cryptographic primitives in compiled binary executables using deep learning.  ...  [25] [9] utilised fine-grained dynamic binary analysis to generate a high-level control flow graph for evaluation using three heuristics.  ... 
arXiv:1709.08385v1 fatcat:pze2f23objeybjwk53fih4c6wi

Polymorphic Type Inference for Machine Code [article]

Matthew Noonan, Alexey Loginov, David Cok
2016 arXiv   pre-print
The problem of recovering high-level types by performing type inference over stripped machine code is called type reconstruction, and offers a useful capability in support of reverse engineering and decompilation  ...  Many of the features we identify are often seen only in expressive and powerful type systems used by high-level functional languages.  ...  Acknowledgments The authors would like to thank Vineeth Kashyap and the anonymous reviewers for their many useful comments on this manuscript, and John Phillips, David Ciarletta, and Tim Clark for their  ... 
arXiv:1603.05495v2 fatcat:vtaoufc2ezf4dcklunu54az3je
« Previous Showing results 1 — 15 out of 63 results