CodeSurfer/x86—A Platform for Analyzing x86 Executables

Balakrishnan, Gogul; Gruian, Radu; Reps, Thomas; Teitelbaum, Tim

doi:10.1007/978-3-540-31985-6_19

Cited by 106 publications

(79 citation statements)

References 10 publications

(10 reference statements)

Supporting

Mentioning

Contrasting

Order By: Relevance

“…This typically manifests itself in either false positives (Johnson et al 2013) or false negatives (Engler and Musuvathi 2004) depending on the analysis model. In the area of binary analysis even the most powerful static technique has problems handling even the most basic aggregate arrays (Balakrishnan et al 2005). On the other hand dynamic analysis is inherently context sensitive since it reasons about a concrete execution path.…”

Section: Static Versus Dynamic Analysismentioning

confidence: 99%

Scalable data structure detection and classification for C/C++ binaries

2015

View full text Add to dashboard Cite

Many existing techniques for reversing data structures in C/C++ binaries are limited to low-level programming constructs, such as individual variables or structs. Unfortunately, without detailed information about a program's pointer structures, forensics and reverse engineering are exceedingly hard. To fill this gap, we propose MemPick, a tool that detects and classifies high-level data structures used in stripped binaries. By analyzing how links between memory objects evolve throughout the program execution, it distinguishes between many commonly used data structures, such as singly-or doubly-linked lists, many types of trees (e.g., AVL, red-black trees, B-trees), and graphs. We evaluate the technique on 10 real world applications, 4 file system implementations and 16 popular libraries. The results show that MemPick can identify the data structures with high accuracy.

show abstract

Section: Static Versus Dynamic Analysismentioning

confidence: 99%

Scalable data structure detection and classification for C/C++ binaries

2015

View full text Add to dashboard Cite

show abstract

“…The CodeSurfer/x86 platform [6] is a proprietary platform for analyzing x86 programs. However, it was mainly designed for other applications such as slicing and does not provide some of the capabilities that we need.…”

Section: Related Workmentioning

confidence: 99%

BitBlaze: A New Approach to Computer Security via Binary Analysis

Song

Brumley

Yin

et al. 2008

Lecture Notes in Computer Science

549

308

View full text Add to dashboard Cite

Abstract. In this paper, we give an overview of the BitBlaze project, a new approach to computer security via binary analysis. In particular, BitBlaze focuses on building a unified binary analysis platform and using it to provide novel solutions to a broad spectrum of different security problems. The binary analysis platform is designed to enable accurate analysis, provide an extensible architecture, and combines static and dynamic analysis as well as program verification techniques to satisfy the common needs of security applications. By extracting security-related properties from binary programs directly, BitBlaze enables a principled, root-cause based approach to computer security, offering novel and effective solutions, as demonstrated with over a dozen different security applications.

show abstract

“…This can be done by using the program-dependence graph (PDG) [14] instead of the controldependence graph. Balakrishnan et al [3] have demonstrated PDG construction for unannotated binaries, but the infrastructure to do this is not yet generally available.…”

Section: Design Alternativesmentioning

confidence: 99%

Cooperative Bug Isolation

2007

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Statistical debugging uses lightweight instrumentation and statistical models to identify program behaviors that are strongly predictive of failure. However, most software is mostly correct; nearly all monitored behaviors are poor predictors of failure. We propose an adaptive monitoring strategy that mitigates the overhead associated with monitoring poor failure predictors. We begin by monitoring a small portion of the program, then automatically refine instrumentation over time to zero in on bugs. We formulate this approach as a search on the control-dependence graph of the program. We present and evaluate various heuristics that can be used for this search. We also discuss the construction of a binary instrumentor for incorporating the feedback loop into post-deployment monitoring. Performance measurements show that adaptive bug isolation yields an average performance overhead of 1% for a class of large applications, as opposed to 87% for realistic sampling-based instrumentation and 300% for complete binary instrumentation.

show abstract

CodeSurfer/x86—A Platform for Analyzing x86 Executables

Cited by 106 publications

References 10 publications

Scalable data structure detection and classification for C/C++ binaries

Scalable data structure detection and classification for C/C++ binaries

BitBlaze: A New Approach to Computer Security via Binary Analysis

Cooperative Bug Isolation

Contact Info

Product

Resources

About