Disassembly of executable code revisited

Schwarz, Benjamin; Debray, Saumya; Andrews, Gregory R.

doi:10.1109/wcre.2002.1173063

Cited by 120 publications

(89 citation statements)

References 11 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The connection between constraints (1) and (2) and control flow analysis is stated in the following theorem (detailed proof in Appendix A), whereby correctness notably depends on ι start ∈ L: Theorem 1. Given a program in the language JUMP and a trace σ = (s i ) 0≤i≤n , such that s 0 (pc) = start and s 0 ∈ γ(ι start ), every solution (D, F ) of the constraints (1) and (2) satisfies s n ∈ γ(D(s n (pc))) and TCFG(σ) ⊆ F .…”

Section: Control Flow Reconstruction By Abstract Interpretationmentioning

confidence: 99%

“…The algorithm iterates its main loop as long as it can find an unsatisfied inequality (line 7,8). Thus the algorithm essentially searches for violations of constraints (1) and (2). If the generic algorithm finds at least one not yet satisfied inequality, it nondeterministically picks a single unsatisfied inequality and updates it (lines 9 to 14).…”

Section: Algorithms For Control Flow Reconstructionmentioning

confidence: 99%

“…The literature contains a number of practical approaches to disassembly, which do not try to formulate a generalizable strategy. Schwarz et al [2] describe a technique that uses an improved linear sweep disassembly algorithm, using relocation information to avoid misinterpreting data in a code segment. Subsequently, they run a recursive traversal algorithm on each function and compare results, but no attempt is made to recover from mismatching disassembly results.…”

Section: Related Workmentioning

confidence: 99%

“…Often, data flow analysis can aid in resolving such indirect branches; however, data flow analysis already requires a precise control flow graph to work on. This seemingly paradox situation has been referred to as an inherent "chicken and egg" problem in the literature [1,2].…”

Section: Introductionmentioning

confidence: 99%

“…We present a framework to construct a safe overapproximation of the control flow graph of low level programs by effectively combining control and data flow analysis by means of abstract interpretation. Existing approaches to control flow extraction from binaries usually either make a best effort attempt and accept possible unsoundness [3,4], or they make optimistic assumptions on clean code layout [5] or on the presence of additional information such as symbol tables or relocation information [2]. Our approach is designed to be generic in the sense that it does not require any additional information besides the actual instructions and is still able to compute a sound and precise overapproximation of the control flow graph.…”

Section: Introductionmentioning

confidence: 99%

See 4 more Smart Citations

An Abstract Interpretation-Based Framework for Control Flow Reconstruction from Binaries

Kinder

Zuleger

Veith

2008

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Abstract. Due to indirect branch instructions, analyses on executables commonly suffer from the problem that a complete control flow graph of the program is not available. Data flow analysis has been proposed before to statically determine branch targets in many cases, yet a generic strategy without assumptions on compiler idioms or debug information is lacking. We have devised an abstract interpretation-based framework for generic low level programs with indirect jumps which safely combines a pluggable abstract domain with the notion of partial control flow graphs. Using our framework, we are able to show that the control flow reconstruction algorithm of our disassembly tool Jakstab produces the most precise overapproximation of the control flow graph with respect to the used abstract domain.

show abstract

Section: Control Flow Reconstruction By Abstract Interpretationmentioning

confidence: 99%

Section: Algorithms For Control Flow Reconstructionmentioning

confidence: 99%

Section: Related Workmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations

An Abstract Interpretation-Based Framework for Control Flow Reconstruction from Binaries

Kinder

Zuleger

Veith

2008

Lecture Notes in Computer Science

View full text Add to dashboard Cite

show abstract

Identifying functions in binary code with reverse extended control flow graphs

Qiu

2015

J Software Evolu Process

View full text Add to dashboard Cite

In binary code analysis, current function identification approaches are challenged by functions without explicit call sites and handcrafted assembly without standard prologues/epilogues. We propose a new function representation called a reverse extended control flow graph (RECFG) and a RECFG-based method for identifying functions in stripped binary code. A function has at least one return instruction (an instruction that makes the control flow leave a function). Therefore, return instructions are more reliable than the function prologues and epilogues used by traditional methods. We first build RECFGs from any values that can be interpreted as return instructions in a code range. Then, for each independent RECFG, the multiple-decision method chooses a subgraph as the control flow graph of a function. A prototype tool is developed for evaluation on seven open source applications, 138 binaries in MASM32 code examples, and 292 binaries in Windows XP SP3. Experimental results show that the proposed method can identify functions that cannot be identified by current methods with high precision and stable recall.

show abstract

Practical dynamic reconstruction of control flow graphs

2020

View full text Add to dashboard Cite

The automatic recovery of a program's high‐level representation from its binary version is a well‐studied problem in programming languages. However, most of the solutions to this problem are based on purely static approaches: techniques such as dataflow analyses or type inference are used to convert the bytes that constitute the executable code back into a control flow graph (CFG). This article departs from such a modus operandi to show that a dynamic analysis can be effective and useful, both as a standalone technique, and as a way to enhance the precision of static approaches. The experimental results provide evidence that completeness, that is, the ability to conclude that the entire CFG has been discovered, is achievable on many functions that are part of industry‐strong benchmarks. Experiments also indicate that dynamic information greatly enhances the ability of DynInst, a state‐of‐the‐art binary reconstructor, to deal with code stripped of debugging information. These results were obtained with CFGgrind, a new implementation of a dynamic code reconstructor, built on top of Valgrind. When applied to cBench, CFGgrind is 9% faster than callgrind, Valgrind's tool used to track targets of function calls; and 7% faster in Spec Cpu2017. CFGgrind recovers the complete CFG of 40% of all the procedures invoked during the standard execution of programs in Spec Cpu2017, and 37% in cBench. When combined with CFGgrind, DynInst finds 15% more CFGs for cBench, and 7% more CFGs for Spec Cpu2017. Finally, CFGgrind is more than 7 times faster than DCFG, a CFG reconstructor from Intel, and 1.30 times faster than bfTrace, a CFG reconstructor used in research. CFGgrind is also more precise than these two tools, handling operating system signals, shared code in functions, and unaligned instructions; besides supporting multithreaded programs, exact profiling and incremental refinements.

show abstract

Disassembly of executable code revisited

Cited by 120 publications

References 11 publications

An Abstract Interpretation-Based Framework for Control Flow Reconstruction from Binaries

An Abstract Interpretation-Based Framework for Control Flow Reconstruction from Binaries

Identifying functions in binary code with reverse extended control flow graphs

Practical dynamic reconstruction of control flow graphs

Contact Info

Product

Resources

About