MetaCG: annotated call-graphs to facilitate whole-program analysis

Lehr, Jan-Patrick; Hück, Alexander; Fischler, Yannic; Bischof, Christian

doi:10.1145/3427764.3428320

Cited by 7 publications

(1 citation statement)

References 21 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…While much of the ICFG can be determined at compile time, indirect call sites prevent precise whole program analysis. There are tools available [118], [145] to perform call graph analysis, but they tend to over-approximate the call graph edges at indirect call sites. This is due to the overlap in function prototypes, especially in C programs, which are the primary means of determining indirect call edges.…”

Section: Dynamic Icfg Considerationsmentioning

confidence: 99%

Towards rigorous evaluation of binary testing and analysis

Bundt

View full text Add to dashboard Cite

Towards Rigorous Evaluation of Binary Testing and Analysis by Joshua BundtComputer security research is an ever-evolving field that aims to make technology more secure.Attackers constantly seek out vulnerabilities in systems, and defenders strive to introduce new controls to prevent these attacks. Attack research typically involves demonstrating the validity of an attack through a proof of concept. In contrast, defense research requires a higher level of rigor to substantiate that defenses are secure under various conditions and against a willful adversary. In this thesis, we examine the state of rigor in a specific area of defense research: binary testing and analysis. Binary testing and analysis encompasses the tasks and techniques required to evaluate binary code, which is the machine-readable representation of software programs, in order to understand program behavior, identify vulnerabilities, and ensure correctness and security. To assess the robustness of the current techniques and to provide a more rigorous methodology, we first examine the utility of synthetic bug generation as a solution to the scarcity of real bugs for fuzz testing evaluation. We conducted a large-scale measurement study evaluating existing synthetic bug generators with eight fuzzers on 20 software libraries and found that synthetic bugs are easier to discover than organic bugs and the most popular synthetic bug benchmark, LAVA-M, exhibits fundamental flaws that make it unsuitable to recommend for future research. Second, we propose a new workflow to enable humans to more effectively assist fuzz testing through compartment analysis. An empirical study of seven software libraries revealed that compartment analysis can significantly improve a fuzzing campaign even when conducted after a few hours of fuzzing. Finally, we consider the fragility of neural network binary disassemblers at the task of function boundary detection. When comparing traditional disassemblers to neural binary disassemblers, we found the latter to be vulnerable to adversarial attacks which allows the attacker to degrade function boundary detection. In response, we proposed an expanded set of benchmarks and adversarial techniques to provide a better evaluation of neural binary disassemblers. Throughout this dissertation, we propose and demonstrate improved methodologies for rigorously examining and assessing binary testing and analysis efficacy. v AcknowledgementsThe PhD journey starts with someone agreeing to take a long term risk on you despite knowing little more than your resume. For taking the initial risk, I would like to thank my advisor Wil Robertson who has guided me from start to finish while providing advice, unwaverable optimism, and tremendous patience. A special thanks to Tim Leek who took on mentoring me long before I started at Northeastern and continues to provide keen insight and frank opinions that shape my research efforts. I would also like to thank the rest of the members of my committee Pete Manolios, Guevara Noubir, and Davide Balzarotti who pr...

show abstract

Section: Dynamic Icfg Considerationsmentioning

confidence: 99%

Towards rigorous evaluation of binary testing and analysis

Bundt

View full text Add to dashboard Cite

show abstract

Automatic Low-Overhead Load-Imbalance Detection in MPI Applications

Arzt

Fischler

Lehr

et al. 2021

Euro-Par 2021: Parallel Processing

View full text Add to dashboard Cite

Compiler-Assisted Instrumentation Selection for Large-Scale C++ Codes

Kreutzer

Iwainsky²,

Lehr

et al. 2022

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Code instrumentation is the primary method for collecting fine-grained performance data. As instrumentation introduces an inherent runtime overhead, it is essential to measure only those regions of the code which are most relevant to the analysis. In practice, the typical approach is to define filter lists manually. Prior projects aim to automate this process using static analysis. Specifically, InstRO enables tailored instrumentation via sophisticated user-defined selection of code regions. However, due to the need for whole-program call-graph analysis, its application on large-scale scientific codes is currently impractical. In this work, we present the new instrumentation tool CaPI (short for “Compiler-assisted Performance Instrumentation”), which is targeted towards such large-scale applications. We demonstrate its application on the CFD framework OpenFOAM. Our evaluation shows that a hybrid approach of CaPI and existing profile-guided filtering outperforms profile-guided filtering alone. Furthermore, we identify correctness and usability issues and propose possible avenues to improve CaPI, as well as compiler-assisted instrumentation tools in general.

show abstract

MetaCG: annotated call-graphs to facilitate whole-program analysis

Cited by 7 publications

References 21 publications

Towards rigorous evaluation of binary testing and analysis

Towards rigorous evaluation of binary testing and analysis

Automatic Low-Overhead Load-Imbalance Detection in MPI Applications

Compiler-Assisted Instrumentation Selection for Large-Scale C++ Codes

Contact Info

Product

Resources

About