The BINCOA Framework for Binary Code Analysis

Bardin, Sébastien; Herrmann, P.; Leroux, Jérôme; Ly, Olivier; Tabary, Renaud; Vincent, Aymeric

doi:10.1007/978-3-642-22110-1_13

Cited by 44 publications

(35 citation statements)

References 11 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…On the other hand, we made our framework independent from implementation languages by translating them into an IR. Our work thus dovetails with recent work that uses IRs for binaries [1,3], which aims at providing a generic interface for low-level analyses. Indeed, Arcade.PLC is the first verification tool for PLCs that can handle modules written in different languages.…”

Section: Resultsmentioning

confidence: 91%

Arcade.PLC: a verification platform for programmable logic controllers

Biallas

Brauer

Kowalewski

2012

Proceedings of the 27th IEEE/ACM International Conference on Automated Software Engineering

View full text Add to dashboard Cite

This paper introduces Arcade.PLC, a verification platform for programmable logic controllers (PLCs). The tool supports static analysis as well as ∀CTL and past-time LTL model checking using counterexample-guided abstraction refinement for different programming languages used in industry. In the underlying principles of the framework, knowledge about the hardware platform is exploited so as to provide efficient techniques. The effectiveness of the approach is evaluated on programs implemented using a combination of programming languages.

show abstract

Section: Resultsmentioning

confidence: 91%

Arcade.PLC: a verification platform for programmable logic controllers

Biallas

Brauer

Kowalewski

2012

Proceedings of the 27th IEEE/ACM International Conference on Automated Software Engineering

View full text Add to dashboard Cite

show abstract

“…For an overview of the recent challenges, see the Dagstuhl report [34]. Along with the increased interest in binary analysis, tool support has improved [5], [32], [35], [36].…”

Section: E Restriction Of Flow Data Along Conditional Edgesmentioning

confidence: 99%

A non-convex abstract domain for the value analysis of binaries

Mattsen

Wichmann

Schupp

2015

2015 IEEE 22nd International Conference on Software Analysis, Evolution, and Reengineering (SANER)

View full text Add to dashboard Cite

A challenge in sound reverse engineering of binary executables is to determine sets of possible targets for dynamic jumps. One technique to address this challenge is abstract interpretation, where singleton values in registers and memory locations are overapproximated to collections of possible values. With contemporary abstract interpretation techniques, convexity is usually enforced on these collections, which causes unacceptable loss of precision. We present a non-convex abstract domain, suitable for the analysis of binary executables. The domain is based on binary decision diagrams (BDD) to allow an efficient representation of non-convex sets of integers. Non-convex sets are necessary to represent the results of jump table lookups and bitwise operations, which are more frequent in executables than in high-level code because of optimizing compilers. Our domain computes abstract bitwise and arithmetic operations precisely and looses precision only for division and multiplication. Because the operations are defined on the structure of the BDDs, they remain efficient even if executed on very large sets. In executables, conditional jumps require solving formulas built with negation and conjunction. We implement a constraint solver using the fast intersection and complementation of BDD-based sets. Our domain is implemented as a plug-in, called BDDStab, and integrated with the binary analysis framework Jakstab. We use Jakstab's k-set and interval domains to discuss the increase in precision for a selection of compiler-generated executables.

show abstract

“…Many intermediate representations for giving semantics to assembler instructions exist, each having its own design goals such as minimality [5,8], mechanical verifiability [9], reversibility [12], or expressivity [5,14]. Our own RReil IR [14] was designed to allow for a precise numeric interpretation.…”

Section: Rreil Intermediate Representationmentioning

confidence: 99%

The GDSL toolkit

Simon¹,

Kranz²

2014

Proceedings of ACM SIGPLAN on Program Protection and Reverse Engineering Workshop 2014

View full text Add to dashboard Cite

Any inspection, analysis or reverse engineering of binaries requires a translation of the program text into an intermediate representation (IR) that conveys the semantics of the program. To this end, we propose a domain specific language called GDSL (Generic Decoder Specification Language) that facilitates the translation from byte streams to instructions and from there to other intermediate representations. We present the GDSL toolkit, containing a compiler from GDSL to C, instruction decoders (currently for Intel x86 and Atmel AVR), translations to semantics, and optimizations of the semantics. Other processors, semantics and optimizations can be added, thereby providing a common platform for building frontends for the analysis of binaries. The emitted C code is humanreadable and outperforms hand-written code such as the XED decoder shipped with the Intel Pin toolkit.

show abstract

The BINCOA Framework for Binary Code Analysis

Cited by 44 publications

References 11 publications

Arcade.PLC: a verification platform for programmable logic controllers

Arcade.PLC: a verification platform for programmable logic controllers

A non-convex abstract domain for the value analysis of binaries

The GDSL toolkit

Contact Info

Product

Resources

About