Tupni: Automatic reverse engineering of input formats

Proceedings of the ACM Conference on Computer and Communications Security

Volumn , Issue , 2008, Pages 391-402

  Cui, Weidong ^a   Peinado, Marcus ^a   Chen, Karl ^b   Wang, Helen J ^a   Irun Briz, Luiz ^a  

^a MICROSOFT RESEARCH   (United States)

^b UNIVERSITY OF CALIFORNIA   (United States)

Author keywords

Binary analysis; Protocol re erse engineering

Indexed keywords

BINARY ANALYSIS; FILE FORMATS; FILE-FORMAT SPECIFICATION; INPUT CONSTRAINTS; INPUT FORMAT; MULTIPLE INPUTS; PROTOCOL RE ERSE ENGINEERING; REVERSE ENGINEERING TOOLS; REVERSE ENGINEERS; SECURITY APPLICATION; TEST INPUTS; VULNERABILITY SIGNATURE;

HTTP; INTERNET PROTOCOLS; REENGINEERING; REVERSE ENGINEERING;

SPECIFICATIONS;

EID: 70349283250     PISSN: 15437221     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1145/1455770.1455820     Document Type: Conference Paper

References (42)

1. International Telecommunication Union Recommendation T.81: JPEG Specification. http://www.w3.org/Graphics/JPEG/itu-t81.pdf.
2. TIFF Revision 6.0. http://partners.adobe.com/public/developer/en/tiff/ TIFF6.pdf.
3. A. Aho, M. Lam, R. Sethi, and J. Ullman. Compilers: Principles, Techniques, and Tools. Addison-Wesley, 2007.
4. S. Bhansali, W.-K. Chen. S. de Jong, A. Edwords, R. Murray. M. Drinic, D. Mihocka, and J. Chau. Framework for instruction-level tracing and analysis of program executions. In Proceedings of the Second International Conference on Virtual Execution Environments, Ottawa, Canada, June 2006.
5. N. Borisov, D. J. Brumley, H. J. Wang, J. Dunagan, P. Joshi, and C. Guo. A Generic Application-Level Protocol Analyzer and its Language. In Proceedings of the 14th Annual Network & Distributed System Security Symposium (NDSS), March 2007.
6. J. Caballero, H. Yin, Z. Liang, and D. Song. Polyglot: Automatic Extraction of Protocol Message Format using Dynamic Binary Analysis. In Proceedings of the 14th ACM Conference on Computer and Communications Security, Alexandria, VA, October 2007.
7. B. Chandra and M. Halldórsson. Greedy local improvement and weighted setpacking. Journal of Algorithms, 39(2):223-240, 2001.
8. M. Christodorescu, N. Kidd, and W.-H. Goh. String analysis for x86 binaries. 6th ACM SIGPLAN-SIGSOFT Workshop on Program Analysis for Software Tools and Engineering (PASTE 2005). 31(1):88-95, 2006.
9. st ACM Symposium on Operating Systems Principles (SOSP), pages 117-130, 2007.
10. M. Costa, J. Crowcroft, M. Castro, and A. Rowstron. Vigilante: End-to-End Containment of Internet Worms. In Proceedings of the Symposium on Systems and Operating Systems Principles (50SF 2005), 2005.
11. J. R. Crandall and F. T. Chong. Minos: Control Data Attack Prevention Orthogonal to Memory Model. In Proceedigns of the 37th Annual IEEE/A CM International Symposium on Microarchitecture (Micro-37), Portland, OR, December 2004.
12. W. Cui, J. Kannan, and H. J. Wang. Discoverer: Automatic Protocol Reverse Engineering from Network Traces. In Proceedings of the 16th USENIX Security Symposium, Boston, MA, August 2007.
13. th Symposium on Network and Distributed System Security (NDSS 2006), February 2006.
14. W. Cui, H. J. Wang, M. Peinado, and M. Locasto. ShieldGen: Automated Data Patch Generation for Unknown Vulnerabilities with Informed Probing. In Proceedings of the 2007 IEEE Symposium on Security and Privacy, May 2007.
15. M. D. Ernst, J. H. Perkins, P. J. Guo, S. McCamant, C. Pacheco, M. S. Tschantz, and C. Xiao. The Daikon System for Dynamic Detection of Likely Invariants. 2007.
16. R. Fielding, J. Gettys, J. Mogul, H. Frystyk, L. Masinter, P. Leach, and T. Berners-Lee. RFC 2616: Hypertext Transfer Protocol-HTTP/1.1. http://www.w3.org/Protocols/rfc2616/rfc2616.html.
17. K. Fisher, D. Walker, K. Q. Zhu, and P. White. From dirt to shovels: Fully automatic tool generation from ad hoc data. In Proceedings of the 35th Annual Symposium on Principles of Programming Languages, January 2008.
18. Gaim Instant Messaging Client. http://gaim.sourceforge.net.
19. P. Godefroid, M. Levin, and D. Molnar. Automated Whitebox Fuzz Testing. In Proceedings of the 15th Annual Network and Distributed System Security Symposium (NDSS), February 2008.
20. T. O. Group. Dcc 1.1: Remote procedure call. http://www.opengroup.org/ onlinepubs/9629399/toc.htm.
21. E. Hazan, S. Safra, and O. Schwartz. On the complexity of approximating k-set packing. Computational Complexity, 15(1):20-39, 2006.
22. J. Kannan, J. Jung, V. Paxson, and C. E. Koksal. Semi-Automated Discovery of Application Session Structure. In Proceedings qf the 2006 Internet Measurement Conference (IMC), Rio de Janeiro, Brazil, October 2006.
23. C. Leita, M. Dacier, and F. Massicotte. Automatic Handling of Protocol Dependencies and Reaction to 0-Day Attacks with ScriptGen based Honeypots. In Proceedings of the 9th International Symposium on Recent Advances in Intrusion Detection, Hamburg, Germany, September 2006.
24. C. Leita, K. Mermoud, and M. Dacier. ScriptGen: An Automated Script Generation Tool for Honeyd. In Proceedings of the 21st Annual Computer Security Applications Conference (ACSAC 2005), December 2005.
25. J. Lim, T. Reps. and B. Liblit. Extracting file formats from executables. In S. E. Sim and M. Di Penta, editors, Proceedings of the 13th Working Conference on Reverse Engineering, Benevento, Italy, Oct. 23-27 2006.
26. Z. Lin, X. Jiang, D. Xu, and X. Zhang. Automatic Protocol Format Reverse Engineering through Context-Aware Monitored Execution. In Proceedings of NDSS'2008, 2008.
27. Z. Lin and X. Zhang. Deriving input syntactic structure from execution. In Proceedings of the 16th ACM SIGSOFT International Symposiumon the Foundations of Software Engineering, November 2008.
28. P. Mockapetris. RFC 1035: Domain Names - Implementation and Specification. http://www.faqs.org/rfc1035.html.
29. th ACM Confrence on Computer and Communications Security (CCS), pages 311-321, 2006.
30. J. Newsome, D. Brumley, and D. Song. Vulnerability-specific execution filtering for exploit prevention on commodity software. In Proceeding of the Network and Distributed System Security Symposium (NDSS), 2006.
31. th Symposium on Network and Distributed System Security (NDSS), February 2005.
32. R. Pang, V. Paxson, R. Somer, and L. Peterson. binpac: A yacc for Writing Application Protocol Parsers. In Proceedings of the 2006 Internet Measurement Conference, October 2006.
33. V. Paxson. Bro: A system for detecting network intruders in real time. Computer Networks, 31 (23):2435-2463, 1999.
34. J. Postel and J. Reynolds. Rfc 959: File transfer protocol (ftp). http://www.faqs.org/rfcs/rfc959.html.
35. The Protocol Informatics Project. http://www.baselineresearch.net/PI/.
36. How Samba Was Written. http://samba.org/ftp/tridge/misc/french-cafe.txt.
37. K. Sollins. Rfc 1350: The tftp protocol (revision 2). http://www.faqs.org/rfcs/rfc1350.html.
38. th International Conference on Architectural Support for Programming Languages and Operating Systems (ASPLOS-XI), October 2004.
39. T. Swan. Inside Windows Pile Formats. Sams Publishing, 1993.
40. T. Boutell, et. al. RFC 2083: PNG (Portable Network Graphics) Specification. http://www.faqs.org/rfc2083.html.
41. H. J. Wang, C. Guo, D. R. Simon, and A. Zugenmaier. Shield: Vulnerability-Driven Network Filters for Preventing Known Vulnerability Exploits. In Proceedings of the ACM SIGCOMM, August 2004.
42. G. Wondracek, C. Kruegel, E. Kirda, and P. Milani. Automatic Network Protocol Analysis. In Proceedings of the 15th Annual Network and Distributed System Security Symposium (NDSS), February 2008.