Differentiating code from data in x86 binaries

Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)

Volumn 6913 LNAI, Issue PART 3, 2011, Pages 522-536

  Wartell, Richard ^a   Zhou, Yan ^a   Hamlen, Kevin W ^a   Kantarcioglu, Murat ^a   Thuraisingham, Bhavani ^a  

^a UNIVERSITY OF TEXAS AT DALLAS   (United States)

Author keywords

classification; segmentation; statistical data compression; x86 binary disassembly

Indexed keywords

BREAKING POINT; CODE ANALYSIS; DISASSEMBLERS; LANGUAGE MODEL; MALWARE ANALYSIS; MINIMUM CROSS ENTROPY; REFERENCE MONITORS; SOFTWARE FAULT; STATISTICAL DATAS; X86 BINARY DISASSEMBLY;

ALGORITHMS; COMPUTATIONAL LINGUISTICS; LEARNING SYSTEMS; REVERSE ENGINEERING; STATISTICS;

DATA COMPRESSION;

EID: 80052400545     PISSN: 03029743     EISSN: 16113349     Source Type: Book Series    
DOI: 10.1007/978-3-642-23808-6_34     Document Type: Conference Paper

References (16)

1. Balakrishnan, G., Gruian, R., Reps, T., Teitelbaum, T.: CodeSurfer/x86 - a platform for analyzing x86 executables. In: Proceedings of the 14th International Conference on Compiler Construction (CC), pp. 250-254 (2005)
2. Bratko, A., Cormack, G.V., Filipič, B., Lynam, T.R., Zupan, B.: Spam filtering using statistical data compression models. Journal of Machine Learning Research 7, 2673-2698 (2006)
3. Cleary, J.G., Teahan, W.J.: Unbounded length contexts for PPM. The Computer Journal 40(2/3), 67-75 (1997)
4. Cleary, J.G., Witten, I.H.: Data compression using adaptive coding and partial string matching. IEEE Transactions on Communications 32(4), 396-402 (1984)
5. Cormack, G.V., Horspool, R.N.: Data compression using dynamic Markov modeling. The Computer Journal 30(6), 541-550 (1987)
6. Eagle, C.: The IDA Pro Book: The Unofficial Guide to the World's Most Popular Disassembler. No Starch Press, Inc., San Francisco (2008)
7. Erdélyi, G.: IDAPython: User scripting for a complex application. Bachelor's thesis, EVTEK University of Applied Sciences (2008)
8. Hamlen, K.W., Mohan, V., Wartell, R.: Reining in Windows API abuses with inlined reference monitors. Tech. Rep. UTDCS-18-10, The University of Texas at Dallas, Richardson, Texas (June 2010)
9. Hex-Rays: The IDA Pro disassembler and debugger (2011), www.hex-rays.com/idapro
10. Hunt, G., Brubacher, D.: Detours: Binary interception of Win32 functions. In: Proceedings of the 3rd USENIX Windows NT Symposium (WINSYM), pp. 14-21 (1999)
11. Intel: Intel® 64 and IA-32 Architectures Software Developer's Manual, vol. 2A & 2B: Instruction Set Reference. Intel Corporation (2011)
12. Kinder, J., Veith, H.: Jakstab: A static analysis platform for binaries. In: Gupta, A., Malik, S. (eds.) CAV 2008. LNCS, vol. 5123, pp. 423-427. Springer, Heidelberg (2008)
13. Kinder, J., Zuleger, F., Veith, H.: An abstract interpretation-based framework for control flow reconstruction from binaries. In: Jones, N.D., Müller-Olm, M. (eds.) VMCAI 2009. LNCS, vol. 5403, pp. 214-228. Springer, Heidelberg (2009)
14. Moffat, A., Turpin, A.: Compression and Coding Algorithms. Kluwer Academic Publishers, Boston (2002)
15. Teahan, W.J., Wen, Y., McNab, R.J., Witten, I.H.: A compression-based algorithm for Chinese word segmentation. Computational Linguistics 26(3), 375-393 (2000)
16. Teahan, W.J.: Text classification and segmentation using minimum cross-entropy. In: Proceedings of the 6th International Conference on Computer-Assisted Information Retrieval (RIAO), pp. 943-961 (2000)