Structured binary editing with a CFG transformation algebra

Proceedings - Working Conference on Reverse Engineering, WCRE

Volumn , Issue , 2012, Pages 9-18

  Bernat, Andrew R ^a   Miller, Barton P ^a  

^a University of Wisconsin   (United States)

Author keywords

binary editing; binary modification; binary validity; graph transformations

Indexed keywords

BINARY ANALYSIS; BINARY EDITING; BINARY MODIFICATION; BINARY VALIDITY; CONTROL FLOW GRAPHS; CONTROL FLOWS; DEBUGGING INFORMATION; DYNINST; GRAPH TRANSFORMATION; HIGH-LEVEL ABSTRACTION; INSTRUCTION SET; PROGRAM BINARY; SOURCE CODES;

ALGEBRA; DATA FLOW ANALYSIS; REVERSE ENGINEERING;

PROGRAM DEBUGGING;

EID: 84872308514     PISSN: 10951350     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/WCRE.2012.11     Document Type: Conference Paper

References (31)

1. X. Zhang, N. Gupta, and R. Gupta, "Locating faults through automated predicate switching," in International Conference on Software Engineering (ICSE), Shanghai, China, May 2006.
2. N. Loriant, M. Ségura-Devillechaise, and J. Menaud, "Server protection through dynamic patching," in Pacific Rim International Symposium on Dependable Computing (PRDC), Changsha, Hunan, China, December 2005.
3. D. Bruening, T. Garnett, and S. Amarasinghe, "An infrastructure for adaptive dynamic optimization," in First Annual International Symposium on Code Generation and Optimization, San Francisco, CA, USA, March 2003.
4. B. P. Miller, M. Callaghan, J. Cargille, J. Hollingsworth, B. Irvin, K. Kar-avanic, K. Kunchithapadam, and T. Newhall, "The Paradyn parallel performance measurement tool," IEEE Computer, vol. 28, no. 11, pp. 37-46, November 1995.
5. J. Newsome, D. Brumley, D. Song, J. Chamcham, and X. Kovah, "Vulnerability-specific execution filtering for exploit prevention on commodity software," in 13th Annual Network and Distributed Systems Security Symposium, San Diego, CA, USA, February 2006.
6. W. Drewry and T. Ormandy, "Flayer: exposing application internals," in Workshop on Offensive Technologies (WOOT), Boston, MA, USA, August 2007.
7. A. Moser, C. Kruegel, and E. Kirda, "Exploring multiple execution paths for malware analysis," in Security and Privacy (SP), Oakland, CA, USA, May 2007.
8. C. Willems, T. Holz, and F. Freiling, "Toward automated dynamic malware analysis using cwsandbox," in Security and Privacy (SP), Oakland, CA, USA, March 2007.
9. H. Pan, K. Asanović, R. Cohn, and C.-K. Luk, "Controlling program execution through binary instrumentation," SIGARCH Computer Architecture News, vol. 33, pp. 45-50, December 2005. [Online]. Available: http://doi.acm.org/10.1145/1127577.1127587
10. N. Nethercote and J. Seward, "Valgrind: A framework for heavyweight dynamic binary instrumentation," in Programming Language Design and Implementation (PLDI), San Diego, CA, USA, June 2007.
11. R. Heckel, "Graph transformation in a nutshell," in Electronic Notes in Theoretical Computer Science. Elsevier, 2006, pp. 187-198.
12. M. Andries, G. Engels, A. Habel, B. Hoffmann, H. Kreowski, S. Kuske, D. Plump, A. Schürr, and G. Taentzer, "Graph transformation for specification and programming," Science of Computer Programming, vol. 34, pp. 1-54, 1996.
13. Paradyn Project, "PatchAPI: An application program interface for binary patching," 2012.
14. B. Buck and J. Hollingsworth, "An API for runtime code patching," Journal of High Performance Computing Applications, vol. 14, no. 4, pp. 317-329, Winter 2000.
15. K. Van Put, B. De Sutter, M. Madou, B. De Bus, D. Chanet, K. Smits, and K. De Bosschere, "Lancet: A nifty code editing tool," in Program Analysis for Software Tools and Engineering (PASTE), Lisbon, Portugal, September 2005.
16. B. De Bus, B. De Sutter, L. Van Put, D. Chanet, and K. De Bosschere, "Link-time optimization of ARM binaries," in ACM Conference on Languages, Compilers, and Tools (SIGPLAN/SIGBED), Washington, D.C., June 2004.
17. C. Lattner and V. Adve, "LLVM: A compilation framework for lifelong program analysis & transformation," in International Symposium on Code Generation and Optimization (CGO), Palo Alto, CA, USA, March 2004.
18. R. Wilson, R. French, C. Wilson, A. S., J. Anderson, S. Tjiang, S. Liao, C. Tseng, M. Hall, M. Lam, and J. Hennessy, "SUIF: An infrastructure for research on parallelizing and optimizing compilers," ACM SIGPLAN Notices, vol. 29, 1994.
19. C. K. Luk, R. Cohn, R. Muth, H. Patil, A. Klauser, G. Lowney, S. Wallace, V. J. Reddi, and K. Hazelwood, "PIN: building customized program analysis tools with dynamic instrumentation," in Programming Language Design and Implementation (PLDI), Chicago, IL, USA, June 2005.
20. Paradyn Project, "ParseAPI: An application program interface for binary parsing," 2012. [Online]. Available: http://www.paradyn.org/html/ parse7.0.1-features.html
21. C. Cifuentes and K. Gough, "Decompilation of binary programs," Software-Practice & Experience, vol. 25, no. 7, pp. 811-829, July 1995.
22. B. Schwarz, S. Debray, and G. Andrews, "Disassembly of executable code revisited," in IEEE 9th Working Conference on Reverse Engineering, Richmond, VA, USA, October 2002.
23. C. Cifuentes and M. Emmerik, "Recovery of jump table case statements from binary code," in International Workshop on Program Comprehension, Pittsburgh, PA, USA, May 1999.
24. L. Harris and B. P. Miller, "Practical analysis of stripped binary code," in Workshop on Binary Instrumentation and Applications, St. Louis, MO, USA, September 2005.
25. K. A. Roundy and B. P. Miller, "Hybrid analysis and control of malware binaries," in Recent Advances in Intrusion Detection (RAID), Ottawa, Canada, September 2010.
26. G. Balakrishnan and T. Reps, "Analyzing memory accesses in x86 executables," in International Conference on Compiler Construction, New York, NY, USA, April 2004.
27. A. Kiss, J. Jasz, G. Lehotai, and T. Gyimothy, "Interprocedural static slicing of binary executables," in Source Code Analysis and Manipulation, Amsterdam, The Netherlands, September 2003.
28. P. Saxena, P. Poosankam, S. McCamant, and D. Song, "Loop-extended symbolic execution on binary programs," in 18th International Symposium on Software Testing and Analysis (ISSTA), Chicago, IL, USA, March 2009.
29. Apache Project, "Apache httpd daemon," November 2011. [Online]. Available: http://www.apache.org
30. National Vulnerability Database, November 2011. [Online]. Available: http://web.nvd.nist.gov/
31. Paradyn Project, "DynC: An instrumentation language for specifying snippets," 2012. [Online]. Available: http://www.paradyn.org/html/dync1.0- features.html