Bird: Binary interpretation using runtime disassembly

Proceedings of the CGO 2006 - The 4th International Symposium on Code Generation and Optimization

Volumn , Issue , 2006, Pages 359-370

  Nanda, Susanta ^a   Li, Wei ^a   Lam, Lap Chung ^a   Chiueh, Tzi Cker ^a  

^a Stony Brook University   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

BIRDS; CODES (SYMBOLS); PROGRAM DEBUGGING; SEMANTICS; THROUGHPUT; WINDOWS OPERATING SYSTEM;

DISTRIBUTED APPLICATIONS; DYNAMIC DISASSEMBLIES; EXECUTION SEMANTICS; INSTRUMENTATION CODE; PROGRAM TRANSFORMATIONS; SECURITY ENHANCING; SECURITY VULNERABILITIES; SERVER APPLICATIONS;

SOFTWARE PROTOTYPING;

EID: 84886067644     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/CGO.2006.6     Document Type: Conference Paper

References (31)

1. Microsoft msdn library. http://msdn.microsoft.com/library/.
2. phrack. http://www.phrack.org/.
3. V. Bala, E. Duesterwald, and S. Banerjia. Dynamo: a transparent dynamic optimization system. ACM SIGPLAN Notices, 35(5): 1-12, 2000.
4. Bochs. Bochs: The cross platform ia-32 emulator. http://bochs. sourceforge.net/, 2001.
5. B.R.Buck and J.K.Hollingsworth. An api for runtime code patching. Journal of High Performance Computing Applications, 14(4): 317-329, 2000.
6. D. Bruening, E. Duesterwald, and S. Amarasinghe. Design and implementation of a dynamic optimization framework for windows. In 4th ACM Workshop on Feedback-Directed and Dynamic Optimization (FDDO-4), December 2000.
7. C. Cifuentes and M. V. Emmerik. Recovery of jump table case statements from binary code. In IWPC '99: Proceedings of the 7th International Workshop on Program Comprehension, page 192,Washington, DC, USA, 1999. IEEE Computer Society.
8. C. Cifuentes, M. V. Emmerik, D. S. D Ung, and T. Waddington. Preliminary experiences with the use of the uqbt binary translation framework. In Proceedings of the Workshop on Binary Translation, 10 1999.
9. P. Dabak, M. Borate, and S. Phadke. Undocumented Windows NT. M and T Books, October 1999.
10. C. C. et al. StackGuard: Automatic Adaptive Detection and Prevention of Buffer-overflow Attacks. In 7th USENIX Security Symposium, 1998.
11. T. R. et al. Instrumentation and optimization of win32/intel executables using etch, 1997.
12. G. S. Kc, A. D. Keromytis, and V. Prevelakis. Countering code-injection attacks with instruction-set randomization. In Proceedings of the 10th ACM conference on Computer and communications security, pages 272-280. ACM Press, 2003.
13. V. Kiriansky, D. Bruening, and S. Amarasinghe. Secure execution via program shepherding. In 11th USENIX Security Symposium, 2002.
14. C. Kruegel, W. Robertson, F. Valeur, and G. Vigna. Static disassembly of obfuscated binaries. In USENIX Security Symposium 2004, pages 255-270.
15. L. Lam and T. Chiueh. Automatic extraction of accurate application-specific sandboxing policy. In Seventh International Symposium on Recent Advances in Intrusion Detection, September 2004.
16. J. R. Larus and E. Schnarr. EEL: Machine-independent executable editing. In SIGPLAN Conference on Programming Language Design and Implementation, pages 291-300, 1995.
17. C. Linn and S. Debray. Obfuscation of executable code to improve resistance to static disassembly. In CCS '03: Proceedings of the 10th ACM conference on Computer and communications security, pages 290-299. ACM Press, 2003.
18. C.-K. Luk, R. Cohn, R. Muth, H. Patil, A. Klauser, G. Lowney, S. Wallace, V. J. Reddi, and K. Hazelwood. Pin: building customized program analysis tools with dynamic instrumentation. In PLDI '05: Proceedings of the 2005 ACM SIGPLAN conference on Programming language design and implementation, pages 190-200, New York, NY, USA, 2005. ACM Press.
19. J. Maebe, M. Ronsse, and K. D. Bosschere. Diota: Dynamic instrumentation, optimization and transformation of applications. In Proceedings of the 4th Workshop on Binary Translation, 2002.
20. N. Nethercote and J. Seward. Valgrind: A program supervision framework. Electronic Notes in Theoretical Computer Science, 89(2), 2003.
21. Plex86. Plex86 x86 virtual machine. http://savannah.nongnu.org/projects/ plex86.
22. M. Prasad and T. cker Chiueh. A binary rewriting defense against stack-based buffer overflow attacks. In USENIX Annual Technical Conference, pages 211-224, 2003.
23. B. Schwarz, S. Debray, and G. Andrews. Plto: A link-time optimizer for the intel ia-32 architecture. In Proc. 2001Workshop on Binary Translation (WBT-2001), Sept 2001.
24. B. Schwarz, S. Debray, and G. Andrews. Disassembly of executable code revisited. In WCRE '02: Proceedings of the Ninth Working Conference on Reverse Engineering (WCRE'02), page 45. IEEE Computer Society, 2002.
25. K. Scott and J. Davidson. Strata: A software dynamic translation infrastructure. In Proceedings of the 2001 Workshop on Binary Translation, 2001.
26. K. Scott, J. Davidson, and K. Skadron. Low-overhead software dynamic translation. Technical Report CS-2001-18, July 2001.
27. A. Srivastava, A. Edwards, and H. Vo. Vulcan: Binary Transformation in a Distributed Environment. Technical Report MSR-TR-2001-50, 2001.
28. A. Srivastava and A. Eustace. Atom: a system for building customized program analysis tools. SIGPLAN Not., 39(4): 528-539, 2004.
29. A. Srivastava and D. W. Wall. A practical system for intermodule code optimization at link-time. Journal of Programming Languages, 1(1): 1-18, December 1992.
30. UPX. the ultimate packer for executables. http://upx.sourceforge.net/.
31. E. Witchel and M. Rosenblum. Embra: Fast and flexible machine simulation. In Measurement and Modeling of Computer Systems, pages 68-79, 1996.