A Stack Memory Abstraction and Symbolic Analysis Framework for Executables

doi:10.1145/2897511

A Stack Memory Abstraction and Symbolic Analysis Framework for Executables

2016-04-27

2

PRE

AI

DOI：10.1145/2897511

原文求助

摘要

En 中文

This article makes three contributions regarding reverse-engineering of executables. First, techniques are presented for recovering a precise and correct stack-memory model in executables while addressing executable-specific challenges such as indirect control transfers. Next, the enhanced memory model is employed to define a novel symbolic analysis framework for executables that can perform the same types of program analyses as source-level tools. Third, a demand-driven framework is presented to enhance the scalability of the symbolic analysis framework. Existing symbolic analysis frameworks for executables fail to simultaneously maintain the properties of correct representation, a precise stack-memory model, and scalability. Furthermore, they ignore memory-allocated variables when defining symbolic analysis mechanisms. Our methods do not use symbolic, relocation or debug information, which are usually absent in deployed binaries. We describe our framework, highlighting the novel intellectual contributions of our approach and demonstrating its efficacy and robustness. Our techniques improve the precision of existing stack-memory models by 25%, enhance scalability of our basic symbolic analysis mechanism by 10x, and successfully uncovers five previously undiscovered information-flow vulnerabilities in several widely used programs.

Keyword:

Executable code

program analysis

information-flow security

A Stack Memory Abstraction and Symbolic Analysis Framework for Executables

摘要

AI总结

期刊

机构