期刊
CHINA COMMUNICATIONS
卷 11, 期 9, 页码 135-147出版社
CHINA INST COMMUNICATIONS
DOI: 10.1109/CC.2014.6969778
关键词
software security; reversing engineering; fine-grained dynamic tainting
资金
- National Natural Science Foundation of China [61303213, 61303212, 61373168, 61373169, 61332019]
- foundation of State Key Lab. for Novel Software Technology in Nanjing University
- foundation of Key Laboratory of Information Assurance Technology [KJ-13-104]
Reversing the syntactic format of program inputs and data structures in binaries plays a vital role for understanding program behaviors in many security applications. In this paper, we propose a collaborative reversing technique by capturing the mapping relationship between input fields and program data structures. The key insight behind our paper is that program uses corresponding data structures as references to parse and access different input fields, and every field could be identified by reversing its corresponding data structure. In details, we use a fine-grained dynamic taint analysis to monitor the propagation of inputs. By identifying base pointers for each input byte, we could reverse data structures and conversely identify fields based on their referencing data structures. We construct several experiments to evaluate the effectiveness. Experiment results show that our approach could effectively reverse precise input formats, and provide unique benefits to two representative security applications, exploit diagnosis and malware analysis.
作者
我是这篇论文的作者
点击您的名字以认领此论文并将其添加到您的个人资料中。
推荐
暂无数据