Stack Analysis of x 86 Executables ⋆
نویسندگان
چکیده
Binary rewriting is becoming increasingly popular for a variety of low-level code manipulation purposes. One of the difficulties encountered in this context is that machine-language programs typically have much less semantic information compared to source code, which makes it harder to reason about the program’s runtime behavior. This problem is especially acute in the widely used Intel x86 architecture, where the paucity of registers often makes it necessary to store values on the runtime stack. The use of memory in this manner affects many analyses and optimizations because of the possibility of indirect memory references, which are difficult to reason about. This paper describes a simple analysis of some basic aspects of the way in which programs manipulate the runtime stack. The information so obtained can be very helpful in enhancing and improving a variety of other dataflow analyses that reason about and manipulate values stored on the runtime stack. Experiments indicate that the analyses are efficient and useful for improving optimizations that need to reason about the runtime stack.
منابع مشابه
ii DEDICATION To my parents and my sister .
RAMACHANDRAN, SHANKAR. Stack Space Analysis for ARM Executables. (Under the direction of Dr. Alexander Dean). Bounding maximum stack depth for embedded system applications is essential in order to avoid conditions such as stack overflow. Stack usage information is useful for allocating the stack into a memory hierarchy. Prior work in stack space analysis addresses specific issues such as handli...
متن کاملA compiler level intermediate representation based binary analysis system and its applications
Title of Dissertation: A COMPILER LEVEL INTERMEDIATE REPRESENTATION BASED BINARY ANALYSIS SYSTEM AND ITS APPLICATIONS Kapil Anand, Doctor of Philosophy, 2013 Dissertation directed by: Professor Rajeev Barua Department of Electrical and Computer Engineering Analyzing and optimizing programs from their executables has received a lot of attention recently in the research community. There has been ...
متن کاملRethinking Antivirus: Executable Analysis in the Network Cloud
Antivirus software installed on each end host in an organization has become the de-facto security mechanism used to defend against unwanted executables. We argue that the executable analysis currently provided by hostbased antivirus software can be more efficiently and effectively provided as an in-cloud network service. Instead of running complex analysis software on every end host, we suggest...
متن کاملAnalyzing Memory Accesses in Obfuscated x86 Executables
Programmers obfuscate their code to defeat manual or automated analysis. Obfuscations are often used to hide malicious behavior. In particular, malicious programs employ obfuscations of stack-based instructions, such as call and return instructions, to prevent an analyzer from determining which system functions it calls. Instead of using these instructions directly, a combination of other instr...
متن کاملAdaptable Static Analysis of Executables for proving the Absence of Vulnerabilities
essential when representing program states where a memory region (a stack frame or heap cell) may or may not exist. No matter how precise an analysis is, a code auditor may have to deal with a large number of warnings when analyzing large programs. In order to improve the usability of the analyzer, we detail how combining static and dynamic analysis allows an auditor to focus the analyzer on po...
متن کامل