Analyzing Memory Accesses in x86 Executables

Abstract

This paper concerns static-analysis algorithms for analyzing x86 executables. The aim of the work is to recover intermediate representations that are similar to those that can be created for a program written in a high-level language. Our goal is to perform this task for programs such as plugins, mobile code, worms, and virus-infected code. For such programs, symbol-table and debugging information is either entirely absent, or cannot be relied upon if present; hence, the technique described in the paper makes no use of symboltable/debugging information. Instead, an analysis is carried out to recover information about the contents of memory locations and how they are manipulated by the executable.

Network-level polymorphic shellcode detection using emulation

“…In such cases, recursive traversal also does not provide an accurate disassembly, and thus, an attacker could use indirect branches extensively to hinder it. Although some advanced static analysis methods can heuristically recover the targets of indirect branches, e.g., when used in jump tables, they are effective only with compiled code and well-structured binaries [36,38,41,42]. A motivated attacker can construct highly obfuscated code that abuses any assumptions about the structure of the code, including the extensive use of indirect branch instructions, which impedes both disassembly methods.…”

Dytaint: The implementation of a novel lightweight 3-state dynamic taint analysis framework for x86 binary programs

“…Its target is achieved during the process of statically translating the binary code into the SSA (Static Single Assignment) form. When the symbol table and debugging information are either entirely absent, or cannot be relied upon, value-set analysis, a static analysis algorithm proposed in (Balakrishnan and Reps, 2004), first recovers the contents of the memory locations and how they are manipulated from the x86 executables. Then, it translates the x86 binary codes onto an IR which can facilitate the work of vulnerability detection and prevention.…”

Probabilistic Alias Analysis of Executable Code

“…Their method considered register values and the contents stored at memory objects at the same time, and produced accurate results. Balakrishnan and Reps [4] described a static-analysis algorithm for x86 executables that tracked the values that data objects in a program can hold. The global, local, and heap memory regions and a-locs were used to locate data objects.…”