Implementation of an effective dynamic concolic execution framework for analyzing binary programs

Zhu, En; Wen, Peng; Ni, Kanqi; Ma, Ruhui

doi:10.1016/j.cose.2019.05.018

Cited by 2 publications

(1 citation statement)

References 41 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Actually, dynamic binary instrumentation is widely used in malicious code analysis, program security analysis, software protection and other fields [18] [19][20] [21] [22], and lots of ideas and methods for program analysis are implemented and verified based on it [33][34] [35] [37]. Although it faces some problems and challenges in practical applications, such as: affecting the runtime performance of the program, occupying large amount of memory resources, and confronting the anti-analysis techniques [4] [23], it is still worth us to take countermeasures to make it effective in the actual analysis scenario [4] [7].…”

Section: Introductionmentioning

confidence: 99%

Lightweight and Efficient Hypervisor-Based Dynamic Binary Instrumentation and Analysis Method

et al. 2020

View full text Add to dashboard Cite

At present, various vulnerabilities and malicious programs are still constantly threatening the system security, and in-depth analysis of legitimate applications and malicious code is an important link of security defense under the current security situation. Dynamic binary analysis is the important method in the field of binary analysis, and after years of research and development, many valuable results have been achieved, and some mature tools generated have been widely used in practice. But it still faces multiple challenges in terms of analysis efficiency, deployment, and the impact on the target program. Based on the existing research, this paper proposes a new lightweight hypervisor-based dynamic binary instrumentation method, which uses the virtualization features of new processors to perform transparent and efficient execution interception of the target program, so that it can instrument the target program and redirect the original execution. To take full advantage of the interception solution, we further present a compact inline dynamic taint analysis method that enables fine-grained data flow analysis of the target program with multiple processes and kernel modules. Experiments in the real environment show that the proposed method is effective and efficient in the binary instrumentation and analysis, it can achieve a good balance in analysis performance, availability and stealthiness, and can be applied to the practical analysis scenarios.

show abstract