Recovery of Class Hierarchies and Composition Relationships from Machine Code

Srinivasan, Venkatesh; Reps, Thomas

doi:10.1007/978-3-642-54807-9_4

Cited by 13 publications

(4 citation statements)

References 15 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…After that, Lee et al [29] proposed a new method on the basis of REWARDS, they transformed the assembly language into the intermediate language BIL and completed the type inference by combining dynamic and static analysis. Srinivasan et al [30] presented a reverse-engineering tool (called Lego), which utilized information obtained from dynamic analysis and relationship about inheritance, to recover class hierarchies and composition relationships from stripped binaries.…”

Section: Related Workmentioning

confidence: 99%

“…The purpose of the data type recognition is to determine the data type (e.g., string or pointer) to which each byte of the data segment belongs. Some researchers have conducted research on type recognition [26]- [30]. Current type recognition tools usually depend on code segment heuristics or dynamic analysis whereas firmware analysis often lacks the dynamic analysis environment.…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Recognizing the Data Type of Firmware Data Segments With Deep Learning

Xiao¹,

Zhu²,

Lu³

et al. 2020

IEEE Access

View full text Add to dashboard Cite

Data segment analysis is of great value for firmware analysis. The data segment contains abundant information such as pointers and strings which is helpful for accelerating the process of code segment analysis. In this paper, we propose a novel approach of applying deep learning to solve the problem of data type identification in data segments, that is a fundamental problem in data segment analysis. We define 3 data types of data segment, then design several data segment byte feature extraction methods to construct feature sequences, and finally present a deep learning-based approach with feature sequences as input to recognize the data type byte by byte. Then, the recognized type can be further corrected efficiently by prior knowledge. Based on the data segment of a firmware, we built a dataset that included 18,032,352 samples (in bytes of data segment). We implement a prototype system and evaluate it with our dataset, then determine reasonable models and hyperparameters through several experiments, and eventually confirm that deep learning techniques are suitable for identifying the data type in data segment. Kappa coefficient of our data type recognition reached 0.96 and the models can be retained quickly. Using 131,072 samples in our dataset for 32 seconds of training, the accuracy can reach 90%; the accuracy can reach 97% with 273 seconds of training and 950,272 samples. Furthermore, our approach has higher accuracy than IDA in string recognition. In experiments, the recall and precision of our approach reached 96.5% and 90% respectively, whereas corresponding results of IDA is 92.9% and 85.7%. In addition, we selected 8 open source software to compile and test, and compared the detection results with TypeMiner. Experiments show that our method has certain cross-platform and operating system capabilities, and performs better than TypeMiner on some software.INDEX TERMS Reverse engineering, binary analysis, data segment, data type recognition, deep learning.

show abstract

Section: Related Workmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Recognizing the Data Type of Firmware Data Segments With Deep Learning

Xiao¹,

Zhu²,

Lu³

et al. 2020

IEEE Access

View full text Add to dashboard Cite

show abstract

“…We define the helper function voterIndex (lines 19-26), which returns the index of the voter in the poll table. We also created the function isRegistered (lines [15][16][17] to determine whether the user was registered to vote by using the voterIndex function. Since array indexes in Solidity are unsigned integers (uint), we need to explicitly convert it to a regular integer (line 22 The rest of the contract defines the following functions:…”

Section: A Poll Smart Contractmentioning

confidence: 99%

“…Srinivasan and Reps [15] developed a reverse engineering tool to recover class hierarchical information from a binary program file. Their tool also extracts composition relationships as well.…”

Section: B Reverse Engineeringmentioning

confidence: 99%

SmartInspect: solidity smart contract inspector

Bragagnolo

Rocha

Denker

et al. 2018

2018 International Workshop on Blockchain Oriented Software Engineering (IWBOSE)

View full text Add to dashboard Cite

Solidity is a language used for smart contracts on the Ethereum blockchain. Smart contracts are embedded procedures stored with the data they act upon. Debugging smart contracts is a really difficult task since once deployed, the code cannot be reexecuted and inspecting a simple attribute is not easily possible because data is encoded. In this paper, we address the lack of inspectability of a deployed contract by analyzing contract state using decompilation techniques driven by the contract structure definition. Our solution, SmartInspect, also uses a mirror-based architecture to represent locally object responsible for the interpretation of the contract state. SmartInspect allows contract developers to better visualize and understand the contract stored state without needing to redeploy, nor develop any ad-hoc code.

show abstract