UQBT: adaptable binary translation at low cost

Cifuentes, Cristina; Emmerik, M. Van

doi:10.1109/2.825697

Cited by 99 publications

(58 citation statements)

References 9 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Also, since program binaries can be instrumented [4,20], we can avoid requiring program source code. While this approach remains subject to the limitations of dynamic information, it can yield impact sets that are more accurate relative to a specific operational profile.…”

Section: Dynamic Whole Program Path-based Impact Analysismentioning

confidence: 99%

Whole program path-based dynamic impact analysis

Law

Rothermel

2003

25th International Conference on Software Engineering, 2003. Proceedings.

182

220

View full text Add to dashboard Cite

show abstract

Section: Dynamic Whole Program Path-based Impact Analysismentioning

confidence: 99%

Whole program path-based dynamic impact analysis

Law

Rothermel

2003

25th International Conference on Software Engineering, 2003. Proceedings.

182

220

View full text Add to dashboard Cite

show abstract

“…When the branch targets are not obvious due to obfuscations, then it is not trivial to determine control flow. To address this issue, an extension called speculative disassembly was proposed by Cifuentes et al [12], which as the name suggests attempts to determine via a linear sweep style disassembly whether a portion of the byte stream could be a potential control flow target. This is similar to our approach since the main idea is to reason whether a stream of bytes can be executable code.…”

Section: Related Workmentioning

confidence: 99%

A Fast Static Analysis Approach to Detect Exploit Code Inside Network Flows

Chinchani

Berg²

2006

Lecture Notes in Computer Science

103

View full text Add to dashboard Cite

Abstract.A common way by which attackers gain control of hosts is through remote exploits. A new dimension to the problem is added by worms which use exploit code to self-propagate, and are becoming a commonplace occurrence. Defense mechanisms exist but popular ones are signature-based techniques which use known byte patterns, and they can be thwarted using polymorphism, metamorphism and other obfuscations. In this paper, we argue that exploit code is characterized by more than just a byte pattern because, in addition, there is a definite control and data flow. We propose a fast static analysis based approach which is essentially a litmus test and operates by making a distinction between data, programs and program-like exploit code. We have implemented a prototype called styx and evaluated it against real data collected at our organizational network. Results show that it is able to detect a variety of exploit code and can also generate very specific signatures. Moreover, it shows initial promise against polymorphism and metamorphism.

show abstract

“…To handle this problem, some systems, e.g., the UQBT binary translation system [5], resort to "speculative disassembly." The idea is to process undisassembled portions of the text segment that appear to be code, in the expectation that they might be the targets of indirect function calls; a "speculative bit" is set when this is done, and speculative disassembly of a particular region of memory is abandoned if an invalid instruction is encountered.…”

Section: Recursive Traversalmentioning

confidence: 99%

Obfuscation of executable code to improve resistance to static disassembly

Linn

Debray

2003

Proceedings of the 10th ACM Conference on Computer and Communications Security

330

126

View full text Add to dashboard Cite

A great deal of software is distributed in the form of executable code. The ability to reverse engineer such executables can create opportunities for theft of intellectual property via software piracy, as well as security breaches by allowing attackers to discover vulnerabilities in an application. The process of reverse engineering an executable program typically begins with disassembly, which translates machine code to assembly code. This is then followed by various decompilation steps that aim to recover higher-level abstractions from the assembly code. Most of the work to date on code obfuscation has focused on disrupting or confusing the decompilation phase. This paper, by contrast, focuses on the initial disassembly phase. Our goal is to disrupt the static disassembly process so as to make programs harder to disassemble correctly. We describe two widely used static disassembly algorithms, and discuss techniques to thwart each of them. Experimental results indicate that significant portions of executables that have been obfuscated using our techniques are disassembled incorrectly, thereby showing the efficacy of our methods.

show abstract

UQBT: adaptable binary translation at low cost

Abstract: Figure 5. UQBT uses PAL to perform parameter analysis of (a) a sequence of Sparc RTLs, to produce (b) HRTL code. From the HRTL, UQBT can generate code for other processors.

Cited by 99 publications

References 9 publications

Whole program path-based dynamic impact analysis

Whole program path-based dynamic impact analysis

A Fast Static Analysis Approach to Detect Exploit Code Inside Network Flows

Obfuscation of executable code to improve resistance to static disassembly

Contact Info

Product

Resources

About