NDLI: Context-sensitive analysis of obfuscated x86 executables

Please wait, while we are loading the content...

Corrective hints for type incorrect generic Java programs

PET: a partial evaluation-based test case generation tool for Java bytecode

Optimizing generics is easy!

Regular approximation and bounded domains for size-change termination

Optimizing relational algebra operations using generic equivalence discriminators and lazy products

I/O guided detection of list catamorphisms: towards problem specific use of program templates in IP

Clone detection and elimination for Haskell

Context-sensitive analysis of obfuscated x86 executables

The SourceGraph program

O, partial evaluator, where art thou?

Mnemonics: type-safe bytecode generation at run time

IGOR2 - an analytical inductive functional programming system: tool demo

A fold/unfold transformation framework for rewrite theories extended to CCT

A3PAT, an approach for certified automated termination proofs

Programming with singular and plural non-deterministic functions

Bridging the gap between symbolic and efficient AES implementations

Making "stricterness" more relevant

Conditional weighted pushdown systems and applications

From higher-order logic to Haskell: there and back again

General purpose languages should be metalanguages

Context-sensitive analysis of obfuscated x86 executables

Content Provider	ACM Digital Library
Author	Lakhotia, Arun Boccardo, Davidson R. Manacero, Aleardo Singh, Anshuman
Abstract	A method for context-sensitive analysis of binaries that may have obfuscated procedure call and return operations is presented. Such binaries may use operators to directly manipulate stack instead of using native call and ret instructions to achieve equivalent behavior. Since definition of context-sensitivity and algorithms for context-sensitive analysis have thus far been based on the specific semantics associated to procedure call and return operations, classic interprocedural analyses cannot be used reliably for analyzing programs in which these operations cannot be discerned. A new notion of context-sensitivity is introduced that is based on the state of the stack at any instruction. While changes in `calling'-context are associated with transfer of control, and hence can be reasoned in terms of paths in an interprocedural control flow graph (ICFG), the same is not true of changes in 'stack'-context. An abstract interpretation based framework is developed to reason about stack-contexts and to derive analogues of call-strings based methods for the context-sensitive analysis using stack-context. The method presented is used to create a context-sensitive version of Venable et al.'s algorithm for detecting obfuscated calls. Experimental results show that the context-sensitive version of the algorithm generates more precise results and is also computationally more efficient than its context-insensitive counterpart.
Starting Page	131
Ending Page	140
Page Count	10
File Format	PDF
ISBN	9781605587271
DOI	10.1145/1706356.1706381
Language	English
Publisher	Association for Computing Machinery (ACM)
Publisher Date	2010-01-19
Publisher Place	New York
Access Restriction	Subscribed
Subject Keyword	Analysis of bianries Deobfuscation Context-sensitive analysis Obfuscation
Content Type	Text
Resource Type	Article

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in

Context-sensitive analysis of obfuscated x86 executables (2010)

Deobfuscation: reverse engineering obfuscated.

Obfuscation-based analysis of sql injection attacks (2010)

Deobfuscation: Reverse engineering obfuscated code (2005)

LOOP: Logic-Oriented Opaque Predicate Detection in Obfuscated Binary Code

Deobfuscation of virtualization-obfuscated software: a semantics-based approach

Context-sensitive analysis of x86. (2009).

Analyzing Memory Accesses in x86 Executables (2004)

Analyzing Memory Accesses in x86 Executables (2004)

Context-sensitive analysis of obfuscated x86 executables

Similar Documents

Context-sensitive analysis of obfuscated x86 executables (2010)

Deobfuscation: reverse engineering obfuscated.

Obfuscation-based analysis of sql injection attacks (2010)

Deobfuscation: Reverse engineering obfuscated code (2005)

LOOP: Logic-Oriented Opaque Predicate Detection in Obfuscated Binary Code

Deobfuscation of virtualization-obfuscated software: a semantics-based approach

Context-sensitive analysis of x86. (2009).

Analyzing Memory Accesses in x86 Executables (2004)

Analyzing Memory Accesses in x86 Executables (2004)

Context-sensitive analysis of obfuscated x86 executables