Scalable data structure detection and classification for C/C plus plus binaries

被引：9

作者：

Haller, Istvan ^{[1
]}

Slowinska, Asia ^{[1
]}

Bos, Herbert ^{[2
]}

机构：

[1] Vrije Univ Amsterdam, Syst & Network Secur Grp, Amsterdam, Netherlands

[2] Vrije Univ Amsterdam, Syst & Network Secur, Amsterdam, Netherlands

来源：

EMPIRICAL SOFTWARE ENGINEERING | 2016年 / 21卷 / 03期

基金：

欧洲研究理事会;

关键词：

Data structures; Dynamic binary analysis;

D O I：

10.1007/s10664-015-9363-y

中图分类号：

TP31 [计算机软件];

学科分类号：

081202 ; 0835 ;

摘要：

Many existing techniques for reversing data structures in C/C++ binaries are limited to low-level programming constructs, such as individual variables or structs. Unfortunately, without detailed information about a program's pointer structures, forensics and reverse engineering are exceedingly hard. To fill this gap, we propose MemPick, a tool that detects and classifies high-level data structures used in stripped binaries. By analyzing how links between memory objects evolve throughout the program execution, it distinguishes between many commonly used data structures, such as singly-or doubly-linked lists, many types of trees (e.g., AVL, red-black trees, B-trees), and graphs. We evaluate the technique on 10 real world applications, 4 file system implementations and 16 popular libraries. The results show that MemPick can identify the data structures with high accuracy.

引用

页码：778 / 810

页数：33