Static Analysis of Executable Files by Machine Learning Methods
Total Page:16
File Type:pdf, Size:1020Kb
Load more
Recommended publications
-
A Compiler-Level Intermediate Representation Based Binary Analysis and Rewriting System
A Compiler-level Intermediate Representation based Binary Analysis and Rewriting System Kapil Anand Matthew Smithson Khaled Elwazeer Aparna Kotha Jim Gruen Nathan Giles Rajeev Barua University of Maryland, College Park {kapil,msmithso,wazeer,akotha,jgruen,barua}@umd.edu Abstract 1. Introduction This paper presents component techniques essential for con- In recent years, there has been a tremendous amount of ac- verting executables to a high-level intermediate representa- tivity in executable-level research targeting varied applica- tion (IR) of an existing compiler. The compiler IR is then tions such as security vulnerability analysis [13, 37], test- employed for three distinct applications: binary rewriting us- ing [17], and binary optimizations [30, 35]. In spite of a sig- ing the compiler’s binary back-end, vulnerability detection nificant overlap in the overall goals of various source-code using source-level symbolic execution, and source-code re- methods and executable-level techniques, several analyses covery using the compiler’s C backend. Our techniques en- and sophisticated transformations that are well-understood able complex high-level transformations not possible in ex- and implemented in source-level infrastructures have yet to isting binary systems, address a major challenge of input- become available in executable frameworks. Many of the derived memory addresses in symbolic execution and are the executable-level tools suggest new techniques for perform- first to enable recovery of a fully functional source-code. ing elementary source-level tasks. For example, PLTO [35] We present techniques to segment the flat address space in proposes a custom alias analysis technique to implement a an executable containing undifferentiated blocks of memory. -
Toward IFVM Virtual Machine: a Model Driven IFML Interpretation
Toward IFVM Virtual Machine: A Model Driven IFML Interpretation Sara Gotti and Samir Mbarki MISC Laboratory, Faculty of Sciences, Ibn Tofail University, BP 133, Kenitra, Morocco Keywords: Interaction Flow Modelling Language IFML, Model Execution, Unified Modeling Language (UML), IFML Execution, Model Driven Architecture MDA, Bytecode, Virtual Machine, Model Interpretation, Model Compilation, Platform Independent Model PIM, User Interfaces, Front End. Abstract: UML is the first international modeling language standardized since 1997. It aims at providing a standard way to visualize the design of a system, but it can't model the complex design of user interfaces and interactions. However, according to MDA approach, it is necessary to apply the concept of abstract models to user interfaces too. IFML is the OMG adopted (in March 2013) standard Interaction Flow Modeling Language designed for abstractly expressing the content, user interaction and control behaviour of the software applications front-end. IFML is a platform independent language, it has been designed with an executable semantic and it can be mapped easily into executable applications for various platforms and devices. In this article we present an approach to execute the IFML. We introduce a IFVM virtual machine which translate the IFML models into bytecode that will be interpreted by the java virtual machine. 1 INTRODUCTION a fundamental standard fUML (OMG, 2011), which is a subset of UML that contains the most relevant The software development has been affected by the part of class diagrams for modeling the data apparition of the MDA (OMG, 2015) approach. The structure and activity diagrams to specify system trend of the 21st century (BRAMBILLA et al., behavior; it contains all UML elements that are 2014) which has allowed developers to build their helpful for the execution of the models. -
Toolchains Instructor: Prabal Dutta Date: October 2, 2012
EECS 373: Design of Microprocessor-Based Systems Fall 2012 Lecture 3: Toolchains Instructor: Prabal Dutta Date: October 2, 2012 Note: Unless otherwise specified, these notes assume: (i) an ARM Cortex-M3 processor operating in little endian mode; (ii) the ARM EABI application binary interface; and (iii) the GNU GCC toolchain. Toolchains A complete software toolchain includes programs to convert source code into binary machine code, link together separately assembled/compiled code modules, disassemble the binaries, and convert their formats. Binary program file (.bin) Assembly Object Executable files (.s) files (.o) image file objcopy ld (linker) as objdump (assembler) Memory layout Disassembled Linker code (.lst) script (.ld) Figure 0.1: Assembler Toolchain. A typical GNU (GNU's Not Unix) assembler toolchain includes several programs that interact as shown in Figure 0.1 and perform the following functions: • as is the assembler and it converts human-readable assembly language programs into binary machine language code. It typically takes as input .s assembly files and outputs .o object files. • ld is the linker and it is used to combine multiple object files by resolving their external symbol references and relocating their data sections, and outputting a single executable file. It typically takes as input .o object files and .ld linker scripts and outputs .out executable files. • objcopy is a translation utility that copies and converts the contents of an object file from one format (e.g. .out) another (e.g. .bin). • objdump is a disassembler but it can also display various other information about object files. It is often used to disassemble binary files (e.g. -
Coqjvm: an Executable Specification of the Java Virtual Machine Using
CoqJVM: An Executable Specification of the Java Virtual Machine using Dependent Types Robert Atkey LFCS, School of Informatics, University of Edinburgh Mayfield Rd, Edinburgh EH9 3JZ, UK [email protected] Abstract. We describe an executable specification of the Java Virtual Machine (JVM) within the Coq proof assistant. The principal features of the development are that it is executable, meaning that it can be tested against a real JVM to gain confidence in the correctness of the specification; and that it has been written with heavy use of dependent types, this is both to structure the model in a useful way, and to constrain the model to prevent spurious partiality. We describe the structure of the formalisation and the way in which we have used dependent types. 1 Introduction Large scale formalisations of programming languages and systems in mechanised theorem provers have recently become popular [4–6, 9]. In this paper, we describe a formalisation of the Java virtual machine (JVM) [8] in the Coq proof assistant [11]. The principal features of this formalisation are that it is executable, meaning that a purely functional JVM can be extracted from the Coq development and – with some O’Caml glue code – executed on real Java bytecode output from the Java compiler; and that it is structured using dependent types. The motivation for this development is to act as a basis for certified consumer- side Proof-Carrying Code (PCC) [12]. We aim to prove the soundness of program logics and correctness of proof checkers against the model, and extract the proof checkers to produce certified stand-alone tools. -
Coldfire Cross Development with GNU Toolchain and Eclipse
ColdFire cross development with GNU Toolchain and Eclipse Version 1.0 embedded development tools Acknowledgements Ronetix GmbH Waidhausenstrasse 13/5 1140 Vienna Austria Tel: +43-720-500315 +43-1962-720 500315 Fax: +43-1- 8174 955 3464 Internet: www.ronetix.at E-Mail [email protected] Acknowledgments: ColdFire is trademark of Freescale Ltd. Windows, Win32, Windows CE are trademarks of Microsoft Corporation. Ethernet is a trademark of XEROX. All other trademarks are trademarks of their respective companies. © 2005-2008 RONETIX All rights reserved. ColdFire cross development 2 www.ronetix.at Acknowledgements Change log April 2007 - First release ColdFire cross development 3 www.ronetix.at Contents 1 INTRODUCTION ...........................................................................................................................5 2 PEEDI COLDFIRE EMULATOR INSTALLATION........................................................................6 3 TOOLSET INSTALLATION ON LINUX ........................................................................................7 4 TOOLSET INSTALLATION ON WINDOWS...............................................................................10 5 WORKING WITH ECLIPSE.........................................................................................................11 5.1 Adding a project ....................................................................................................................11 5.2 Configuring and working with the Eclipse built-in debugger ...........................................16 -
An Executable Intermediate Representation for Retargetable Compilation and High-Level Code Optimization
An Executable Intermediate Representation for Retargetable Compilation and High-Level Code Optimization Rainer Leupers, Oliver Wahlen, Manuel Hohenauer, Tim Kogel Peter Marwedel Aachen University of Technology (RWTH) University of Dortmund Integrated Signal Processing Systems Dept. of Computer Science 12 Aachen, Germany Dortmund, Germany Email: [email protected] Email: [email protected] Abstract— Due to fast time-to-market and IP reuse require- potential parallelism and which are the usual input format for ments, an increasing amount of the functionality of embedded code generation and scheduling algorithms. HW/SW systems is implemented in software. As a consequence, For the purpose of hardware synthesis from C, the IR software programming languages like C play an important role in system specification, design, and validation. Besides many other generation can be viewed as a specification refinement that advantages, the C language offers executable specifications, with lowers an initially high-level specification in order to get clear semantics and high simulation speed. However, virtually closer to the final implementation, while retaining the original any tool operating on C specifications has to convert C sources semantics. We will explain later, how this refinement step can into some intermediate representation (IR), during which the be validated. executability is normally lost. In order to overcome this problem, this paper describes a novel IR format, called IR-C, for the use However, the executability of C, which is one of its major in C based design tools, which combines the simplicity of three advantages, is usually lost after an IR has been generated. address code with the executability of C. -
Transparent Dynamic Optimization: the Design and Implementation of Dynamo
Transparent Dynamic Optimization: The Design and Implementation of Dynamo Vasanth Bala, Evelyn Duesterwald, Sanjeev Banerjia HP Laboratories Cambridge HPL-1999-78 June, 1999 E-mail: [email protected] dynamic Dynamic optimization refers to the runtime optimization optimization, of a native program binary. This report describes the compiler, design and implementation of Dynamo, a prototype trace selection, dynamic optimizer that is capable of optimizing a native binary translation program binary at runtime. Dynamo is a realistic implementation, not a simulation, that is written entirely in user-level software, and runs on a PA-RISC machine under the HPUX operating system. Dynamo does not depend on any special programming language, compiler, operating system or hardware support. Contrary to intuition, we demonstrate that it is possible to use a piece of software to improve the performance of a native, statically optimized program binary, while it is executing. Dynamo not only speeds up real application programs, its performance improvement is often quite significant. For example, the performance of many +O2 optimized SPECint95 binaries running under Dynamo is comparable to the performance of their +O4 optimized version running without Dynamo. Internal Accession Date Only Ó Copyright Hewlett-Packard Company 1999 Contents 1 INTRODUCTION ........................................................................................... 7 2 RELATED WORK ......................................................................................... 9 3 OVERVIEW -
Building a GCC Cross Compiler
B uilding the Gnu GCC Compiler Page 1 Building a Gnu GCC Cross Compiler Cmpware, Inc. Introduction The Cmpware Configurable Multiprocessor Development Kit (CMP-DK) is based around fast simulation models for multiple processors. While the Cmpware CMP-DK comes with several popular microprocessor models included, it does not supply tools for programming these processors. One popular microprocessor development tool chain is the Gnu tools from the Free Software Foundation. These tools are most often used in typical self-hosted development environments, where the processor and operating system used for development is also the processor and operating system used to execute the code being developed. In the case of development for the Cmpware CMP-DK, it is more likely that the tools will be cross targeted. This means that the host machine used for software development uses one processor and operating system and the target system uses a different processor and operating system. This arrangement does not necessarily complicate the processor itself; it still only has to produce code for a single target. The major problem with cross targeted tools is that the possible combinations of host and target can be large and the audience for such tools relatively small. So such tools tend to be less rigorously maintained than more popular self-hosted tools. This document briefly describes the complete process of building a cross targeted Gnu tool chain. It uses a popular combination of host and target, and the process is know to work correctly. This document does not address the problems that may occur in the build process which may require specialized knowledge of the internals of the Gnu tools. -
Devpartner Advanced Error Detection Techniques Guide
DevPartner® Advanced Error Detection Techniques Release 8.1 Technical support is available from our Technical Support Hotline or via our FrontLine Support Web site. Technical Support Hotline: 1-800-538-7822 FrontLine Support Web Site: http://frontline.compuware.com This document and the product referenced in it are subject to the following legends: Access is limited to authorized users. Use of this product is subject to the terms and conditions of the user’s License Agreement with Compuware Corporation. © 2006 Compuware Corporation. All rights reserved. Unpublished - rights reserved under the Copyright Laws of the United States. U.S. GOVERNMENT RIGHTS Use, duplication, or disclosure by the U.S. Government is subject to restrictions as set forth in Compuware Corporation license agreement and as provided in DFARS 227.7202-1(a) and 227.7202-3(a) (1995), DFARS 252.227-7013(c)(1)(ii)(OCT 1988), FAR 12.212(a) (1995), FAR 52.227-19, or FAR 52.227-14 (ALT III), as applicable. Compuware Corporation. This product contains confidential information and trade secrets of Com- puware Corporation. Use, disclosure, or reproduction is prohibited with- out the prior express written permission of Compuware Corporation. DevPartner® Studio, BoundsChecker, FinalCheck and ActiveCheck are trademarks or registered trademarks of Compuware Corporation. Acrobat® Reader copyright © 1987-2003 Adobe Systems Incorporated. All rights reserved. Adobe, Acrobat, and Acrobat Reader are trademarks of Adobe Systems Incorporated. All other company or product names are trademarks of their respective owners. US Patent Nos.: 5,987,249, 6,332,213, 6,186,677, 6,314,558, and 6,016,466 April 14, 2006 Table of Contents Preface Who Should Read This Manual . -
The Concept of Dynamic Analysis
The Concept of Dynamic Analysis Thomas Ball Bell Laboratories Lucent Technologies [email protected] Abstract. Dynamic analysis is the analysis of the properties of a run- ning program. In this paper, we explore two new dynamic analyses based on program profiling: - Frequency Spectrum Analysis. We show how analyzing the frequen- cies of program entities in a single execution can help programmers to decompose a program, identify related computations, and find computations related to specific input and output characteristics of a program. - Coverage Concept Analysis. Concept analysis of test coverage data computes dynamic analogs to static control flow relationships such as domination, postdomination, and regions. Comparison of these dynamically computed relationships to their static counterparts can point to areas of code requiring more testing and can aid program- mers in understanding how a program and its test sets relate to one another. 1 Introduction Dynamic analysis is the analysis of the properties of a running program. In contrast to static analysis, which examines a program’s text to derive properties that hold for all executions, dynamic analysis derives properties that hold for one or more executions by examination of the running program (usually through program instrumentation [14]). While dynamic analysis cannot prove that a program satisfies a particular property, it can detect violations of properties as well as provide useful information to programmers about the behavior of their programs, as this paper will show. The usefulness of dynamic analysis derives from two of its essential charac- teristics: - Precision of information: dynamic analysis typically involves instrumenting a program to examine or record certain aspects of its run-time state. -
Anti-Executable Standard User Guide 2 |
| 1 Anti-Executable Standard User Guide 2 | Last modified: October, 2015 © 1999 - 2015 Faronics Corporation. All rights reserved. Faronics, Deep Freeze, Faronics Core Console, Faronics Anti-Executable, Faronics Device Filter, Faronics Power Save, Faronics Insight, Faronics System Profiler, and WINSelect are trademarks and/or registered trademarks of Faronics Corporation. All other company and product names are trademarks of their respective owners. Anti-Executable Standard User Guide | 3 Contents Preface . 5 Important Information. 6 About Faronics . 6 Product Documentation . 6 Technical Support . 7 Contact Information. 7 Definition of Terms . 8 Introduction . 10 Anti-Executable Overview . 11 About Anti-Executable . 11 Anti-Executable Editions. 11 System Requirements . 12 Anti-Executable Licensing . 13 Installing Anti-Executable . 15 Installation Overview. 16 Installing Anti-Executable Standard. 17 Accessing Anti-Executable Standard . 20 Using Anti-Executable . 21 Overview . 22 Configuring Anti-Executable . 23 Status Tab . 24 Verifying Product Information . 24 Enabling Anti-Executable Protection. 24 Anti-Executable Maintenance Mode . 25 Execution Control List Tab . 26 Users Tab. 27 Adding an Anti-Executable Administrator or Trusted User . 27 Removing an Anti-Executable Administrator or Trusted User . 28 Enabling Anti-Executable Passwords . 29 Temporary Execution Mode Tab. 30 Activating or Deactivating Temporary Execution Mode . 30 Setup Tab . 32 Setting Event Logging in Anti-Executable . 32 Monitor DLL Execution . 32 Monitor JAR Execution . 32 Anti-Executable Stealth Functionality . 33 Compatibility Options. 33 Customizing Alerts. 34 Report Tab . 35 Uninstalling Anti-Executable . 37 Uninstalling Anti-Executable Standard . 38 Anti-Executable Standard User Guide 4 | Contents Anti-Executable Standard User Guide |5 Preface Faronics Anti-Executable is a solution that ensures endpoint security by only permitting approved executables to run on a workstation or server. -
Embedded Design Handbook
Embedded Design Handbook Subscribe EDH | 2020.07.22 Send Feedback Latest document on the web: PDF | HTML Contents Contents 1. Introduction................................................................................................................... 6 1.1. Document Revision History for Embedded Design Handbook........................................ 6 2. First Time Designer's Guide............................................................................................ 8 2.1. FPGAs and Soft-Core Processors.............................................................................. 8 2.2. Embedded System Design...................................................................................... 9 2.3. Embedded Design Resources................................................................................. 11 2.3.1. Intel Embedded Support........................................................................... 11 2.3.2. Intel Embedded Training........................................................................... 11 2.3.3. Intel Embedded Documentation................................................................. 12 2.3.4. Third Party Intellectual Property.................................................................12 2.4. Intel Embedded Glossary...................................................................................... 13 2.5. First Time Designer's Guide Revision History............................................................14 3. Hardware System Design with Intel Quartus Prime and Platform Designer.................