CS 449 – Executables and Linking Compiler Executables Older

Total Page:16

File Type:pdf, Size:1020Kb

CS 449 – Executables and Linking Compiler Executables Older Compiler CS 449 – Executables and gcc Preprocessed Object Linking C source source files Executable .c cpp cc1 .o ld Preprocessor Compiler Linker Jonathan Misurda [email protected] Executables Older Executable Formats •What do we need to store? • a.out (Assembler OUTput) –Code – Oldest UNIX format –Data –No longer commonly used –More? •COFF (Common Object File Format) •Agree on a common format (much like with – Older UNIX Format ID3 tags) –No longer commonly used Modern Executable Formats a.out •PE (Portable Executable) •exec header –Based on COFF •text segment –Used in 32‐ and 64‐bit Windows •data segment •ELF (Executable and Linkable Format) •text relocations – Linux/UNIX •data relocations •symbol table •Mach‐O file •string table –Mac 1 Header Process’s Address Space •Every a.out formatted binary file begins with an exec 0x7fffffff structure: Stack $sp struct exec { brk unsigned long a_midmag; //magic number unsigned long a_text; brk unsigned long a_data; Data (Heap) Data (Heap) unsigned long a_bss; unsigned long a_syms; _end unsigned long a_entry; Data (Globals) unsigned long a_trsize; unsigned long a_drsize; Text (Code) }; 0 CS 1550 ‐ 2077 Libraries Linking •Not all code in a program is what you wrote • Static Linking –Copy code into executable at compile time •Use code that others have written in your own –Done by linker program •Dynamic Linking •How to include this code in your address –Copy code into Address Space at load time or later space? –Done by link loader Static Linking Dynamic Linking #include <stdio.h> #include <math.h> int main() { Shared Objects printf(“The sqrt of 9 is %f\n”, sqrt(9)); /usr/lib/libc.so /usr/lib/libm.so Stack return 0; } Archives Executable Data (Heap) /usr/lib/libc.a /usr/lib/libm.a Data (Heap) ld Object Data (Globals) files Executable Link Loader Text (Code) .o ld Linker 2 Dynamic Loading Function Pointers DLL 2 •How do we call a function when we can’t be DLL 1 sure what address it’s loaded at? Stack Stack • Need a level of indirection Data (Heap) Data (Heap) Data (Heap) Data (Heap) LoadLibrary(“DLL1.dll”); Data (Globals) LoadLibrary(“DLL2.dll”); Data (Globals) •Use a function pointer Text (Code) Text (Code) Function Pointers in C #include <stdio.h> int f(int x) { return x; } int main() { int (*g)(int x); g = f; printf(“%d\n”,g(3)); return 0; } 3.
Recommended publications
  • A Compiler-Level Intermediate Representation Based Binary Analysis and Rewriting System
    A Compiler-level Intermediate Representation based Binary Analysis and Rewriting System Kapil Anand Matthew Smithson Khaled Elwazeer Aparna Kotha Jim Gruen Nathan Giles Rajeev Barua University of Maryland, College Park {kapil,msmithso,wazeer,akotha,jgruen,barua}@umd.edu Abstract 1. Introduction This paper presents component techniques essential for con- In recent years, there has been a tremendous amount of ac- verting executables to a high-level intermediate representa- tivity in executable-level research targeting varied applica- tion (IR) of an existing compiler. The compiler IR is then tions such as security vulnerability analysis [13, 37], test- employed for three distinct applications: binary rewriting us- ing [17], and binary optimizations [30, 35]. In spite of a sig- ing the compiler’s binary back-end, vulnerability detection nificant overlap in the overall goals of various source-code using source-level symbolic execution, and source-code re- methods and executable-level techniques, several analyses covery using the compiler’s C backend. Our techniques en- and sophisticated transformations that are well-understood able complex high-level transformations not possible in ex- and implemented in source-level infrastructures have yet to isting binary systems, address a major challenge of input- become available in executable frameworks. Many of the derived memory addresses in symbolic execution and are the executable-level tools suggest new techniques for perform- first to enable recovery of a fully functional source-code. ing elementary source-level tasks. For example, PLTO [35] We present techniques to segment the flat address space in proposes a custom alias analysis technique to implement a an executable containing undifferentiated blocks of memory.
    [Show full text]
  • Automatic Classifying of Mac OS X Samples
    Automatic Classifying of Mac OS X Samples Spencer Hsieh, Pin Wu and Haoping Liu Trend Micro Inc., Taiwan TREND MICRO LEGAL DISCLAIMER The information provided herein is for general information Contents and educational purposes only. It is not intended and should not be construed to constitute legal advice. The information contained herein may not be applicable to all situations and may not reflect the most current situation. Nothing contained herein should be relied on or acted 4 upon without the benefit of legal advice based on the particular facts and circumstances presented and nothing Introduction herein should be construed otherwise. Trend Micro reserves the right to modify the contents of this document at any time without prior notice. Translations of any material into other languages are intended solely as a convenience. Translation accuracy 6 is not guaranteed nor implied. If any questions arise related to the accuracy of a translation, please refer to Mac OS X Samples Dataset the original language official version of the document. Any discrepancies or differences created in the translation are not binding and have no legal effect for compliance or enforcement purposes. 10 Although Trend Micro uses reasonable efforts to include accurate and up-to-date information herein, Trend Micro makes no warranties or representations of any kind as Classification of Mach-O Files to its accuracy, currency, or completeness. You agree that access to and use of and reliance on this document and the content thereof is at your own risk. Trend Micro disclaims all warranties of any kind, express or implied. 11 Neither Trend Micro nor any party involved in creating, producing, or delivering this document shall be liable for any consequence, loss, or damage, including direct, Malware Families indirect, special, consequential, loss of business profits, or special damages, whatsoever arising out of access to, use of, or inability to use, or in connection with the use of this document, or any errors or omissions in the content 15 thereof.
    [Show full text]
  • A Proposed System for Hiding Information in Portable Executable Files Based on Analyzing Import Section
    IOSR Journal of Engineering (IOSRJEN) www.iosrjen.org ISSN (e): 2250-3021, ISSN (p): 2278-8719 Vol. 04, Issue 01 (January. 2014), ||V7|| PP 21-30 A Proposed System for Hiding Information In Portable Executable Files Based on Analyzing Import Section Mohammad Hussein Jawwad 1- University of Babylon- College of Information Technology- Iraq Abstract: - Information-hiding techniques have newly become very important in a many application areas. Many cover mediums have been used to hide information like image, video, voice. Use of these mediums have been extensively studied. In this paper, we propose new system for hiding information in Portable Executable files (PE files). PE is a file format for executable file used in the 32-bit and 64-bit versions of the Windows operating system. This algorithm has higher security than some traditional ones because of the combination between encryption and hiding. We first encrypt the information before hiding it to ensure high security. After that we hide the information in the import table of PE file. This hiding depends on analyzing the import table characteristics of PE files that have been built under Borland turbo assembler. The testing result shows that the result file does not make any inconsistency with anti-virus programs and the PE file still function as normal after the hiding process. Keywords: - PE File, Information Hiding, Cryptography. I. INTRODUCTION The development and wide use of computer science and informatics also, the advent of global networks (i.e. Internet) that make the access for information is possible for every one online impose the need for ways to avoid hackers and muggers from getting the important information.
    [Show full text]
  • Toward IFVM Virtual Machine: a Model Driven IFML Interpretation
    Toward IFVM Virtual Machine: A Model Driven IFML Interpretation Sara Gotti and Samir Mbarki MISC Laboratory, Faculty of Sciences, Ibn Tofail University, BP 133, Kenitra, Morocco Keywords: Interaction Flow Modelling Language IFML, Model Execution, Unified Modeling Language (UML), IFML Execution, Model Driven Architecture MDA, Bytecode, Virtual Machine, Model Interpretation, Model Compilation, Platform Independent Model PIM, User Interfaces, Front End. Abstract: UML is the first international modeling language standardized since 1997. It aims at providing a standard way to visualize the design of a system, but it can't model the complex design of user interfaces and interactions. However, according to MDA approach, it is necessary to apply the concept of abstract models to user interfaces too. IFML is the OMG adopted (in March 2013) standard Interaction Flow Modeling Language designed for abstractly expressing the content, user interaction and control behaviour of the software applications front-end. IFML is a platform independent language, it has been designed with an executable semantic and it can be mapped easily into executable applications for various platforms and devices. In this article we present an approach to execute the IFML. We introduce a IFVM virtual machine which translate the IFML models into bytecode that will be interpreted by the java virtual machine. 1 INTRODUCTION a fundamental standard fUML (OMG, 2011), which is a subset of UML that contains the most relevant The software development has been affected by the part of class diagrams for modeling the data apparition of the MDA (OMG, 2015) approach. The structure and activity diagrams to specify system trend of the 21st century (BRAMBILLA et al., behavior; it contains all UML elements that are 2014) which has allowed developers to build their helpful for the execution of the models.
    [Show full text]
  • Portable Executable File Format
    Chapter 11 Portable Executable File Format IN THIS CHAPTER + Understanding the structure of a PE file + Talking in terms of RVAs + Detailing the PE format + The importance of indices in the data directory + How the loader interprets a PE file MICROSOFT INTRODUCED A NEW executable file format with Windows NT. This for- mat is called the Portable Executable (PE) format because it is supposed to be portable across all 32-bit operating systems by Microsoft. The same PE format exe- cutable can be executed on any version of Windows NT, Windows 95, and Win32s. Also, the same format is used for executables for Windows NT running on proces- sors other than Intel x86, such as MIPS, Alpha, and Power PC. The 32-bit DLLs and Windows NT device drivers also follow the same PE format. It is helpful to understand the PE file format because PE files are almost identi- cal on disk and in RAM. Learning about the PE format is also helpful for under- standing many operating system concepts. For example, how operating system loader works to support dynamic linking of DLL functions, the data structures in- volved in dynamic linking such as import table, export table, and so on. The PE format is not really undocumented. The WINNT.H file has several struc- ture definitions representing the PE format. The Microsoft Developer's Network (MSDN) CD-ROMs contain several descriptions of the PE format. However, these descriptions are in bits and pieces, and are by no means complete. In this chapter, we try to give you a comprehensive picture of the PE format.
    [Show full text]
  • Investigation of Malicious Portable Executable File Detection on the Network Using Supervised Learning Techniques
    Investigation of Malicious Portable Executable File Detection on the Network using Supervised Learning Techniques Rushabh Vyas, Xiao Luo, Nichole McFarland, Connie Justice Department of Information and Technology, Purdue School of Engineering and Technology IUPUI, Indianapolis, IN, USA 46202 Emails: [email protected]; [email protected]; [email protected]; [email protected] Abstract—Malware continues to be a critical concern for that random forest learning technique achieved best detection everyone from home users to enterprises. Today, most devices are performance than the other three learning techniques. The connected through networks to the Internet. Therefore, malicious achieved detection rate and false alarm rate on experimental code can easily and rapidly spread. The objective of this paper is to examine how malicious portable executable (PE) files can be data set were 98.7% and 1.8% respectively. We compared detected on the network by utilizing machine learning algorithms. the performances of the four learning techniques on four The efficiency and effectiveness of the network detection rely types of PE malware - backdoors, viruses, worms and trojans. on the number of features and the learning algorithms. In this The results showed that the same learning technique show work, we examined 28 features extracted from metadata, packing, the similar performance on different types of malwares. It imported DLLs and functions of four different types of PE files for malware detection. The returned results showed that the demonstrated the features that are extracted from the files have proposed system can achieve 98.7% detection rates, 1.8% false no bias for a specific type of malware.
    [Show full text]
  • Coqjvm: an Executable Specification of the Java Virtual Machine Using
    CoqJVM: An Executable Specification of the Java Virtual Machine using Dependent Types Robert Atkey LFCS, School of Informatics, University of Edinburgh Mayfield Rd, Edinburgh EH9 3JZ, UK [email protected] Abstract. We describe an executable specification of the Java Virtual Machine (JVM) within the Coq proof assistant. The principal features of the development are that it is executable, meaning that it can be tested against a real JVM to gain confidence in the correctness of the specification; and that it has been written with heavy use of dependent types, this is both to structure the model in a useful way, and to constrain the model to prevent spurious partiality. We describe the structure of the formalisation and the way in which we have used dependent types. 1 Introduction Large scale formalisations of programming languages and systems in mechanised theorem provers have recently become popular [4–6, 9]. In this paper, we describe a formalisation of the Java virtual machine (JVM) [8] in the Coq proof assistant [11]. The principal features of this formalisation are that it is executable, meaning that a purely functional JVM can be extracted from the Coq development and – with some O’Caml glue code – executed on real Java bytecode output from the Java compiler; and that it is structured using dependent types. The motivation for this development is to act as a basis for certified consumer- side Proof-Carrying Code (PCC) [12]. We aim to prove the soundness of program logics and correctness of proof checkers against the model, and extract the proof checkers to produce certified stand-alone tools.
    [Show full text]
  • An Executable Intermediate Representation for Retargetable Compilation and High-Level Code Optimization
    An Executable Intermediate Representation for Retargetable Compilation and High-Level Code Optimization Rainer Leupers, Oliver Wahlen, Manuel Hohenauer, Tim Kogel Peter Marwedel Aachen University of Technology (RWTH) University of Dortmund Integrated Signal Processing Systems Dept. of Computer Science 12 Aachen, Germany Dortmund, Germany Email: [email protected] Email: [email protected] Abstract— Due to fast time-to-market and IP reuse require- potential parallelism and which are the usual input format for ments, an increasing amount of the functionality of embedded code generation and scheduling algorithms. HW/SW systems is implemented in software. As a consequence, For the purpose of hardware synthesis from C, the IR software programming languages like C play an important role in system specification, design, and validation. Besides many other generation can be viewed as a specification refinement that advantages, the C language offers executable specifications, with lowers an initially high-level specification in order to get clear semantics and high simulation speed. However, virtually closer to the final implementation, while retaining the original any tool operating on C specifications has to convert C sources semantics. We will explain later, how this refinement step can into some intermediate representation (IR), during which the be validated. executability is normally lost. In order to overcome this problem, this paper describes a novel IR format, called IR-C, for the use However, the executability of C, which is one of its major in C based design tools, which combines the simplicity of three advantages, is usually lost after an IR has been generated. address code with the executability of C.
    [Show full text]
  • Devpartner Advanced Error Detection Techniques Guide
    DevPartner® Advanced Error Detection Techniques Release 8.1 Technical support is available from our Technical Support Hotline or via our FrontLine Support Web site. Technical Support Hotline: 1-800-538-7822 FrontLine Support Web Site: http://frontline.compuware.com This document and the product referenced in it are subject to the following legends: Access is limited to authorized users. Use of this product is subject to the terms and conditions of the user’s License Agreement with Compuware Corporation. © 2006 Compuware Corporation. All rights reserved. Unpublished - rights reserved under the Copyright Laws of the United States. U.S. GOVERNMENT RIGHTS Use, duplication, or disclosure by the U.S. Government is subject to restrictions as set forth in Compuware Corporation license agreement and as provided in DFARS 227.7202-1(a) and 227.7202-3(a) (1995), DFARS 252.227-7013(c)(1)(ii)(OCT 1988), FAR 12.212(a) (1995), FAR 52.227-19, or FAR 52.227-14 (ALT III), as applicable. Compuware Corporation. This product contains confidential information and trade secrets of Com- puware Corporation. Use, disclosure, or reproduction is prohibited with- out the prior express written permission of Compuware Corporation. DevPartner® Studio, BoundsChecker, FinalCheck and ActiveCheck are trademarks or registered trademarks of Compuware Corporation. Acrobat® Reader copyright © 1987-2003 Adobe Systems Incorporated. All rights reserved. Adobe, Acrobat, and Acrobat Reader are trademarks of Adobe Systems Incorporated. All other company or product names are trademarks of their respective owners. US Patent Nos.: 5,987,249, 6,332,213, 6,186,677, 6,314,558, and 6,016,466 April 14, 2006 Table of Contents Preface Who Should Read This Manual .
    [Show full text]
  • The Concept of Dynamic Analysis
    The Concept of Dynamic Analysis Thomas Ball Bell Laboratories Lucent Technologies [email protected] Abstract. Dynamic analysis is the analysis of the properties of a run- ning program. In this paper, we explore two new dynamic analyses based on program profiling: - Frequency Spectrum Analysis. We show how analyzing the frequen- cies of program entities in a single execution can help programmers to decompose a program, identify related computations, and find computations related to specific input and output characteristics of a program. - Coverage Concept Analysis. Concept analysis of test coverage data computes dynamic analogs to static control flow relationships such as domination, postdomination, and regions. Comparison of these dynamically computed relationships to their static counterparts can point to areas of code requiring more testing and can aid program- mers in understanding how a program and its test sets relate to one another. 1 Introduction Dynamic analysis is the analysis of the properties of a running program. In contrast to static analysis, which examines a program’s text to derive properties that hold for all executions, dynamic analysis derives properties that hold for one or more executions by examination of the running program (usually through program instrumentation [14]). While dynamic analysis cannot prove that a program satisfies a particular property, it can detect violations of properties as well as provide useful information to programmers about the behavior of their programs, as this paper will show. The usefulness of dynamic analysis derives from two of its essential charac- teristics: - Precision of information: dynamic analysis typically involves instrumenting a program to examine or record certain aspects of its run-time state.
    [Show full text]
  • Archive and Compressed [Edit]
    Archive and compressed [edit] Main article: List of archive formats • .?Q? – files compressed by the SQ program • 7z – 7-Zip compressed file • AAC – Advanced Audio Coding • ace – ACE compressed file • ALZ – ALZip compressed file • APK – Applications installable on Android • AT3 – Sony's UMD Data compression • .bke – BackupEarth.com Data compression • ARC • ARJ – ARJ compressed file • BA – Scifer Archive (.ba), Scifer External Archive Type • big – Special file compression format used by Electronic Arts for compressing the data for many of EA's games • BIK (.bik) – Bink Video file. A video compression system developed by RAD Game Tools • BKF (.bkf) – Microsoft backup created by NTBACKUP.EXE • bzip2 – (.bz2) • bld - Skyscraper Simulator Building • c4 – JEDMICS image files, a DOD system • cab – Microsoft Cabinet • cals – JEDMICS image files, a DOD system • cpt/sea – Compact Pro (Macintosh) • DAA – Closed-format, Windows-only compressed disk image • deb – Debian Linux install package • DMG – an Apple compressed/encrypted format • DDZ – a file which can only be used by the "daydreamer engine" created by "fever-dreamer", a program similar to RAGS, it's mainly used to make somewhat short games. • DPE – Package of AVE documents made with Aquafadas digital publishing tools. • EEA – An encrypted CAB, ostensibly for protecting email attachments • .egg – Alzip Egg Edition compressed file • EGT (.egt) – EGT Universal Document also used to create compressed cabinet files replaces .ecab • ECAB (.ECAB, .ezip) – EGT Compressed Folder used in advanced systems to compress entire system folders, replaced by EGT Universal Document • ESS (.ess) – EGT SmartSense File, detects files compressed using the EGT compression system. • GHO (.gho, .ghs) – Norton Ghost • gzip (.gz) – Compressed file • IPG (.ipg) – Format in which Apple Inc.
    [Show full text]
  • Anti-Executable Standard User Guide 2 |
    | 1 Anti-Executable Standard User Guide 2 | Last modified: October, 2015 © 1999 - 2015 Faronics Corporation. All rights reserved. Faronics, Deep Freeze, Faronics Core Console, Faronics Anti-Executable, Faronics Device Filter, Faronics Power Save, Faronics Insight, Faronics System Profiler, and WINSelect are trademarks and/or registered trademarks of Faronics Corporation. All other company and product names are trademarks of their respective owners. Anti-Executable Standard User Guide | 3 Contents Preface . 5 Important Information. 6 About Faronics . 6 Product Documentation . 6 Technical Support . 7 Contact Information. 7 Definition of Terms . 8 Introduction . 10 Anti-Executable Overview . 11 About Anti-Executable . 11 Anti-Executable Editions. 11 System Requirements . 12 Anti-Executable Licensing . 13 Installing Anti-Executable . 15 Installation Overview. 16 Installing Anti-Executable Standard. 17 Accessing Anti-Executable Standard . 20 Using Anti-Executable . 21 Overview . 22 Configuring Anti-Executable . 23 Status Tab . 24 Verifying Product Information . 24 Enabling Anti-Executable Protection. 24 Anti-Executable Maintenance Mode . 25 Execution Control List Tab . 26 Users Tab. 27 Adding an Anti-Executable Administrator or Trusted User . 27 Removing an Anti-Executable Administrator or Trusted User . 28 Enabling Anti-Executable Passwords . 29 Temporary Execution Mode Tab. 30 Activating or Deactivating Temporary Execution Mode . 30 Setup Tab . 32 Setting Event Logging in Anti-Executable . 32 Monitor DLL Execution . 32 Monitor JAR Execution . 32 Anti-Executable Stealth Functionality . 33 Compatibility Options. 33 Customizing Alerts. 34 Report Tab . 35 Uninstalling Anti-Executable . 37 Uninstalling Anti-Executable Standard . 38 Anti-Executable Standard User Guide 4 | Contents Anti-Executable Standard User Guide |5 Preface Faronics Anti-Executable is a solution that ensures endpoint security by only permitting approved executables to run on a workstation or server.
    [Show full text]