TY - GEN
T1 - Equational reasoning on x86 assembly code
AU - Coogan, Kevin
AU - Debray, Saumya
PY - 2011
Y1 - 2011
N2 - Analysis of software is essential to addressing problems of correctness, efficiency, and security. Existing source code analysis tools are very useful for such purposes, but there are many instances where high-level source code is not available for software that needs to be analyzed. A need exists for tools that can analyze assembly code, whether from disassembled binaries or from handwritten sources. This paper describes an equational reasoning system for assembly code for the ubiquitous Intel x86 architecture, focusing on various problems that arise in low-level equational reasoning, such as register-name aliasing, memory indirection, condition-code flags, etc. Our system has successfully been applied to the problem of simplifying execution traces from obfuscated malware executables.
AB - Analysis of software is essential to addressing problems of correctness, efficiency, and security. Existing source code analysis tools are very useful for such purposes, but there are many instances where high-level source code is not available for software that needs to be analyzed. A need exists for tools that can analyze assembly code, whether from disassembled binaries or from handwritten sources. This paper describes an equational reasoning system for assembly code for the ubiquitous Intel x86 architecture, focusing on various problems that arise in low-level equational reasoning, such as register-name aliasing, memory indirection, condition-code flags, etc. Our system has successfully been applied to the problem of simplifying execution traces from obfuscated malware executables.
KW - equational reasoning
KW - static and dynamic analysis
KW - x86 assembly
UR - http://www.scopus.com/inward/record.url?scp=82055196630&partnerID=8YFLogxK
UR - http://www.scopus.com/inward/citedby.url?scp=82055196630&partnerID=8YFLogxK
U2 - 10.1109/SCAM.2011.15
DO - 10.1109/SCAM.2011.15
M3 - Conference contribution
AN - SCOPUS:82055196630
SN - 9780769543475
T3 - Proceedings - 11th IEEE International Working Conference on Source Code Analysis and Manipulation, SCAM 2011
SP - 75
EP - 84
BT - Proceedings - 11th IEEE International Working Conference on Source Code Analysis and Manipulation, SCAM 2011
T2 - 11th IEEE International Working Conference on Source Code Analysis and Manipulation, SCAM 2011
Y2 - 25 September 2011 through 26 September 2011
ER -