Recovery of Variables and Heap Structure in x86 Executables
Gogul Balakrishnan, Thomas Reps · 2005
Abstract This paper addresses two problems that arise when analyzing ex-ecutables: (1) recovering variable-like quantities in the absence of symbol-table and debugging information, and (2) recovering usefulinformation about objects allocated in the heap. 1. Introduction There is an increasing need for tools to help programmers and se-curity analysts understand executables. For instance, commercial companies and the military increasingly use Commercial Off-TheShelf (COTS) components to reduce the cost of software development. They are interested in ensuring that COTS components do notperform malicious actions (or can be forced to perform malicious actions). Viruses and worms have become ubiquitous. A tool thataids in understanding their behavior can ensure early dissemination of signatures, and thereby control the extent of damage causedby them. In both domains, the questions that need to be answered cannot be answered perfectly--the problems are undecidable--butstatic analysis provides a way to answer them conservatively.