Differentiating Code from Data in x86 Binaries

author: Richard Wartell, Department of Computer Science, Erik Jonsson School of Engineering & Computer Science, The University of Texas at Dallas
published: Oct. 3, 2011,   recorded: September 2011,   views: 3065
Categories

Slides

Related content

Report a problem or upload files

If you have found a problem with this lecture or would like to send us extra material, articles, exercises, etc., please use our ticket system to describe your request and upload the data.
Enter your e-mail into the 'Cc' field, and we will keep you updated with your request's status.
Lecture popularity: You need to login to cast your vote.
  Delicious Bibliography

Description

Robust, static disassembly is an important part of achieving high coverage for many binary code analyses, such as reverse engineering, malware analysis, reference monitor in-lining, and software fault isola- tion. However, one of the major diculties current disassemblers face is di erentiating code from data when they are interleaved. This paper presents a machine learning-based disassembly algorithm that segments an x86 binary into subsequences of bytes and then classi es each subse- quence as code or data. The algorithm builds a language model from a set of pre-tagged binaries using a statistical data compression technique. It sequentially scans a new binary executable and sets a breaking point at each potential code-to-code and code-to-data/data-to-code transition. The classi cation of each segment as code or data is based on the min- imum cross-entropy. Experimental results are presented to demonstrate the e ectiveness of the algorithm.

See Also:

Download slides icon Download slides: ecmlpkdd2011_wartell_code_01.pdf (447.2 KB)


Help icon Streaming Video Help

Link this page

Would you like to put a link to this lecture on your homepage?
Go ahead! Copy the HTML snippet !

Write your own review or comment:

make sure you have javascript enabled or clear this field: