Search

When you're starting out you want to be able to hold the entire program in your head if at all possible. Once you're conversant with your first, simple assembly language and the machine architecture you're working with, it will be completely possible to look at a page or two of your assembly and know not only what it is supposed to do but also what the machine will do for you step by step. When you look at a high-level language, you should be able to understand what you mean it to do, but often you have no idea just how your intent will be translated into action. Assembly and machine code is where the action is.

The authors conducted an analysis of technological lines operation in the Russian regions. They reasoned the relevance of scientific research on the development and design of technological lines using modular equipment for the humic and complex fertilizers production. A technical problem unresolved from a scientific point of view was revealed – the lack of industrial production of specialized equipment for humic fertilizers obtained on the basis of deep processing of organic raw materials. ( Research purpose ) To determine the optimal composition of modular equipment using digital technologies for the design of industrial processing lines for the organic raw materials processing (peat, sapropel, brown coal and biohumus) based on the technical specifications of the customer and the results of the experimental production lines. ( Materials and methods ) The authors studied the efficiency of the technological lines based on their technical capabilities. They studied the practical results of checking the dependence of the obtained products quality on the parameters and operating modes of individual units and assemblies. They used well-known private methods developed on their basis. ( Results and discussion ) The authors revealed some technical and technological deviations in the equipment operation: low level of organic raw materials purification when the vibratory separator was 85-90 percent, insufficient power of the disassembler – 3.5 kilowatts; fertilizers dispersion after the reactor exceeded 140 micrometers; the content of the ballast after filtration – 5-8 percent; the level of humic salts was low – from 5 to 10 grams per liter; trace element dosing system was not perfect. The authors suggested continuing the search for technical solutions for production without ballast humates using modular equipment. They identified the need to increase the productivity of technological lines from 1 to 2.5 tons per shift. ( Conclusions ) Based on practical experience in modernizing production lines, the authors suggested optimizing the composition of modular equipment purchased in the market for engineering products. They determined the basic principles of the modular design of technological lines that allowed using the Internet portal to increase production efficiency and obtain a product of demanded quality.

Malware infects thousands of systems globally each day causing millions of dollars in damages. Which disassembler should a malware analyst choose in order to get the most accurate disassembly and be able to detect, analyze and defuse malware quickly? There is no clear answer to this question: (a) the performance of disassemblers varies across configurations, and (b) most prior work on disassemblers focuses on benign software and the x86 CPU architecture. In this work, we take a different approach and ask: why not use all the disassemblers instead of picking one? We present DisCo, a novel and effective approach to harness the collective capability of a group of disassemblers combining their output into an ensemble consensus. We develop and evaluate our approach using 1760 IoT malware binaries compiled with different compilers and compiler options for the ARM and MIPS architectures. First, we show that DisCo can combine the collective wisdom of disassemblers effectively. For example, our approach outperforms the best contributing disassembler by as much as 17.8% in the F1 score for function start identification for MIPS binaries compiled using GCC with O3 option. Second, the collective wisdom of the disassemblers can be brought back to improve each disassembler. As a proof of concept, we show that byte-level signatures identified by DisCo can improve the performance of Ghidra by as much as 13.6% in terms of the F1 score. Third, we quantify the effect of the architecture, the compiler, and the compiler options on the performance of disassemblers. Finally, the systematic evaluation within our approach led to a bug discovery in Ghidra v9.1, which was acknowledged by the Ghidra team.

Recently, we have observed a significant increase in the frequency with which Microsoft Office macros are being used as an attack vector. Microsoft Office uses a macro programming language called Visual Basic for Applications (VBA), which is powerful enough to do whatever the attacker needs. Usually, the malicious VBA macros are used to download the second stage of the malware (ransomware, banking Trojan, backdoor, etc.). They can be relatively small and are easy to modify or even to completely rewrite them each time, thus making them difficult to detect at the perimeter defenses (e.g., with an e-mail scanner) with known-malware detection tools. So far, we have seen malicious VBA macros being distributed with Microsoft Word, Excel, PowerPoint, Access, Visio, Project and Publisher documents. Microsoft Office has built-in protections against execution of foreign macros, but unless properly administered, they are easy for the user to disable and the malicious documents usually use some form of social engineering to convince the user to do so. Therefore, we need proper tools for inspecting the macro content of the received documents, in order to decide whether it contains any malicious code. During our research we have discovered that the publicly available tools lack the capability to discover all forms in which a malicious macro can exist. We have applied our findings from reverse-engineering the formats of Microsoft Office documents and have created a tool, which allows disassembling of the p-code into which VBA is compiled.

When a software transformation or software security task needs to analyze a given program binary, the first step is often disassembly. Since many modern disassemblers have become highly accurate on many binaries, we believe reliable disassembler benchmarking requires standardizing the set of binaries used and the disassembly ground truth about these binaries. This paper presents (i) a first version of our work-in-progress disassembly benchmark suite, which comprises 879 binaries from diverse projects compiled with multiple compilers and optimization settings, and (ii) a novel disassembly ground truth generator leveraging the notion of "listing files", which has broad support by Clang, GCC, ICC, and MSVC. In additional, it presents our evaluation of four prominent open-source disassemblers using this benchmark suite and a custom evaluation system. Our entire system and all generated data are maintained openly on GitHub to encourage community adoption., Revised and extended version of our publication that first appeared in the 2020 Workshop on Forming an Ecosystem Around Software Transformation (FEAST '20), November 13, 2020

The LEGv8 architecture is a restricted representation of the ARMv8 architecture. In this paper, we present a formalisation of the LEGv8 architecture in Agda. We have modelled machine words, the processor state, and the semantics of the instruction set; we also include an assembler and disassembler with round-trip correctness. We explain how dependent types allow us to abstract away some repetitive definitions and drive the correctness proof of the assembler.

In this tutorial, the Ghidra software reverse engineering framework will be presented, its characteristics highlighted and its features to the hitherto industry standard in reverse engineering tools, IDA Pro - the interactive disassembler, compared against. This framework was released on March the 5th 2019, by the National Security Agency under the Apache v2 license and brought with it a powerful decompiler for many different architectures (X86 16/32/64, ARM/AARCH64, Java/DEX bytecode, ...), which will be presented and its underlying intermediate language p-code and the corresponding SLEIGH-format explained. Further, hands-on demonstrations will follow, including the aforementioned SLEIGH-format, the plugin-system and the standalone-mode, showcased on different reverse engineering tasks like binary diffing, code lifting, deobfuscation and patching.

In this paper, a new method of usage forensics memory analysis for compromising the carrier-lock algorithm was proposed. The firmware of one popular 3G modem for security issues is investigated. A binary file is reverse engineered using IDA Pro Disassembler and the carrier-lock code algorithm is found. The reproduction of arithmetic and bitwise ARM commands under the IMEI to obtain the unlock code by way of just reverse engineering become impossible because of the algorithm complexity. Therefore the existed ARM code was used to generate the unlock codes on the fly via memory forensics technique and JTAG debugger. A new method was successfully tested on a set of different modem versions.

BackgroundNatural products are the source of various functional materials such as medicines, and understanding their biosynthetic pathways can provide information that is helpful for their effective production through the synthetic biology approach. A number of studies have aimed to predict biosynthetic pathways from their chemical structures in a retrosynthesis manner; however, sometimes the calculation finishes without reaching the starting material from the target molecule. In order to address this problem, the method to find suitable starting materials is required.ResultsIn this study, we developed a predictive workflow named the Metabolic Disassembler that automatically disassembles the target molecule structure into relevant biosynthetic units (BUs), which are the substructures that correspond to the starting materials in the biosynthesis pathway. This workflow uses a biosynthetic unit library (BUL), which contains starting materials, key intermediates, and their derivatives. We obtained the starting materials from the KEGG PATHWAY database, and 765 BUs were registered in the BUL. We then examined the proposed workflow to optimize the combination of the BUs. To evaluate the performance of the proposed Metabolic Disassembler workflow, we used 943 molecules that are included in the secondary metabolism maps of KEGG PATHWAY. About 95.8% of them (903 molecules) were correctly disassembled by our proposed workflow. For comparison, we also implemented a genetic algorithm-based workflow, and found that the accuracy was only about 52.0%. In addition, for 90.7% of molecules, our workflow finished the calculation within one minute.ConclusionsThe Metabolic Disassembler enabled the effective disassembly of natural products in terms of both correctness and computational time. It also outputs automatically highlighted color-coded substructures corresponding to the BUs to help users understand the calculation results. The users do not have to specify starting molecules in advance, and can input any target molecule, even if it is not in databases. Our workflow will be very useful for understanding and predicting the biosynthesis of natural products.

Processor verification is a very complex task. Even simple system has plenty of blocks which must work together in a determined way. Modern digital systems use advanced techniques to improve throughput and reduce power consumption. It enhances risk of error and consequently verification process requires a significant and continuous resources. This article presents the approach to create design and verification environment for RISC-V processor cores. The environment consists of behavioral golden reference model and online disassembler module, as well as a set of scripts for setting up software infrastructure. Golden reference model running in master-checker mode with core under design allows faulty behavior to be detected instantly while running direct tests or random verification technique.

Дипломна робота: 85 с., 25 рис., 14 табл., 2 дод., 13 джерел. Актуальність теми: мова асемблера є потужним інструментом, що допомагає виявити всі особливості апаратного та програмного забезпечення. Тож дане дослідження, тобто побудова системи асемблювання та віртуальної машини, є необхідним для розуміння архітектури комп'ютера. Метою даної роботи є дослiдження в галузi асемблювання, а саме виконання процесу візуалізації роботи пам'яті. Об’єктом дослідження є синтаксис мови асемблера програми Corewar.. Методи дослiдження: мова асемблеру , системи числення. Пiсля побудови моделей було проведено аналiз результатiв роботи програмного продукту. Отриманi результати: розроблений програмний продукт складається з асемблера, дизасемблера, віртуальної машини та інструменту для візуалізації роботи пам'яті віртуальної машини. The theme: «The system of assembling and memory work visualization». Thesis explanatory note: 85 p., 25 fig., 14 tabl., 2 append., 3 sources. Actuality: Assembler language is a powerful tool that helps to identify all the features of hardware and software. Therefore, this study, that is, the construction of the assembly system and the virtual machine, is necessary for understanding the architecture of the computer. The purpose of this work is the research in the field of assembling, namely the execution of the process of visualizing memory work. The purpose of the work is the syntax of the assembly language language of the Corewar program. Methods of research: assembler language, numerical systems. Methods of research: assembler language, numerical systems. Following the construction of the models, an analysis of the results of the software product was conducted. Obtained results: The software product developed consists of an assembler, a disassembler, a virtual machine and a tool for visualizing the memory of the virtual machine.

Disassembling stripped binaries is a prominent challenge for binary analysis, due to the interleaving of code segments and data, and the difficulties of resolving control transfer targets of indirect calls and jumps. As a result, most existing disassemblers have both false positives (FP) and false negatives (FN). We observe that uncertainty is inevitable in disassembly due to the information loss during compilation and code generation. Therefore, we propose to model such uncertainty using probabilities and propose a novel disassembly technique, which computes a probability for each address in the code space, indicating its likelihood of being a true positive instruction. The probability is computed from a set of features that are reachable to an address, including control flow and data flow features. Our experiments with more than two thousands binaries show that our technique does not have any FN and has only 3.7% FP. In comparison, a state-of-the-art superset disassembly technique has 85% FP. A rewriter built on our disassembly can generate binaries that are only half of the size of those by superset disassembly and run 3% faster. While many widely-used disassemblers such as IDA and BAP suffer from missing function entries, our experiment also shows that even without any function entry information, our disassembler can still achieve 0 FN and 6.8% FP.

Nowadays, it is challenging for traditional static malware detection method to keep pace with the rapid development of malware variants, therefore machine learning based malware detection approaches begin to flourish. Typically, operation codes disassembled from binary programs were sent to classifiers e.g. SVM and KNN for classification recognition. However, this feature extraction method does not make full use of sequence relations between opcodes, at the same time, the classification model still has less dimensions and lower matching ability. Therefore, a malware detection model based on residual network was proposed in this paper. Firstly, the model extracts the opcode sequences using the disassembler. To improve the vector’s expressibility of opcodes, Word2Vec strategy was used in the representation of opcodes, and word vector representations of opcodes were also optimized in the process of training iteration. Unfortunately, the overlapping opcode matrix and convolution operation results in information redundancies. To overcome this problem, a method of downsampling to organize opcode sequences into opcode matrix was adopted, which can effectively control the time and space complexity. In order to improve the classification ability of the model, a classifier with more layers and cross-layer connection was proposed to match malicious code in more dimensions based on ResNet. The experiment shows that the malware classification accuracy in this paper is 98.2%. At the same time, the processing time consumption comparing with traditional classifiers is still negligible.

International audience; Side-Channel Based Disassembling (SCBD) is a powerful application of side-channel analysis that allows recovering instructions executed by a processor from its physical leakages, such as the electromagnetic field (EM) emitted by the chip. These attacks directly compromise code confidentiality, but they can also reveal to an adversary many critical information on the system's internals. In this work, we propose a new approach for SCBD that directly focuses the bit encoding of an instruction using local EM leakage. We exploit a very precise bit-level leakage model and derive from it new algorithms that aim at recovering the actual bit values. We also propose strategies to automate the complex tasks of finding the best EM probe positions and combining them to improve results. On a PIC16 target, our method succeed in recovering the bits of an instruction with an average rate of 99,41% per bit. Compared to the state of the art, our disassembler is easier to train, recovers more information about instructions than just opcode and requires almost no modifications to target other processor architectures. Thus, this kind of disassemblers might become a threat to more complex processors, where side-channel disassembling has not been proved to be feasible yet.

Malware means malicious software. Detecting malware over a system is malware analysis. It consists of two parts static analysis and dynamic analysis. Static analysis includes analysing a suspicious file and dynamic analysis means observing a file during its process time. In this paper, we have proposed a framework for malware analysis based on semi automated malware detection usually machine learning which is based on dynamic malware detection. The framework shows the quality of experience (QoE) to maintain the efficiency tradeoffs and uses the method of classification. The samples of malware also shows that the framework create a strong detection method.

In this work, disassembler effect has been investigated on the detection performance of opcode-based malware detection methods. Opcode analysis is widely used to detect malware programs. Our experimental results presented which disassembler is more suitable with the analysis method for the best performance. Therefore, researchers will be guided with the results obtained in this work for their static opcode based PE file analysis.

The language FlexT (Flexible Types) is intended for specification of binary data formats. The language is declarative and designed to be well understood for human readers. Its main elements are the data type declarations, which look very much like the usual type declarations of the imperative programming languages, but are more flexible. In the article we first give a review of the capabilities of the modern projects oriented to specification of binary file formats. Then we consider the main features of the FlexT language and, in particular, the features that help to describe the formats of encoding of machine instructions. Finally we briefly describe the software developed, which is based upon the FlexT interpreter and some new capabilities of information search, which makes possible the use of the specifications.

Selfie is a self-contained 64-bit, 10-KLOC implementation of (1) a self-compiling compiler written in a tiny subset of C called C* targeting a tiny subset of 64-bit RISC-V called RISC-U, (2) a self-executing RISC-U emulator, (3) a self-hosting hypervisor that virtualizes the emulated RISC-U machine, and (4) a prototypical symbolic execution engine that executes RISC-U symbolically. Selfie can compile, execute, and virtualize itself any number of times in a single invocation of the system given adequate resources. There is also a simple linker, disassembler, debugger, and profiler. C* supports only two data types, uint64_t and uint64_t*, and RISC-U features just 14 instructions, in particular for unsigned arithmetic only, which significantly simplifies reasoning about correctness. Selfie has originally been developed just for educational purposes but has by now become a research platform as well. We discuss how selfie leverages the synergy of integrating compiler, target machine, and hypervisor in one self-referential package while orthogonalizing bootstrapping, virtual and heap memory management, emulated and virtualized concurrency, and even replay debugging and symbolic execution.

In this study, a pure structural implementation based, 32-bit open source RISC-V processor is presented. The proposed processor is designed using Verilog and it is implemented on Cyclone IV 4CE115 FPGA device available on Altera DE2-115 Board. Additionally, web-based assembler and disassembler tools are developed and published as a part of this project. Before using the target RISC-V processor, the user can generate machine code using the web-based assembler tool. Then, the generated machine code can be downloaded onto the RISC-V processor using UART. The web-based assembler and disassembler tools are developed with technologies such as HTML5, CSS and JavaScript. The proposed processor is a fully functional processor that uses RV32I base integer instructional set with 37 instructions. The amount of hardware resources used by the whole processor circuit is about 43.7% of the Cyclone IV 4CE115 FPGA device and the maximum frequency achieved for the processor is 150MHz without using any timing constraint.

Obtaining a list of programs linear blocks and the links between them is used in the tasks of research and software protection. According to the results of abstracting, the authors have not found the means of analysis of binary files to obtain this information. The purpose of the study is to facilitate the analysis of the software by creating a unified data provider about the structure of the analyzed program. The approach proposed in the research is focused on the decomposition and presentation of program code as a set of interrelated linear blocks and their relations. Presented in such form a code can be analyzed to identify patterns which have certain characteristics, which simplifies the process of secure software development. The proposed method is based on the development of a plugin that aggregates data from existing tools. The method of information extraction from the "IDA" disassembler and presentation in the form necessary for further work is developed. There is presented method's verification tests example. The data generated according to the methodology are intended for use in targeted software analysis tools

At this paper focus on Malicous Software also known as Malware APT1 (Advance Persistent Threat) codename WEBC2-DIV the most variants malware has criteria consists of Virus, Worm, Trojan, Adware, Spyware, Backdoor either Rootkit. Although, malware could avoidance scanning antivirus but reverse engineering could be know how dangerous malware infect computer client. Lately, malware attack as a form espionage (cyberwar) one of the most topic on security internet, because of has massive impact. Forensic malware becomes indicator successfull user to realized about malware infect. This research about reverse engineering. A few steps there are scanning, suspected packet in network and analysis of malware behavior and dissambler body malware.Keyword : forensic malware, Analysis, Advance Presistent Threat, Cyberwar, dissambler

At this paper focus on Malicious Software also known as Malware APT1 (Advance Persistent Threat) codename WEBC2-DIV the most variants malware has criteria consists of Virus, Worm, Trojan, Adware, Spyware, Backdoor either Rootkit. Although, malware could avoidance scanning antivirus but reverse engineering could be know how dangerous malware infect computer client. Lately, malware attack as a form espionage (cyberwar) one of the most topic on security internet, because of has massive impact. Forensic malware becomes indicator successful user to realized about malware infect. This research about reverse engineering. A few steps there are scanning, suspected packet in network and analysis of malware behavior and disassembler body malware.

Code similarity measures create a comparison metric showing to what degree two code samples have the same functionality, e.g., to statically detect the use of known libraries in binary code. They are both an indispensable part of automated malware analysis, as well as a helper for the detection of plagiarism (IP protection) and the illegal use of open-source libraries in commercial apps. The centroid similarity metric extracts control-flow features from binary code and encodes them as geometric structures before comparing them. In our paper, we propose novel improvements to the centroid approach and apply it to the ARM architecture for the first time. We implement our approach as a plug-in for the IDA Pro disassembler and evaluate it regarding efficiency, accuracy and robustness on Android. Based on a dataset of 508,745 APKs, collected from 18 third-party app markets, we achieve a detection rate of 89% for the use of native code libraries, with an FPR of 10.8%. To test the robustness of our approach against the compiler version, optimization level, and other code transformations, we obfuscate and recompile known open-source libraries to evaluate which code transformations are resisted. Based on our results, we discuss how code re-use can be hidden by obfuscation and conclude with possible improvements.

Malicious software poses serious threats to our lives, and the activity to detect malware is becoming more and more important. An effective approach is to train a classifier using known software samples and malware samples, and recognize malware from new software. To do that, a recent popular trend is to use OpCode, which is extracted from executable modules, as an expression of software entities to drive machine learning. However, we found that the effectiveness of such a framework highly suffers from having insufficient samples, which is caused by the low success rate of disassembly due to the intrinsic complexity of the problem. In this paper, we propose to increase the success rate of disassembly by allowing inaccurate disassembling, with the attempt to increase the number of successful disassembled samples to improve OpCode-driven malware detection. We built a lightweight disassembler D-light based on the linear swap disassembly method to avoid known issues with the recursive descent manner of IDA Pro. We carried out experiment to evaluate the performance, effectiveness, and other design factors of adopting D-light and IDA Pro as disassemblers for malware detection. The empirical study shows the D-light is both more efficient and more effective than IDA Pro in supporting malware detection.

Modern embedded computing devices are vulnerable against mal-ware and software piracy due to insufficient security scrutiny and the complications of continuous patching. To detect malicious activity as well as protecting the integrity of executable software, it is necessary to monitor the operation of such devices. In this paper, we propose a disassembler based on power-based side-channel to analyze the real-time operation of embedded systems at instruction-level granularity. The proposed disassembler obtains templates from an original device (e.g., IoT home security system, smart thermostat, etc.) and utilizes machine learning algorithms to uniquely identify instructions executed on the device. The feature selection using Kullback-Leibler (KL) divergence and the dimensional reduction using PCA in the time-frequency domain are proposed to increase the identification accuracy. Moreover, a hierarchical classification framework is proposed to reduce the computational complexity associated with large instruction sets. In addition, covariate shifts caused by different environmental measurements and device-to-device variations are minimized by our covariate shift adaptation technique. We implement this disassembler on an AVR 8-bit microcontroller. Experimental results demonstrate that our proposed disassembler can recognize test instructions including register names with a success rate no lower than 99.03% with quadratic discriminant analysis (QDA).

This paper presents the fusion of two subdomains of digital forensics: (1) raw memory analysis and (2) approximate matching. Specifically, this paper describes a prototype implementation named MRSH-MEM that allows to compare hard drive images as well as memory dumps and therefore can answer the question if a particular program (installed on a hard drive) is currently running / loaded in memory. To answer this question, we only require both dumps or access to a public repository which provides the binaries to be tested. For our prototype, we modified an existing approximate matching algorithm named MRSH-NET and combined it with approxis, an approximate disassembler. Recent literature claims that approximate matching techniques are slow and hardly applicable to the field of memory forensics. Especially legitimate changes to executables in memory caused by the loader itself prevent the application of current bytewise approximate matching techniques. Our approach lowers the impact of modified code in memory and shows a good computational performance. During our experiments, we show how an investigator can leverage meaningful insights by combining data gained from a hard disk image and raw memory dumps with a practicability runtime performance. Lastly, our current implementation will be integrable into the Volatility memory forensics framework and we introduce new possibilities for providing data driven cross validation functions. Our current proof of concept implementation supports Linux based raw memory dumps.

We present a new type of attack termed denial of engineering operations in which an attacker can interfere with the normal cycle of an engineering operation leading to a loss of situational awareness. Specifically, the attacker can deceive the engineering software during attempts to retrieve the ladder logic program from a programmable logic controller (PLC) by manipulating the ladder logic on the PLC, such that the software is unable to process it while the PLC continues to execute it successfully. This attack vector can provide sufficient cover for the attacker»s actual scenario to play out while the owner tries to understand the problem and reestablish positive operational control. To enable the forensic analysis and, eventually, eliminate the threat, we have developed the first decompiler for ladder logic programs. Ladder logic is a graphical programming language for PLCs that control physical processes such as power grid, pipelines, and chemical plants; PLCs are a common target of malicious modifications leading to the compromise of the control behavior (and potentially serious consequences). Our decompiler, Laddis, transforms a low-level representation to its corresponding high-level original representation comprising of graphical symbols and connections. The evaluation of the accuracy of the decompiler on the program of varying complexity demonstrates perfect reconstruction of the original program. We present three new attack scenarios on PLC-deployed ladder logic and demonstrate the effectiveness of the decompiler on these scenarios.

The discipline of detecting known and unknown code structures in large sets of data is a challenging task. An example could be the examination of memory dumps of an infected system. Memory forensic frameworks rely on system relevant information and the examination of structures which are located within a dump itself. With the constant increasing size of used memory, the creation of additional methods of data reduction (similar to those in disk forensics) are eligible. In the field of disk forensics, approximate matching algorithms are well known. However, in the field of memory forensics, the application of those algorithms is impractical. In this paper we introduce approxis: an approximate disassembler. In contrary to other disassemblers our approach does not rely on an internal disassembler engine, as the system is based on a compressed set of ground truth x86 and x86-64 assemblies. Our first prototype shows a good computational performance and is able to detect code in large sets of raw data. Additionally, our current implementation is able to differentiate between architectures while disassembling. Summarized, approxis is the first attempt to interface approximate matching with the field of memory forensics.

Comparison of two binary files has many practical applications: the ability to detect programmatic changes between two versions, the ability to find old versions of statically linked libraries to prevent the use of well-known bugs, malware analysis, etc. In this article, a framework for comparison of binary files is presented. Framework uses IdaPro [1] disassembler and Binnavi [2] platform to recover structure of the target program and represent it as a call graph (CG). A program dependence graph (PDG) corresponds to each vertex of the CG. The proposed comparison algorithm consists of two main stages. At the first stage, several heuristics are applied to find the exact matches. Two functions are matched if at least one of the calculated heuristics is the same and unique in both binaries. At the second stage, backward and forward slicing is applied on matched vertices of CG to find further matches. According to empiric results heuristic method is effective and has high matching quality for unchanged or slightly modified functions. As a contradiction, to match heavily modified functions, binary code clone detection is used and it is based on finding maximum common subgraph for pair of PDGs. To achieve high performance on extensive binaries, the whole matching process is parallelized. The framework is tested on the number of real world libraries, such as python, openssh, openssl, libxml2, rsync, php, etc. Results show that in most cases more than 95% functions are truly matched. The tool is scalable due to parallelization of functions matching process and generation of PDGs and CGs.

The paper presents methods of executable file signature creation based on frequency distributions of their informative features to be applied for program identification. Identification here should be understood as a process of file recognition by establishing its coincidence with a particular program. A new approach to creation of the archive of program signatures, both in terms of byte-frequency distribution of a program's binary code, and in terms of frequency distribution of assembler commands in their disassembler codes, is presented. The new method of executable file identification is offered and the results of experiments on their identification using a statistical criterion of φ * -Fisher and analysis of the slope are provided. The proposed method can be used to audit data-storage medium.

There are many mobile operating systems for different smartphones. iOS is one of them available exclusively on Apple devices. It offers various features such as GPS tracking, Siri, multi touch gestures, biometric authentication etc. The functionality of an iOS device can be expanded by installing third party applications, available from App store. Apple follows a mandatory code signing process to ensure that applications are developed by trusted enterprises/developers and no malware exists on App Store. However, past attacks on iOS devices such as ikee, Wirelurker have revealed that Apple's code signing process is not sufficient to ensure the security of its devices. Considering past attacks on iOS devices and with view of analyzing the behavior of iOS applications, this paper aims to describe how an analyst can perform reverse engineering of iOS applications by disassembling, decompiling and debugging application's code using Disassembler to discover the vulnerable areas.

Presilicon simulation is one of the key toolsets for computer architects to evaluate and optimize their future designs. As Graphics Processing Units (GPUs) have become the platform of choice in many computing communities due to their impressive processing capabilities, computer architecture researchers need a simulation framework that allows them to quantitatively consider design tradeoffs. In this paper, we present the Multi2Sim Kepler simulator framework, a new detailed GPU microarchitecture performance simulator that supports NVIDIA's Kepler shader assembly (SASS) code execution. The toolset provides a disassembler, a functional simulator and a detailed cycle-based simulator. We provide insight into the architecture of the NVIDIA Kepler GPU, describing the details of the streaming multiprocessor, front-end and instruction pipelines. We compare the performance of this new simulator against an NVIDIA K20X, a high-end Kepler device. We also evaluate the performance of NVIDIA's CUDA benchmark suite on our GPU performance simulator.

This paper presents a framework for generating assembler and disassembler from ADL (architecture description language), which enables processor architecture designers to explore a large design space by quickly modifying the architecture description written in high abstraction level ADL. We present our ADL: GADL(GNU tool chain based ADL) and propose the binary utilities generation algorithms for GADL. Some issues are discussed and resolved which have not been covered by related research. We have implemented the binary utilities generator with the proposed algorithms and used it to generate the binary utilities for a DSP we are designing, which shows the efficiency of the algorithms.

Static analysis of malicious software is a complicated process. This complication stems from the fact that the process of analysis has to be carried out on the malicious binary file which is represented in assembly language and therefore lacks critical semantics such as functions, types and bu ffers that are only found in the source code of high-level languages. This work presents a method that is built on top of IDA Pro disassembler and can be used for analysis of binary files by describing their structure using finite-state automaton. This kind of approach allows a reverse engineer to perform advanced features such as visualization, comparison, etc on a malicious file.

From inception, side channel leakage has been widely used for the purposes of extracting secret information, such as cryptographic keys, from embedded devices. However, in a few instances it has been utilized for extracting other information about the internal state of a computing device. In this paper, we exploit side channel information to recover large parts of the Sykipot malware program executed on a smart card. We present the first methodology to recover the program code of a smart card malware by evaluating its power consumption only. Besides well-studied methods from side channel analysis, we apply a combination of dimensionality reduction techniques in the form of PCA and LDA models to compress the large amount of data generated while preserving as much variance of the original data as possible. Among feature extraction techniques, PCA and LDA are very common dimensionality reduction algorithms that have successfully been applied in many classification problems like face recognition, character recognition, speech recognition, etc. with the chief objective being to eliminate insignificant data (without losing too much information) during the pre-processing step. In addition to quantifying the potential of the created side channel based disassembler, we highlight its diverse and unique application scenarios.

At this paper focus on Malicious Software also known as Malware APT1 (Advance Persistent Threat) codename WEBC2-DIV the most variants malware has criteria consists of Virus, Worm, Trojan, Adware, Spyware, Backdoor either Rootkit. Although, malware could avoidance scanning antivirus but reverse engineering could be know how dangerous malware infect computer client. Lately, malware attack as a form espionage (cyberwar) one of the most topic on security internet, because of has massive impact. Forensic malware becomes indicator successful user to realized about malware infect. This research about reverse engineering. A few steps there are scanning, suspected packet in network and analysis of malware behavior and disassembler body malware.

Runtime executable code compression is a method which uses standard data compression methods and binary machine code transformations to achieve smaller le size, yet maintaining the ability to execute the compressed le as a regular executable. With a disassembler, an almost perfect instructional and functional level disassembly can be generated. Using the structural information of the compiled machine code each function can be split into so called basic blocks. In this work we show that reordering instructions within basic blocks using data ow constraints can improve code compression without changing the behavior of the code. We use two kinds of data aection (read, write) and 20 data types including registers: 8 basic x86 registers, 11 eags, and memory data. Due to the complexity of the reordering, some simplication is required. Our solution is to search local optimum of the compression on the function level and then combine the results to get a suboptimal global result. Using the reordering method better results can be achieved, namely the compression size gain for gzip can be as high as 1.24%, for lzma 0.68% on the tested executables.

Embedded software is rapidly increasing in complexity. To cope with this, developers rely on third-party IPs to accelerate product delivery. However, IP source code might not be available which limits verifiability. This creates a particular challenge especially in safety-critical applications, e.g., automotive. Static Binary Analysis (SBA) is a promising technique to address such a challenge by providing engineers with the ability to reason about the actual instructions executed for all possible inputs. Disassembly is the fundamental first step for any SBA where assembly instructions are recovered from binary code. Correct disassembly, however, is challenging since data is mixed with code in binaries. Moreover, variable-size ISA, e.g., Thumb and TriCore, allow a single byte sequence to have multiple valid interpretations. We introduce Spedi, an open source SPEculative DIsassembler for Thumb ISA. Spedi is based on a principled approach to disassembly where all possible basic blocks are speculatively recovered. Then, basic blocks are refined using conflict analyses to identify assembly instructions. Experiments using a wide range of benchmarks demonstrate that Spedi is both fast and effective. It outperforms IDA Pro, the de-facto industry standard disassembler, in terms of disassembly correctness. Spedi can also recover the majority of the call graph and switch table targets. It is resilient to obfuscation and doesn't use any symbol information which makes it a suitable front-end for a wide variety of SBA applications including security analysis.

As currently classical malware detection methods based on signatures fail to detect new malware, they are not always efficient with new obfuscation techniques. Besides, new malware is easily created and old malware can be recoded to produce new one. Therefore, classical Antivirus becomes consistently less effective in dealing with those new threats. Also malware gets hand tailored to bypass network security and Antivirus. But as analysts do not have enough time to dissect suspected malware by hand, automated approaches have been developed. To cope with the mass of new malware, statistical and machine learning methods proved to be a good approach classifying programs, especially when using multiple approaches together to provide a likelihood of software being malicious. In normal approach, some steps have been taken, mostly by analyzing the opcodes or mnemonics of disassembly and their distribution. In this paper, we focus on the control flow change (CFC) itself and finding out if it is significant to detect malware. In the scope of this work, only relative control flow changes are contemplated, as these are easier to extract from the first chosen disassembler library and are within a range of 256 addresses. These features are analyzed as a raw feature, as n-grams of length 2, 4 and 6 and the even more abstract feature of the occurrences of the n-grams is used. Statistical methods were used as well as the Naive-Bayes algorithm to find out if there is significant data in CFC. We also test our approach with real-world datasets.

This paper presents a tool BE-PUM (Binary Emulator for PUshdown Model generation), which generates a precise control flow graph (CFG), under presence of typical obfuscation techniques of malware, e.g., indirect jump, self-modification, overlapping instructions, and structured exception handler (SEH), which cover packers. Experiments are performed on 2000 real-world malware examples taken from VX Heaven and compare the results of a popular commercial disassembler IDA Pro, a state-of-the-art tool JakStab, and BE-PUM. It shows that BE-PUM correctly traces CFGs, whereas IDA Pro and JakStab fail. By manual inspection on 300 malware examples, we also observe that the starts of these failures exactly locate the entries of obfuscation code.

The paper describes the implementation of a programming tool for measuring the quality characteristics of an assembly code. The aim of this paper is to prove the usability of these metrics for evaluation of an assembly code's quality, which is generated by C Compiler for 32bit DSP architecture. The analysis of test results has shown that the compiler generates a good quality assembly code.

This article proposes an alternative yet effective way of constructing a multiplatform binary translator, by converting a retargetable compiler into a binary translator. The rationale is that a retargetable compiler usually parses source programs into an Intermediate Representation (IR), and then translates IR into object code of different targets after performing analysis and optimizations. Specifically, the mechanism of code generation for multiple platforms from IR is already in place, and the missing link of building a multiplatform binary translator is a tool to transform binary programs back into IR. In order to fill in this missing link, this article presents a tool, called the disIRer . Just as a translator from machine language to assembly language is called a disassembler, a tool that translates executable binary programs to IR is called here a disIRer. The unique feature of this approach is that the retargetability of the binary translator is inherited directly from the retargetable compiler. A prototype multiplatform binary translator has been implemented upon GCC (the GNU Compiler Collection). DisIRer first converts binary programs back into GCC IR (Intermediate Representation), and afterward the GCC backend translates the IR to target binary programs of specified platforms. Experimental results show that x86 binary programs can be translated by this technique into ARM and Alpha binaries with reasonable code density and quality.