论文部分内容阅读
Reversing the syntactic structure of program inputs and data structures of binary executables plays a vital role for understand the program behaviors in software security applications.In this paper,we propose a collaborative reversing technique by capturing the mapping relationship between input fields and program data structures.The key insight is that program uses different data structures as references for different input fields,which could be a reliable pattern to reverse both input formats and program data structures.In details,we use a fine-grained dynamic taint analysis to monitor the propagation of inputs.Then we could collaboratively reverse input fields and program data structures by identify the base pointers for each byte in the input to reverse data structures referencing inputs,and conversely identifying fields based on their referenced data structures.We construct several experiments to evaluate the effectiveness on precise reversed structures,and security applications,and the experiment results show that our approach could effectively reverse precise input formats,and provides unique benefits to two applications,exploit diagnosis and malware analysis.