TY - JOUR
TI - Context-sensitive analysis without calling-context
AU - Lakhotia, Arun
AU - Boccardo, Davidson R.
AU - Singh, Anshuman
AU - Jr, Aleardo Manacero
T2 - Higher-Order and Symbolic Computation
AB - Since Sharir and Pnueli, algorithms for context-sensitivity have been defined in terms of ‘valid’ paths in an interprocedural flow graph. The definition of valid paths requires atomic call and ret statements, and encapsulated procedures. Thus, the resulting algorithms are not directly applicable when behavior similar to call and ret instructions may be realized using non-atomic statements, or when procedures do not have rigid boundaries, such as with programs in low level languages like assembly or RTL. We present a framework for context-sensitive analysis that requires neither atomic call and ret instructions, nor encapsulated procedures. The framework presented decouples the transfer of control semantics and the context manipulation semantics of statements. A new definition of context-sensitivity, called stack contexts, is developed. A stack context, which is defined using trace semantics, is more general than Sharir and Pnueli’s interprocedural path based calling-context. An abstract interpretation based framework is developed to reason about stack-contexts and to derive analogues of calling-context based algorithms using stack-context. The framework presented is suitable for deriving algorithms for analyzing binary programs, such as malware, that employ obfuscations with the deliberate intent of defeating automated analysis. The framework is used to create a context-sensitive version of Venable et al.’s algorithm for analyzing x86 binaries without requiring that a binary conforms to a standard compilation model for maintaining procedures, calls, and returns. Experimental results show that a context-sensitive analysis using stack-context performs just as well for programs where the use of Sharir and Pnueli’s calling-context produces correct approximations. However, if those programs are transformed to use call obfuscations, a context-sensitive analysis using stack-context still provides the same, correct results and without any additional overhead.
DA - 2010/09/01/
PY - 2010
DO - 10.1007/s10990-011-9080-1
DP - link.springer.com
VL - 23
IS - 3
SP - 275
EP - 313
J2 - Higher-Order Symb Comput
LA - en
SN - 1388-3690, 1573-0557
UR - http://link.springer.com/article/10.1007/s10990-011-9080-1
Y2 - 2014/01/06/20:51:54
KW - Analysis of binaries
KW - Computational Intelligence
KW - Computational Mathematics and Numerical Analysis
KW - Mathematical Logic and Formal Languages
KW - Symbolic and Algebraic Manipulation
KW - context-sensitive analysis
KW - deobfuscation
KW - obfuscation
ER -