GPU-Disasm: A GPU-Based X86 Disassembler
GPU-Disasm: A GPU-Based X86 Disassembler
复制标题
GPU-Disasm：基于 GPU 的 X86 反汇编器
DOI：
10.1007/978-3-319-23318-5_26
复制
发表时间：
2015
影响因子：
4
通讯作者：
G. Portokalidis
中科院分区：
文献类型：
--
作者：
E. Ladakis;Giorgos Vasiliadis;M. Polychronakis;S. Ioannidis;G. Portokalidis
静态二进制代码分析和逆向工程是恶意软件分析，二进制软件保护，调试和修补的关键操作，以及许多其他任务。更快的二进制代码分析工具对于分析每天收集的许多新恶意软件样本等任务是必需的。二进制代码拆卸是此类工具的核心功能，从性能的角度来看，它没有得到足够的关注。在本文中，我们介绍了GPU-Disasm，这是一种基于GPU的X86代码拆卸框架，它利用图形处理器来实现对二进制可执行文件的有效大规模分析。我们详细描述了各种优化和设计决策，以实现并行的同时构造多个二进制文件，以及并行内部的多个二进制文件，以并行解码相同二进制的多个指令。我们在性能和功耗方面的实验评估结果表明，GPU-DISASS的速度是线性拆卸的CPU拆卸器的两倍，而详尽的拆卸速度则快4.4倍，并且功耗可与仅CPU仅实施相当。
Static binary code analysis and reverse engineering are crucial operations for malware analysis, binary-level software protections, debugging, and patching, among many other tasks. Faster binary code analysis tools are necessary for tasks such as analyzing the multitude of new malware samples gathered every day. Binary code disassembly is a core functionality of such tools which has not received enough attention from a performance perspective. In this paper we introduce GPU-Disasm, a GPU-based disassembly framework for x86 code that takes advantage of graphics processors to achieve efficient large-scale analysis of binary executables. We describe in detail various optimizations and design decisions for achieving both inter-parallelism, to disassemble multiple binaries in parallel, as well as intra-parallelism, to decode multiple instructions of the same binary in parallel. The results of our experimental evaluation in terms of performance and power consumption demonstrate that GPU-Disasm is twice as fast than a CPU disassembler for linear disassembly and 4.4 times faster for exhaustive disassembly, with power consumption comparable to CPU-only implementations.