SHF: Medium: MACANTOK -- a MAchine-Code-ANalysis TOol Kit -- and its Applications

点击翻译按钮获取中文摘要

Recent work has revealed how important it is to examine theproperties of programs after they have been translated to machinecode. For instance, many security exploits depend onplatform-specific features that are not visible at the source-codelevel, such as memory-layout details (e.g., the offsets of variablesin activation records and padding between fields of a structure). Theexpected contributions of the project include (i) alanguage-independent tool generator that, from a formal specificationof a given instruction set's syntax and semantics, generatesimplementations of dynamic-analysis, static-analysis, andsymbolic-evaluation components tailored to that instruction set, and(ii) a variety of prototype language-specific applications (i.e.,specific machine-code-analysis tools), including o A tool to automate the detection of bugs and security vulnerabilities in machine code. The aim is to identify definite bugs and vulnerabilities, and information about what is required to trigger them. o A tool to check sequencing properties on machine code. o A tool that can aid in detecting interoperability problems among components by inferring input/output and network-communication formats, and by summarizing the behavior of a component's client.The results will help programmers create correct, reliable, and securesoftware systems by providing them with new kinds of tools to (a) verifyproperties of a program?s behavior, and (b) find potential bugs andsecurity vulnerabilities.