TC: EAGER: Binary-based Data Structure Revelation for Memory Forensics

TC：EAGER：用于内存取证的基于二进制的数据结构揭示

• 批准号: 1049303
• 负责人: Dongyan Xu
• 金额: $ 20万
• 依托单位: Purdue University
• 依托单位国家: 美国
• 项目类别: Standard Grant
• 财政年份: 2010
• 资助国家: 美国
• 起止时间: 2010-09-01 至 2013-08-31
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=1049303&HistoricalAwards=false
• 关键词: TC; EAGER; Binary; based; Data

Today's computer users often run programs for which they do not have the source code. In some cases, those programs are viruses or other malware, and it is desirable to understand how they work in order to prevent them from causing further damage or to track down the author. Part of the process of understanding the program (sometimes called "reverse engineering")is to understand how it stores data. This research develops a new technique for revealing the data structures in programs for which only the binary code is available called REWARDS -- Reverse Engeineering Work for Automatic Revelation of Data Structures. The tools developed by the research are evaluated against both benign and malicious programs.

今天的计算机用户经常运行他们没有源代码的程序。 在某些情况下，这些程序是病毒或其他恶意软件，并且希望了解它们是如何工作的，以便防止它们造成进一步的损害或追踪作者。 理解程序的过程（有时称为“逆向工程”）的一部分是理解它如何存储数据。 本研究开发了一种新的技术，用于揭示程序中的数据结构，对于只有二进制代码是可用的，称为奖励-反向工程工作的数据结构的自动揭示。 该研究开发的工具进行评估，对良性和恶意程序。