BISTRO: A Tool for Binary Component Extraction and Embedding
- 總結
- Researchers at Purdue University have developed BISTRO, a systematic approach to binary functional component extraction and embedding. BISTRO automatically performs the extraction of a functional component, with its instructions and data section entries non-contiguously located in the virtual address space, from an original binary program. This technology is also capable of embedding a binary component of any size and at any user-specified location in a target binary program without requiring symbolic information, relocation information, or compiler support. For both extraction and embedding, BISTRO preserves the functionalities of the target binary program and the extracted component by accurately patching them, using the same approach and technique. BISTRO performs extraction and embedding operations efficiently. After embedding, the "stretched" target binary program only incurs minor time and space overhead.
- 技術優勢
- Does not require relocation information or special compiler supportWorks for both user-level programs and kernel-level programs Preserves the functionality of the target binary program and the extracted componentThe target binary incurs lower time and space overhead
- 技術應用
- Computer Security
- 詳細技術說明
- Dongyan XuPurdue Computer Science
- *Abstract
-
- *Background
- In software security and malware analysis, researchers often need to manipulate binary program, benign or malicious, without source code. A useful pair of binary manipulation primitives is binary functional component extraction and embedding. This pair is used for extracting a functional component from a binary program and for embedding a functional component in a binary program, respectively. Such primitives are applicable to a wide range of security scenarios such as legacy program hardening, binary semantic patching, and malware function analysis. Unfortunately, existing binary rewriting techniques are inadequate to support binary function carving and embedding.
- *IP Issue Date
- None
- *IP Type
- Utility
- *Stage of Development
- Prototype Testing
- *Web Links
- Purdue Office of Technology CommercializationPurdueInnovation and EntrepreneurshipDongyan XuComputer Science
- 國家
- United States
- 申請號碼
- None
- 國家/地區
- 美國
欲了解更多信息，請點擊 這裡
