TY - GEN
T1 - Analysis oF exception-based control transfers
AU - Yadegari, Babak
AU - Stephens, Jon
AU - Debray, Saumya
N1 - Funding Information:
This research was supported in part by the National Science Foundation (NSF) under grants III-1318343, CNS-1318955, and CNS-1525820.
PY - 2017/3/22
Y1 - 2017/3/22
N2 - Dynamic taint analysis and symbolic execution find many important applications in security-related program analyses. However, current techniques for such analyses do not take proper account of control transfers due to exceptions. As a result, they can fail to account for implicit ows arising from exception-based control transfers, leading to loss of precision and potential false negatives in analysis results. While the idea of using exceptions for obfuscating (unconditional) control transfers is well known, we are not aware of any prior work discussing the use of exceptions to implement condi-Tional control transfers and implicit information ows. This paper demonstrates the problems that can arise in existing dynamic taint analysis and symbolic execution systems due to exception-based implicit information ows and proposes a generic architecture-Agnostic solution for reasoning about the behavior of code using user-defined exception handlers. Experimental results from a prototype implementation indicate that the ideas described produce better results than current state-of-The-Art systems.
AB - Dynamic taint analysis and symbolic execution find many important applications in security-related program analyses. However, current techniques for such analyses do not take proper account of control transfers due to exceptions. As a result, they can fail to account for implicit ows arising from exception-based control transfers, leading to loss of precision and potential false negatives in analysis results. While the idea of using exceptions for obfuscating (unconditional) control transfers is well known, we are not aware of any prior work discussing the use of exceptions to implement condi-Tional control transfers and implicit information ows. This paper demonstrates the problems that can arise in existing dynamic taint analysis and symbolic execution systems due to exception-based implicit information ows and proposes a generic architecture-Agnostic solution for reasoning about the behavior of code using user-defined exception handlers. Experimental results from a prototype implementation indicate that the ideas described produce better results than current state-of-The-Art systems.
KW - Binary analysis
KW - Dynamic information flow
KW - Symbolic execution
UR - http://www.scopus.com/inward/record.url?scp=85018464400&partnerID=8YFLogxK
UR - http://www.scopus.com/inward/citedby.url?scp=85018464400&partnerID=8YFLogxK
U2 - 10.1145/3029806.3029826
DO - 10.1145/3029806.3029826
M3 - Conference contribution
AN - SCOPUS:85018464400
T3 - CODASPY 2017 - Proceedings of the 7th ACM Conference on Data and Application Security and Privacy
SP - 205
EP - 216
BT - CODASPY 2017 - Proceedings of the 7th ACM Conference on Data and Application Security and Privacy
PB - Association for Computing Machinery, Inc
T2 - 7th ACM Conference on Data and Application Security and Privacy, CODASPY 2017
Y2 - 22 March 2017 through 24 March 2017
ER -