Function argument number identification in stripped binary under PPC and MIPS instruction set
The identification of the number of function argument contributes to the recovery of the function prototype and is the basis for data flow analysis and other security analysis.In order to improve the accuracy of the recognition of the number of function parameters,an algorithm (Findargs) which deter...
Saved in:
| Main Authors: | , , , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
POSTS&TELECOM PRESS Co., LTD
2020-08-01
|
| Series: | 网络与信息安全学报 |
| Subjects: | |
| Online Access: | http://www.cjnis.com.cn/thesisDetails#10.11959/j.issn.2096-109x.2020047 |
| Tags: |
Add Tag
No Tags, Be the first to tag this record!
|
| _version_ | 1841530010862616576 |
|---|---|
| author | Xiaokang YIN Liu LIU Long LIU Shengli LIU |
| author_facet | Xiaokang YIN Liu LIU Long LIU Shengli LIU |
| author_sort | Xiaokang YIN |
| collection | DOAJ |
| description | The identification of the number of function argument contributes to the recovery of the function prototype and is the basis for data flow analysis and other security analysis.In order to improve the accuracy of the recognition of the number of function parameters,an algorithm (Findargs) which determines the number of parameters of the function according to the voting mechanism of the function call relationship was proposed.Findargs starts from the function call characteristics of PPC and MIPS instruction set,and uses function call relationship combined with argument pass analysis to identify the number of function arguments,which can help to recover function prototype.In order to evaluate the recognition effect of Findargs,a large binary file was selected and tested it with radare2.The experiments results show that Findargs has higher accuracy,and the accuracy rate for PPC instruction set reaches 90.3%.For MIPS instruction set,the accuracy rate is 86%. |
| format | Article |
| id | doaj-art-d417883b980f44698a7a6a9fa2872654 |
| institution | Kabale University |
| issn | 2096-109X |
| language | English |
| publishDate | 2020-08-01 |
| publisher | POSTS&TELECOM PRESS Co., LTD |
| record_format | Article |
| series | 网络与信息安全学报 |
| spelling | doaj-art-d417883b980f44698a7a6a9fa28726542025-01-15T03:14:16ZengPOSTS&TELECOM PRESS Co., LTD网络与信息安全学报2096-109X2020-08-0169510359560138Function argument number identification in stripped binary under PPC and MIPS instruction setXiaokang YINLiu LIULong LIUShengli LIUThe identification of the number of function argument contributes to the recovery of the function prototype and is the basis for data flow analysis and other security analysis.In order to improve the accuracy of the recognition of the number of function parameters,an algorithm (Findargs) which determines the number of parameters of the function according to the voting mechanism of the function call relationship was proposed.Findargs starts from the function call characteristics of PPC and MIPS instruction set,and uses function call relationship combined with argument pass analysis to identify the number of function arguments,which can help to recover function prototype.In order to evaluate the recognition effect of Findargs,a large binary file was selected and tested it with radare2.The experiments results show that Findargs has higher accuracy,and the accuracy rate for PPC instruction set reaches 90.3%.For MIPS instruction set,the accuracy rate is 86%.http://www.cjnis.com.cn/thesisDetails#10.11959/j.issn.2096-109x.2020047static analysisfunction call resolveargument number identificationvoting mechanism |
| spellingShingle | Xiaokang YIN Liu LIU Long LIU Shengli LIU Function argument number identification in stripped binary under PPC and MIPS instruction set 网络与信息安全学报 static analysis function call resolve argument number identification voting mechanism |
| title | Function argument number identification in stripped binary under PPC and MIPS instruction set |
| title_full | Function argument number identification in stripped binary under PPC and MIPS instruction set |
| title_fullStr | Function argument number identification in stripped binary under PPC and MIPS instruction set |
| title_full_unstemmed | Function argument number identification in stripped binary under PPC and MIPS instruction set |
| title_short | Function argument number identification in stripped binary under PPC and MIPS instruction set |
| title_sort | function argument number identification in stripped binary under ppc and mips instruction set |
| topic | static analysis function call resolve argument number identification voting mechanism |
| url | http://www.cjnis.com.cn/thesisDetails#10.11959/j.issn.2096-109x.2020047 |
| work_keys_str_mv | AT xiaokangyin functionargumentnumberidentificationinstrippedbinaryunderppcandmipsinstructionset AT liuliu functionargumentnumberidentificationinstrippedbinaryunderppcandmipsinstructionset AT longliu functionargumentnumberidentificationinstrippedbinaryunderppcandmipsinstructionset AT shengliliu functionargumentnumberidentificationinstrippedbinaryunderppcandmipsinstructionset |