Runtime execution tracing and alignment with PANDA
This electronic version was submitted by the student author. The certified thesis is available in the Institute Archives and Special Collections.
| Main Author: | |
|---|---|
| Other Authors: | |
| Format: | Thesis |
| Language: | eng |
| Published: |
Massachusetts Institute of Technology
2020
|
| Subjects: | |
| Online Access: | https://hdl.handle.net/1721.1/124243 |
| _version_ | 1826197718250291200 |
|---|---|
| author | Goggin, Leah(Leah G.) |
| author2 | Tim Leek. |
| author_facet | Tim Leek. Goggin, Leah(Leah G.) |
| author_sort | Goggin, Leah(Leah G.) |
| collection | MIT |
| description | This electronic version was submitted by the student author. The certified thesis is available in the Institute Archives and Special Collections. |
| first_indexed | 2024-09-23T10:52:04Z |
| format | Thesis |
| id | mit-1721.1/124243 |
| institution | Massachusetts Institute of Technology |
| language | eng |
| last_indexed | 2024-09-23T10:52:04Z |
| publishDate | 2020 |
| publisher | Massachusetts Institute of Technology |
| record_format | dspace |
| spelling | mit-1721.1/1242432020-03-25T03:29:24Z Runtime execution tracing and alignment with PANDA Goggin, Leah(Leah G.) Tim Leek. Massachusetts Institute of Technology. Department of Electrical Engineering and Computer Science. Massachusetts Institute of Technology. Department of Electrical Engineering and Computer Science Electrical Engineering and Computer Science. This electronic version was submitted by the student author. The certified thesis is available in the Institute Archives and Special Collections. Thesis: M. Eng., Massachusetts Institute of Technology, Department of Electrical Engineering and Computer Science, 2019 Cataloged from student-submitted PDF version of thesis. Includes bibliographical references (pages 43-44). When a reverse engineer executes a binary multiple times and observes different behaviors, it is often not obvious what caused the difference, since the two executions may diverge much earlier for unrelated reasons and the relevant input may be one among tens of millions. This thesis implements a plugin for the Platform for Architecture-Neutral Dynamic Analysis (PANDA) which tracks control flow at runtime at the basic block level, recording a hash of the current location in program structure at every conditional jump. By considering only control flow history up to and including the current stack frame, multiple divergences and reconvergences can be detected. Comparing these hashes across executions allows the engineer to narrow down branches of interest and request more detailed information from the plugin on a second pass, during which the precise context of nested functions and control flow within functions is recorded at the selected moment of divergence. Existing PANDA tools may then be used to trace the variables relevant to the conditional branch back to some initial input. by Leah Goggin. M. Eng. M.Eng. Massachusetts Institute of Technology, Department of Electrical Engineering and Computer Science 2020-03-24T15:36:01Z 2020-03-24T15:36:01Z 2019 2019 Thesis https://hdl.handle.net/1721.1/124243 1145019144 eng MIT theses are protected by copyright. They may be viewed, downloaded, or printed from this source but further reproduction or distribution in any format is prohibited without written permission. http://dspace.mit.edu/handle/1721.1/7582 44 pages application/pdf Massachusetts Institute of Technology |
| spellingShingle | Electrical Engineering and Computer Science. Goggin, Leah(Leah G.) Runtime execution tracing and alignment with PANDA |
| title | Runtime execution tracing and alignment with PANDA |
| title_full | Runtime execution tracing and alignment with PANDA |
| title_fullStr | Runtime execution tracing and alignment with PANDA |
| title_full_unstemmed | Runtime execution tracing and alignment with PANDA |
| title_short | Runtime execution tracing and alignment with PANDA |
| title_sort | runtime execution tracing and alignment with panda |
| topic | Electrical Engineering and Computer Science. |
| url | https://hdl.handle.net/1721.1/124243 |
| work_keys_str_mv | AT gogginleahleahg runtimeexecutiontracingandalignmentwithpanda |