Extracting Output Formats from Executables

摘要: We describe the design and implementation of FFE/x86 (File-Format Extractor for x86), an analysis tool that works on stripped executables (i.e., neither source code nor debugging information need be available) extracts output data formats, such as file formats network packet formats. first construct a hierarchical finite state machine (HFSM) over-approximates format. An HFSM defines language over operations used to generate data. use value-set (VSA) aggregate structure identification (ASI) annotate HFSMs with partially characterizes some values. VSA determines over-approximation set addresses integer values each object can hold at program point, ASI analyzes memory accesses in recover about aggregates. A series filtering is performed over-approximate finite-state machine, which result final answer easier understand. Our experiments uncovered possible bug image-conversion utility png2ico