Static Detection of Disassembly Errors

摘要: Static disassembly is a crucial first step in reverse engineering executable files, and there considerable body of work reverse-engineering binaries, as well areas such semantics-based security analysis, that assumes the input has been correctly disassembled. However, errors, e.g., arising from binary obfuscations, can render this assumption invalid. This describes machine-learning-based approach, using decision trees, for statically identifying possible errors static disassembly; potential may then be examined more closely, dynamic analyses. Experimental results variety executables indicate our approach performs well, most with relatively few false positives.