Runtime execution tracing and alignment with PANDA
Name
1145019144-MIT.pdf
Size
791.73 KB
Format
Adobe PDF
Checksum (MD5)
fbec5d8e95f82d81e7d1d164aba432a0
Author(s)
Goggin, Leah(Leah G.)
Advisor(s)
Tim Leek.
Date Issued
2019
Publisher
Massachusetts Institute of Technology
Abstract
When a reverse engineer executes a binary multiple times and observes different behaviors, it is often not obvious what caused the difference, since the two executions may diverge much earlier for unrelated reasons and the relevant input may be one among tens of millions. This thesis implements a plugin for the Platform for Architecture-Neutral Dynamic Analysis (PANDA) which tracks control flow at runtime at the basic block level, recording a hash of the current location in program structure at every conditional jump. By considering only control flow history up to and including the current stack frame, multiple divergences and reconvergences can be detected. Comparing these hashes across executions allows the engineer to narrow down branches of interest and request more detailed information from the plugin on a second pass, during which the precise context of nested functions and control flow within functions is recorded at the selected moment of divergence. Existing PANDA tools may then be used to trace the variables relevant to the conditional branch back to some initial input.
Description
This electronic version was submitted by the student author. The certified thesis is available in the Institute Archives and Special Collections.
Thesis: M. Eng., Massachusetts Institute of Technology, Department of Electrical Engineering and Computer Science, 2019
Cataloged from student-submitted PDF version of thesis.
Includes bibliographical references (pages 43-44).
Subjects
Electrical Engineering and Computer Science.
MIT Department
Massachusetts Institute of Technology. Department of Electrical Engineering and Computer Science
Terms of Use
MIT theses are protected by copyright. They may be viewed, downloaded, or printed from this source but further reproduction or distribution in any format is prohibited without written permission.
Persistent DSpace Link
