{"id":{"repo_id":"cambridge","oai_identifier":"oai:www.repository.cam.ac.uk:1810/391516"},"canonical_url":"https://search.dev.ndltd.org/etd/cambridge/oai:www.repository.cam.ac.uk:1810/391516","repository":{"repo_id":"cambridge","name":"Cambridge University","base_url":"https://api.repository.cam.ac.uk/server/oai/request"},"display":{"title":"A practical, comprehensive and accessible binary framework for security","abstract":"Securing binaries is a critical challenge in an ever-evolving security landscape, particularly with vulnerable legacy and third-party software. Existing frameworks retrofit security through static rewriting or dynamic run-time modification. Static approaches struggle with precise control flow recovery, leading to unsound binaries or limited binary support. Dynamic approaches, while more comprehensive, incur high performance costs. Additionally, complexities of binary frameworks hinder swift development of security solutions. Effective solutions must balance sound and comprehensive code coverage with high performance to ensure practical viability, while enabling developer productivity. To address these, I first introduce Janitizer, a hybrid static-dynamic binary framework that overcomes the limitations of static and dynamic-only techniques. It optimises dynamic modification using static analysis to enforce security policies and generate sound binaries, while employing lightweight dynamic analysis for statically unavailable code for full coverage. Janitizer distinguishes between statically analysed and unanalysed code to avoid redundant run-time analysis and supports both position-dependent and positionindependent code. I demonstrate, through a memory sanitiser and a control-flow integrity scheme, that Janitizer achieves performance overheads comparable to static techniques while delivering full coverage previously only achievable with dynamic techniques. Second, I present Cinnamon, a domain-specific language for binary profiling and monitoring. Cinnamon simplifies development by providing high-level abstractions for control flow, data and types, enabling efficient development of such tools. Its programming model mirrors the typical flow of binary profiling and monitoring tools —control flow traversal, filtering and instrumentation specification. Cinnamon significantly reduces code length and complexity by abstracting framework-specific details, while supporting multiple binary frameworks, ensuring flexibility across static, dynamic and hybrid environments. Finally, I extend Cinnamon with features that optimise code generation, enable modifications and improve integration with Janitizer. A memory sanitiser implementation via Cinnamon highlights how these features enable real-world security techniques and better integration with Janitizer, achieving performance and coverage comparable to a native Janitizer version. This contribution concludes in an accessible, end-to-end binary framework ensuring comprehensive and sound code coverage with low performance overhead.","abstract_html":"Securing binaries is a critical challenge in an ever-evolving security landscape, particularly with vulnerable legacy and third-party software. Existing frameworks retrofit security through static rewriting or dynamic run-time modification. Static approaches struggle with precise control flow recovery, leading to unsound binaries or limited binary support. Dynamic approaches, while more comprehensive, incur high performance costs. Additionally, complexities of binary frameworks hinder swift development of security solutions. Effective solutions must balance sound and comprehensive code coverage with high performance to ensure practical viability, while enabling developer productivity. To address these, I first introduce Janitizer, a hybrid static-dynamic binary framework that overcomes the limitations of static and dynamic-only techniques. It optimises dynamic modification using static analysis to enforce security policies and generate sound binaries, while employing lightweight dynamic analysis for statically unavailable code for full coverage. Janitizer distinguishes between statically analysed and unanalysed code to avoid redundant run-time analysis and supports both position-dependent and positionindependent code. I demonstrate, through a memory sanitiser and a control-flow integrity scheme, that Janitizer achieves performance overheads comparable to static techniques while delivering full coverage previously only achievable with dynamic techniques. Second, I present Cinnamon, a domain-specific language for binary profiling and monitoring. Cinnamon simplifies development by providing high-level abstractions for control flow, data and types, enabling efficient development of such tools. Its programming model mirrors the typical flow of binary profiling and monitoring tools —control flow traversal, filtering and instrumentation specification. Cinnamon significantly reduces code length and complexity by abstracting framework-specific details, while supporting multiple binary frameworks, ensuring flexibility across static, dynamic and hybrid environments. Finally, I extend Cinnamon with features that optimise code generation, enable modifications and improve integration with Janitizer. A memory sanitiser implementation via Cinnamon highlights how these features enable real-world security techniques and better integration with Janitizer, achieving performance and coverage comparable to a native Janitizer version. This contribution concludes in an accessible, end-to-end binary framework ensuring comprehensive and sound code coverage with low performance overhead.","abstract_has_math":false,"creators":["Arif, Mahwish"],"institution":"University of Cambridge","degree_name":"Doctor of Philosophy (PhD)","degree_level":"Doctoral","degree_discipline":null,"degree_department":null,"school":null,"contributors":[],"advisors":["Jones, Timothy"],"committee_chairs":[],"committee_members":[],"year":2025,"date_issued":"2025-03-28","date_published":"2025-03-28","updated_at":"2026-07-22T22:24:25Z","subjects":["binary analysis","binary transformation","binary security"],"languages":["eng"],"rights":[],"rights_urls":["https://www.repository.cam.ac.uk/bitstreams/5750bb7e-252b-4bff-8b46-dde4064f727b/download","http://purl.org/NET/rdflicense/allrightsreserved"],"identifier_entries":[]},"links":{"outbound_url":"https://doi.org/10.17863/CAM.122629","outbound_label":"DOI","outbound_source":"dc:identifier.doi"},"metadata_groups":[{"id":"people","label":"People","entries":[{"key":"dc:contributor.advisor","label":"Advisor","values":["Jones, Timothy"]},{"key":"dc:creator","label":"Author","values":["Arif, Mahwish"]}]},{"id":"academic_context","label":"Academic Context","entries":[{"key":"dc:date.issued","label":"Date","values":["2025-03-28"]},{"key":"dc:publisher.institution","label":"Dc Publisher Institution","values":["University of Cambridge"]},{"key":"dc:relation.isreferencedby.uri","label":"Dc Relation Isreferencedby URI","values":["https://www.repository.cam.ac.uk/handle/1810/391516"]},{"key":"dc:type","label":"Dc Type","values":["Thesis"]},{"key":"dc:type.qualificationlevel","label":"Dc Type Qualificationlevel","values":["Doctoral"]},{"key":"dc:type.qualificationname","label":"Dc Type Qualificationname","values":["Doctor of Philosophy (PhD)"]}]},{"id":"subjects_keywords","label":"Subjects and Keywords","entries":[{"key":"dc:subject","label":"Dc Subject","values":["binary analysis","binary transformation","binary security"]}]},{"id":"language_rights","label":"Language and Rights","entries":[{"key":"dc:language","label":"Dc Language","values":["eng"]},{"key":"dc:rights","label":"Dc Rights","values":["https://www.repository.cam.ac.uk/bitstreams/5750bb7e-252b-4bff-8b46-dde4064f727b/download","http://purl.org/NET/rdflicense/allrightsreserved"]}]},{"id":"identifiers","label":"Identifiers","entries":[{"key":"dc:identifier.doi","label":"DOI","values":["https://doi.org/10.17863/CAM.122629"]},{"key":"dc:identifier.uri","label":"Identifier URI","values":["https://www.repository.cam.ac.uk/bitstreams/52e09cce-2221-4534-a55d-720d042d3933/download"]}]},{"id":"additional","label":"Additional Metadata","entries":[{"key":"dc:description.abstract","label":"Abstract","values":["Securing binaries is a critical challenge in an ever-evolving security landscape, particularly with vulnerable legacy and third-party software. Existing frameworks retrofit security through static rewriting or dynamic run-time modification. Static approaches struggle with precise control flow recovery, leading to unsound binaries or limited binary support. Dynamic approaches, while more comprehensive, incur high performance costs. Additionally, complexities of binary frameworks hinder swift development of security solutions. Effective solutions must balance sound and comprehensive code coverage with high performance to ensure practical viability, while enabling developer productivity. To address these, I first introduce Janitizer, a hybrid static-dynamic binary framework that overcomes the limitations of static and dynamic-only techniques. It optimises dynamic modification using static analysis to enforce security policies and generate sound binaries, while employing lightweight dynamic analysis for statically unavailable code for full coverage. Janitizer distinguishes between statically analysed and unanalysed code to avoid redundant run-time analysis and supports both position-dependent and positionindependent code. I demonstrate, through a memory sanitiser and a control-flow integrity scheme, that Janitizer achieves performance overheads comparable to static techniques while delivering full coverage previously only achievable with dynamic techniques. Second, I present Cinnamon, a domain-specific language for binary profiling and monitoring. Cinnamon simplifies development by providing high-level abstractions for control flow, data and types, enabling efficient development of such tools. Its programming model mirrors the typical flow of binary profiling and monitoring tools —control flow traversal, filtering and instrumentation specification. Cinnamon significantly reduces code length and complexity by abstracting framework-specific details, while supporting multiple binary frameworks, ensuring flexibility across static, dynamic and hybrid environments. Finally, I extend Cinnamon with features that optimise code generation, enable modifications and improve integration with Janitizer. A memory sanitiser implementation via Cinnamon highlights how these features enable real-world security techniques and better integration with Janitizer, achieving performance and coverage comparable to a native Janitizer version. This contribution concludes in an accessible, end-to-end binary framework ensuring comprehensive and sound code coverage with low performance overhead."]},{"key":"dc:format.checksum.md5","label":"Dc Format Checksum Md5","values":["19871c4b259e1f542be736b4ab1add76","87eda9de84448d1f82354d60eee3eb5f"]},{"key":"dc:title","label":"Title","values":["A practical, comprehensive and accessible binary framework for security"]}]}],"canonical_facts":{"dc:contributor.advisor":["Jones, Timothy"],"dc:creator":["Arif, Mahwish"],"dc:date.issued":["2025-03-28"],"dc:description.abstract":["Securing binaries is a critical challenge in an ever-evolving security landscape, particularly with vulnerable legacy and third-party software. Existing frameworks retrofit security through static rewriting or dynamic run-time modification. Static approaches struggle with precise control flow recovery, leading to unsound binaries or limited binary support. Dynamic approaches, while more comprehensive, incur high performance costs. Additionally, complexities of binary frameworks hinder swift development of security solutions. Effective solutions must balance sound and comprehensive code coverage with high performance to ensure practical viability, while enabling developer productivity. To address these, I first introduce Janitizer, a hybrid static-dynamic binary framework that overcomes the limitations of static and dynamic-only techniques. It optimises dynamic modification using static analysis to enforce security policies and generate sound binaries, while employing lightweight dynamic analysis for statically unavailable code for full coverage. Janitizer distinguishes between statically analysed and unanalysed code to avoid redundant run-time analysis and supports both position-dependent and positionindependent code. I demonstrate, through a memory sanitiser and a control-flow integrity scheme, that Janitizer achieves performance overheads comparable to static techniques while delivering full coverage previously only achievable with dynamic techniques. Second, I present Cinnamon, a domain-specific language for binary profiling and monitoring. Cinnamon simplifies development by providing high-level abstractions for control flow, data and types, enabling efficient development of such tools. Its programming model mirrors the typical flow of binary profiling and monitoring tools —control flow traversal, filtering and instrumentation specification. Cinnamon significantly reduces code length and complexity by abstracting framework-specific details, while supporting multiple binary frameworks, ensuring flexibility across static, dynamic and hybrid environments. Finally, I extend Cinnamon with features that optimise code generation, enable modifications and improve integration with Janitizer. A memory sanitiser implementation via Cinnamon highlights how these features enable real-world security techniques and better integration with Janitizer, achieving performance and coverage comparable to a native Janitizer version. This contribution concludes in an accessible, end-to-end binary framework ensuring comprehensive and sound code coverage with low performance overhead."],"dc:format.checksum.md5":["19871c4b259e1f542be736b4ab1add76","87eda9de84448d1f82354d60eee3eb5f"],"dc:identifier.doi":["https://doi.org/10.17863/CAM.122629"],"dc:identifier.uri":["https://www.repository.cam.ac.uk/bitstreams/52e09cce-2221-4534-a55d-720d042d3933/download"],"dc:language":["eng"],"dc:publisher.institution":["University of Cambridge"],"dc:relation.isreferencedby.uri":["https://www.repository.cam.ac.uk/handle/1810/391516"],"dc:rights":["https://www.repository.cam.ac.uk/bitstreams/5750bb7e-252b-4bff-8b46-dde4064f727b/download","http://purl.org/NET/rdflicense/allrightsreserved"],"dc:subject":["binary analysis","binary transformation","binary security"],"dc:title":["A practical, comprehensive and accessible binary framework for security"],"dc:type":["Thesis"],"dc:type.qualificationlevel":["Doctoral"],"dc:type.qualificationname":["Doctor of Philosophy (PhD)"]},"updated_at":"2026-07-22T22:24:25Z"}