{"id":{"repo_id":"mit","oai_identifier":"oai:dspace.mit.edu:1721.1/121764"},"canonical_url":"https://search.dev.ndltd.org/etd/mit/oai:dspace.mit.edu:1721.1/121764","repository":{"repo_id":"mit","name":"MIT","base_url":"https://dspace.mit.edu/oai/request"},"display":{"title":"A system for dynamic slicing and program visualization","abstract":"Dynamic analysis, which involves gathering information about a program as it is executing, is becoming increasingly common as reverse engineers attempt to more efficiently analyze complex software systems. In this thesis, I implement a technique called dynamic slicing, which determines how values in a program's register or memory, such as strings, are computed as a function of the program's initial state. This technique is then evaluated on sets of programs of interest to reverse engineers: string generation and string encoding/decoding algorithms. A common source of these algorithms is malware, which often employs these mechanisms to obfuscate and to make human-driven reverse engineering more difficult. In particular, malware will use Domain Generation Algorithms (DGAs) to construct seemingly randomized domain names to contact their control servers. We demonstrate that metrics and graphs produced with dynamic slicing can be successfully employed on these algorithm classes, elucidating interesting features from different families of malware and reducing the manual workload of malware reverse engineers.","abstract_html":"Dynamic analysis, which involves gathering information about a program as it is executing, is becoming increasingly common as reverse engineers attempt to more efficiently analyze complex software systems. In this thesis, I implement a technique called dynamic slicing, which determines how values in a program's register or memory, such as strings, are computed as a function of the program's initial state. This technique is then evaluated on sets of programs of interest to reverse engineers: string generation and string encoding/decoding algorithms. A common source of these algorithms is malware, which often employs these mechanisms to obfuscate and to make human-driven reverse engineering more difficult. In particular, malware will use Domain Generation Algorithms (DGAs) to construct seemingly randomized domain names to contact their control servers. We demonstrate that metrics and graphs produced with dynamic slicing can be successfully employed on these algorithm classes, elucidating interesting features from different families of malware and reducing the manual workload of malware reverse engineers.","abstract_has_math":false,"creators":["Wang, Ray(Ray Y.)"],"institution":"Massachusetts Institute of Technology","degree_name":"Master","degree_level":null,"degree_discipline":null,"degree_department":"Massachusetts Institute of Technology. Department of Electrical Engineering and Computer Science","school":null,"contributors":[],"advisors":["Tim Leek."],"committee_chairs":[],"committee_members":[],"year":2019,"date_issued":"2019","date_published":"2019","updated_at":"2026-07-22T22:22:18Z","subjects":["Electrical Engineering and Computer Science."],"languages":["eng"],"rights":["MIT theses are protected by copyright. They may be viewed, downloaded, or printed from this source but further reproduction or distribution in any format is prohibited without written permission."],"rights_urls":["http://dspace.mit.edu/handle/1721.1/7582"],"identifier_entries":[]},"links":{"outbound_url":"https://hdl.handle.net/1721.1/121764","outbound_label":"Handle","outbound_source":"dc:identifier.uri"},"metadata_groups":[{"id":"people","label":"People","entries":[{"key":"dc:contributor.advisor","label":"Advisor","values":["Tim Leek."]},{"key":"dc:contributor.department","label":"Department","values":["Massachusetts Institute of Technology. Department of Electrical Engineering and Computer Science","EECS"]},{"key":"dc:contributor.other","label":"Dc Contributor Other","values":["Massachusetts Institute of Technology. Department of Electrical Engineering and Computer Science."]},{"key":"dc:creator","label":"Author","values":["Wang, Ray(Ray Y.)"]}]},{"id":"academic_context","label":"Academic Context","entries":[{"key":"dc:date.accessioned","label":"Dc Date Accessioned","values":["2019-07-17T21:02:19Z"]},{"key":"dc:date.available","label":"Dc Date Available","values":["2019-07-17T21:02:19Z"]},{"key":"dc:date.issued","label":"Date","values":["2019"]},{"key":"dc:publisher","label":"Institution","values":["Massachusetts Institute of Technology"]},{"key":"dc:type","label":"Dc Type","values":["Thesis"]},{"key":"thesis:degree_name","label":"Degree Name","values":["Master"]}]},{"id":"subjects_keywords","label":"Subjects and Keywords","entries":[{"key":"dc:subject","label":"Dc Subject","values":["Electrical Engineering and Computer Science."]}]},{"id":"language_rights","label":"Language and Rights","entries":[{"key":"dc:language.iso","label":"Language (ISO)","values":["eng"]},{"key":"dc:rights","label":"Dc Rights","values":["MIT theses are protected by copyright. They may be viewed, downloaded, or printed from this source but further reproduction or distribution in any format is prohibited without written permission."]},{"key":"dc:rights.uri","label":"Rights URI","values":["http://dspace.mit.edu/handle/1721.1/7582"]}]},{"id":"identifiers","label":"Identifiers","entries":[{"key":"dc:identifier.uri","label":"Identifier URI","values":["https://hdl.handle.net/1721.1/121764"]}]},{"id":"additional","label":"Additional Metadata","entries":[{"key":"dc:description","label":"Description","values":["Thesis: M. Eng., Massachusetts Institute of Technology, Department of Electrical Engineering and Computer Science, 2019","Cataloged from PDF version of thesis.","Includes bibliographical references (pages 54-55)."]},{"key":"dc:description.abstract","label":"Abstract","values":["Dynamic analysis, which involves gathering information about a program as it is executing, is becoming increasingly common as reverse engineers attempt to more efficiently analyze complex software systems. In this thesis, I implement a technique called dynamic slicing, which determines how values in a program's register or memory, such as strings, are computed as a function of the program's initial state. This technique is then evaluated on sets of programs of interest to reverse engineers: string generation and string encoding/decoding algorithms. A common source of these algorithms is malware, which often employs these mechanisms to obfuscate and to make human-driven reverse engineering more difficult. In particular, malware will use Domain Generation Algorithms (DGAs) to construct seemingly randomized domain names to contact their control servers. We demonstrate that metrics and graphs produced with dynamic slicing can be successfully employed on these algorithm classes, elucidating interesting features from different families of malware and reducing the manual workload of malware reverse engineers."]},{"key":"dc:description.degree","label":"Dc Description Degree","values":["M. Eng."]},{"key":"dc:title","label":"Title","values":["A system for dynamic slicing and program visualization"]}]}],"canonical_facts":{"dc:contributor.advisor":["Tim Leek."],"dc:contributor.department":["Massachusetts Institute of Technology. Department of Electrical Engineering and Computer Science","EECS"],"dc:contributor.other":["Massachusetts Institute of Technology. Department of Electrical Engineering and Computer Science."],"dc:creator":["Wang, Ray(Ray Y.)"],"dc:date.accessioned":["2019-07-17T21:02:19Z"],"dc:date.available":["2019-07-17T21:02:19Z"],"dc:date.issued":["2019"],"dc:description":["Thesis: M. Eng., Massachusetts Institute of Technology, Department of Electrical Engineering and Computer Science, 2019","Cataloged from PDF version of thesis.","Includes bibliographical references (pages 54-55)."],"dc:description.abstract":["Dynamic analysis, which involves gathering information about a program as it is executing, is becoming increasingly common as reverse engineers attempt to more efficiently analyze complex software systems. In this thesis, I implement a technique called dynamic slicing, which determines how values in a program's register or memory, such as strings, are computed as a function of the program's initial state. This technique is then evaluated on sets of programs of interest to reverse engineers: string generation and string encoding/decoding algorithms. A common source of these algorithms is malware, which often employs these mechanisms to obfuscate and to make human-driven reverse engineering more difficult. In particular, malware will use Domain Generation Algorithms (DGAs) to construct seemingly randomized domain names to contact their control servers. We demonstrate that metrics and graphs produced with dynamic slicing can be successfully employed on these algorithm classes, elucidating interesting features from different families of malware and reducing the manual workload of malware reverse engineers."],"dc:description.degree":["M. Eng."],"dc:identifier.uri":["https://hdl.handle.net/1721.1/121764"],"dc:language.iso":["eng"],"dc:publisher":["Massachusetts Institute of Technology"],"dc:rights":["MIT theses are protected by copyright. They may be viewed, downloaded, or printed from this source but further reproduction or distribution in any format is prohibited without written permission."],"dc:rights.uri":["http://dspace.mit.edu/handle/1721.1/7582"],"dc:subject":["Electrical Engineering and Computer Science."],"dc:title":["A system for dynamic slicing and program visualization"],"dc:type":["Thesis"],"thesis:degree_name":["Master"]},"updated_at":"2026-07-22T22:22:18Z"}