Runtime execution tracing and alignment with PANDA

When a reverse engineer executes a binary multiple times and observes different behaviors, it is often not obvious what caused the difference, since the two executions may diverge much earlier for unrelated reasons and the relevant input may be one among tens of millions. This thesis implements a plugin for the Platform for Architecture-Neutral Dynamic Analysis (PANDA) which tracks control flow at runtime at the basic block level, recording a hash of the current location in program structure at every conditional jump. By considering only control flow history up to and including the current stack frame, multiple divergences and reconvergences can be detected. Comparing these hashes across executions allows the engineer to narrow down branches of interest and request more detailed information from the plugin on a second pass, during which the precise context of nested functions and control flow within functions is recorded at the selected moment of divergence. Existing PANDA tools may then be used to trace the variables relevant to the conditional branch back to some initial input.

Name thesis:degree_name

Master

Department dc:contributor.department

Massachusetts Institute of Technology. Department of Electrical Engineering and Computer Science

Grantor dc:publisher

Massachusetts Institute of Technology

Year dc:date.issued

2019

Author dc:creator

• Goggin, Leah(Leah G.)

Advisor dc:contributor.advisor

• Tim Leek.

• Electrical Engineering and Computer Science.

Statement dc:rights

• MIT theses are protected by copyright. They may be viewed, downloaded, or printed from this source but further reproduction or distribution in any format is prohibited without written permission.

Licence dc:rights.uri

• http://dspace.mit.edu/handle/1721.1/7582

Language dc:language.iso

eng

Handle dc:identifier.uri

https://hdl.handle.net/1721.1/124243

OAI identifier oai:identifier

oai:dspace.mit.edu:1721.1/124243