MemPick:A tool for data structure detection
| Autor: | Istvan Haller, Herbert Bos, Asia Slowinska |
|---|---|
| Přispěvatelé: | Computer Systems, Network Institute, Systems and Network Security |
| Jazyk: | angličtina |
| Rok vydání: | 2013 |
| Předmět: | |
| Zdroj: | Haller, I, Slowinska, A & Bos, H 2013, MemPick : A tool for data structure detection . in Proceedings-20th Working Conference on Reverse Engineering, WCRE 2013 ., 6671327, pp. 479-480, 20th Working Conference on Reverse Engineering, WCRE 2013, Koblenz, Germany, 14/10/13 . https://doi.org/10.1109/WCRE.2013.6671327 WCRE Proceedings-20th Working Conference on Reverse Engineering, WCRE 2013, 479-480 STARTPAGE=479;ENDPAGE=480;TITLE=Proceedings-20th Working Conference on Reverse Engineering, WCRE 2013 |
| DOI: | 10.1109/WCRE.2013.6671327 |
| Popis: | Most current techniques for data structure reverse engineering are limited to low-level programing constructs, such as individual variables or structs. In practice, pointer networks connect some of these constructs, to form higher level entities like lists and trees. The lack of information about the pointer network limits our ability to efficiently perform forensics and reverse engineering. To fill this gap, we propose MemPick, a tool that detects and classifies high-level data structures used in stripped C/C++ binaries. By analyzing the evolution of the heap during program execution, it identifies and classifies the most commonly used data structures, such as singly-or doubly-linked lists, many types of trees (e.g., AVL, red-black trees, B-trees), and graphs. We evaluated MemPick on a wide variety of popular libraries and real world applications with great success. |
| Databáze: | OpenAIRE |
| Externí odkaz: |
|