Attack diagnosis on binary executables using dynamic program slicing

Abstract

Nowadays, the level of the practically used programs is often complex and of such a large scale so that it is not as easy to analyze and debug them as one might expect. And it is quite difficult to diagnose attacks and find vulnerabilities in such large-scale programs. Thus, dynamic program slicing becomes a popular and effective method for program comprehension and debugging since it can reduce the analysis scope greatly and drop useless data that do not influence the final result. Besides, most of existing dynamic slicing tools perform dynamic slicing in the source code level, but the source code is not easy to obtain in practice. We believe that we do need some kinds of systems to help the users understand binary programs. In this paper, we present an approach of diagnosing attacks using dynamic backward program slicing based on binary executables, and provide a dynamic binary slicing tool named DBS to analyze binary executables precisely and efficiently. It computes the set of instructions that may have affected or been affected by slicing criterion set in certain location of the binary execution stream. This tool also can organize the slicing results by function call graphs and control flow graphs clearly and hierarchically.