Assembly Language Code Research Articles

ROMEO: A binary vulnerability detection dataset for exploring Juliet through the lens of assembly language

ContextAutomatic vulnerability detection on C/C++ source code has benefitted from the introduction of machine learning to the field, with many recent publications targeting this combination. In contrast, assembly language or machine code artifacts receive less attention, although there are compelling reasons to study them. They are more representative of what is executed, more easily incorporated in dynamic analysis, and in the case of closed-source code, there is no alternative. ObjectiveWe evaluate the representative capability of assembly language compared to C/C++ source code for vulnerability detection. Furthermore, we investigate the role of call graph context in detecting function-spanning vulnerabilities. Finally, we verify whether compiling a benchmark dataset compromises an experiment’s soundness by inadvertently leaking label information. MethodWe propose ROMEO, a publicly available, reproducible and reusable binary vulnerability detection benchmark dataset derived from the synthetic Juliet test suite. Alongside, we introduce a simple text-based assembly language representation that includes context for function-spanning vulnerability detection and semantics to detect high-level vulnerabilities. It is constructed by disassembling the .text segment of the respective binaries. ResultsWe evaluate an x86 assembly language representation of the compiled dataset, combined with an off-the-shelf classifier. It compares favorably to state-of-the-art methods, including those operating on the full C/C++ code. Including context information using the call graph improves detection of function-spanning vulnerabilities. There is no label information leaked during the compilation process. ConclusionPerforming vulnerability detection on a compiled program instead of the source code is a worthwhile tradeoff. While certain information is lost, e.g., comments and certain identifiers, other valuable information is gained, e.g., about compiler optimizations.

Empirical Study on Microsoft Malware Classification

A malware is a computer program which causes harm to software. Cybercriminals use malware to gain access to sensitive information that will be exchanged via software infected by it. The important task of protecting a computer system from a malware attack is to identify whether given software is a malware. Tech giants like Microsoft are engaged in developing anti-malware products. Microsoft's anti-malware products are installed on over 160M computers worldwide and examine over 700M computers monthly. This generates huge amount of data points that can be analyzed as potential malware. Microsoft has launched a challenge on coding competition platform Kaggle.com, to predict the probability of a computer system, installed with windows operating system getting affected by a malware, given features of the windows machine. The dataset provided by Microsoft consists of 10,868 instances with 81 features, classified into nine classes. These features correspond to files of type asm (data with assembly language code) as well as binary format. In this work, we build a multi class classification model to classify which class a malware belongs to. We use K-Nearest Neighbors, Logistic Regression, Random Forest Algorithm and XgBoost in a multi class environment. As some of the features are categorical, we use hot encoding to make them suitable to the classifiers. The prediction performance is evaluated using log loss. We analyze the accuracy using only asm features, binary features and finally both. xGBoost provide a better log-loss value of 0.078 when only asm features are considered, a value of 0.048 when only binary features are used and a final log loss of 0.03 when all features are used, over other classifiers.

A verified, efficient embedding of a verifiable assembly language

High-performance cryptographic libraries often mix code written in a high-level language with code written in assembly. To support formally verifying the correctness and security of such hybrid programs, this paper presents an embedding of a subset of x64 assembly language in F* that allows efficient verification of both assembly and its interoperation with C code generated from F*. The key idea is to use the computational power of a dependent type system's type checker to run a verified verification-condition generator during type checking. This allows the embedding to customize the verification condition sent by the type checker to an SMT solver. By combining our proof-by-reflection style with SMT solving, we demonstrate improved automation for proving the correctness of assembly-language code. This approach has allowed us to complete the first-ever proof of correctness of an optimized implementation of AES-GCM, a cryptographic routine used by 90% of secure Internet traffic.

Requirements for tools for comprehending highly specialized assembly language code and how to elicit these requirements

Program comprehension tools used with assembly language--often for maintaining legacy software or reverse engineering malware threats--are dated and fail to provide rudimentary features found in to...

Improving robustness and computational efficiency using modern C++

For nearly two decades, the C++ programming language has been the dominant programming language for experimental HEP. The publication of ISO/IEC 14882:2011, the current version of the international standard for the C++ programming language, makes available a variety of language and library facilities for improving the robustness, expressiveness, and computational efficiency of C++ code. However, much of the C++ written by the experimental HEP community does not take advantage of the features of the language to obtain these benefits, either due to lack of familiarity with these features or concern that these features must somehow be computationally inefficient.In this paper, we address some of the features of modern C+-+, and show how they can be used to make programs that are both robust and computationally efficient. We compare and contrast simple yet realistic examples of some common implementation patterns in C, currently-typical C++, and modern C++, and show (when necessary, down to the level of generated assembly language code) the quality of the executable code produced by recent C++ compilers, with the aim of allowing the HEP community to make informed decisions on the costs and benefits of the use of modern C++.

High-level separation logic for low-level code

Separation logic is a powerful tool for reasoning about structured, imperative programs that manipulate pointers. However, its application to unstructured, lower-level languages such as assembly language or machine code remains challenging. In this paper we describe a separation logic tailored for this purpose that we have applied to x86 machine-code programs. The logic is built from an assertion logic on machine states over which we construct a specification logic that encapsulates uses of frames and step indexing. The traditional notion of Hoare triple is not applicable directly to unstructured machine code, where code and data are mixed together and programs do not in general run to completion, so instead we adopt a continuation-passing style of specification with preconditions alone. Nevertheless, the range of primitives provided by the specification logic, which include a higher-order frame connective, a novel read-only frame connective, and a 'later' modality, support the definition of derived forms to support structured-programming-style reasoning for common cases, in which standard rules for Hoare triples are derived as lemmas. Furthermore, our encoding of scoped assembly-language labels lets us give definitions and proof rules for powerful assembly-language 'macros' such as while loops, conditionals and procedures. We have applied the framework to a model of sequential x86 machine code built entirely within the Coq proof assistant, including tactic support based on computational reflection.

Software design of the ATLAS Muon Cathode Strip Chamber ROD

The ATLAS Cathode Strip Chamber system consists of two end-caps with 16 chambers each. The CSC Readout Drivers (RODs) are purpose-built boards encapsulating 13 DSPs and around 40 FPGAs. The principal responsibility of each ROD is for the extraction of data from two chambers at a maximum trigger rate of 75 KHz. In addition, each ROD is in charge of the setup, control and monitoring of the on-detector electronics. This paper introduces the design of the CSC ROD software. The main features of this design include an event flow schema that decentralizes the different dataflow streams, which can thus operate asynchronously at its own natural rate; an event building mechanism that associates data transferred by the asynchronous streams belonging to the same event; and a sparcification algorithm that discards uninteresting events and thus reduces the data occupancy volume. The time constraints imposed by the trigger rate have made paramount the use of optimization techniques such as the curiously recurrent template pattern and the programming of critical code in assembly language. The behaviour of the CSC RODs has been characterized in order to validate its performance.

Programmable Hamiltonian for One-way Patterns

We construct a family of time-independent Hamiltonians which are able to perform universally programmable quantum computation. The construction is obtained via direct translation of one-way computer assembly language code into a Hamiltonian evolution. We also present how to evolve adiabatically to this Hamiltonian. It is hoped that this approach contributes further into the study of the structural relationship between measurement-based and adiabatic models of quantum computing.

Automated Verification of Practical Garbage Collectors

Garbage collectors are notoriously hard to verify, due to their low-level interaction with the underlying system and the general difficulty in reasoning about reachability in graphs. Several papers have presented verified collectors, but either the proofs were hand-written or the collectors were too simplistic to use on practical applications. In this work, we present two mechanically verified garbage collectors, both practical enough to use for real-world C# benchmarks. The collectors and their associated allocators consist of x86 assembly language instructions and macro instructions, annotated with preconditions, postconditions, invariants, and assertions. We used the Boogie verification generator and the Z3 automated theorem prover to verify this assembly language code mechanically. We provide measurements comparing the performance of the verified collector with that of the standard Bartok collectors on off-the-shelf C# benchmarks, demonstrating their competitiveness.

Automated verification of practical garbage collectors

Garbage collectors are notoriously hard to verify, due to their low-level interaction with the underlying system and the general difficulty in reasoning about reachability in graphs. Several papers have presented verified collectors, but either the proofs were hand-written or the collectors were too simplistic to use on practical applications. In this work, we present two mechanically verified garbage collectors, both practical enough to use for real-world C# benchmarks. The collectors and their associated allocators consist of x86 assembly language instructions and macro instructions, annotated with preconditions, postconditions, invariants, and assertions. We used the Boogie verification generator and the Z3 automated theorem prover to verify this assembly language code mechanically. We provide measurements comparing the performance of the verified collector with that of the standard Bartok collectors on off-the-shelf C# benchmarks, demonstrating their competitiveness.

Type-preserving compilation for large-scale optimizing object-oriented compilers

Type-preserving compilers translate well-typed source code, such as Java or C#, into verifiable target code, such as typed assembly language or proof-carrying code. This paper presents the implementation of type-preserving compilation in a complex, large-scale optimizing compiler. Compared to prior work, this implementation supports extensive optimizations, and it verifies a large portion of the interface between the compiler and the runtime system. This paper demonstrates the practicality of type-preserving compilation in complex optimizing compilers: the generated typed assembly language is only 2.3% slower than the base compiler's generated untyped assembly language, and the type-preserving compiler is 82.8% slower than the base compiler.

Develop a compiler in Java for a compiler design course

The authors' Compiler Design course at Bridgewater State College implemented a translator for a small language using Java. The project was broken into five assignments that included a language definition, extension of this language, a lexical analyzer, a recursive descent parser, and finally a code generator that generated Jasmin assembly language code for the JVM (Java Virtual Machine).

Case Tools for Process Control and Instrumentation Applications Development

The paper presents two integrated development environments for process control and instrumentation programs designed for developing software for microsystems with microcontrollers from the 8051 family, one, and for real-time, multi-tasking systems, the other. The CASE tools include standard development facilities and also specific ones: remote loading and debugging in a target computer, assembly language code generation for simple for the first program and a graphical editor for data flow diagrams, an application builder in background set for a specific real-time executive and evaluation tools for the second one. The presented software development instruments strongly increase the productivity of new applications development.

GOTO Removal Based on Regular Expressions

We present an algorithm for eliminating GOTOs and replacing them with structured IF-THEN-ELSE and loop constructs. Previous approaches have treated GOTO removal as an isolated problem for programming languages. In this paper, we describe a way of reducing GOTO removal to the well-understood problem of converting a finite-state transition network to a regular expression. A semantics is provided showing how the regular expression form may be interpreted as a non-deterministic program. A set of pattern-based reduction rules is used to transform the regular expression form back to a conventional structured program. Besides achieving greater conceptual unity, the method leads to a simpler algorithm where the task of recognizing loop boundaries is separated from that of identifying loop exits. We have successfully applied the algorithm in systems for re-engineering COBOL/IMS database systems and assembly language code. © 1997 by John Wiley & Sons, Ltd. J. Software Maintenance 9: 47–66, 1997

OPTIMIZATION OF RECIPROCALS AND SQUARE ROOTS ON THE i860 MICROPROCESSOR

Reciprocal and reciprocal square root operations are partially supported by the i860 floating point unit, whereas square roots are not. We point out the reasons for this, and its consequences for the optimization of code involving many reciprocal square roots, such as many-body simulations involving Coulomb-like potentials. We conclude that code which can be optimized to explicitly combine reciprocals and square roots in the form of reciprocal square roots can attain significantly higher performance, and that assembly language coding of such operations can make the greatest use of the hardware by calculating only to the accuracy required, which may be less than single precision.

Bit-plane layering for high-resolution EGA and VGA graphics on the IBM PC/XT/AT

Each page of video memory comprises four parallel planes that can be manipulated and displayed independently or in combination. A technique is described that involves programming the video hardware to achieve this. The utility of well-known video programming technology, such as the tachistoscope display, is thereby extended. Assembly language code is included, and a demonstration program is described.

Pulse shape analysis for germanium detectors used in DM searches

Progress in Ge detector technology has resulted in ultralow backgrounds of less than 0.3 counts keV −1 kg −1 d −1 at energies between 6 and 9 keV and from 12 to 20 keV. Between 4 and 6 keV it is less than 2 counts kev −1 kg −1 d −1. Coupled with good energy resolution, 0.4 keV FWHM at 10 keV, this allows searches for DM particles with m ≥ 8 GeV/c 2. Electromagnetic interference (EMI) and acoustical pick-up are the main sources of background in the best Ge detectors. A PC-based on-line pulse shape analysis system is presented which permits rejection of large fraction of the EMI/acoustical background. The hardware uses a low cost, commercially available digital storage oscilloscope (DSO). The software consists of about 40,000 lines of code in Pascal and assembly language. We tested this system using a low radioactive background Ge-system at the Baksan observatory. For low energy events (< 100 keV) this system permits improvement in the background by about 20–30%.

Performance of an Occam/transputer implementation of interval arithmetic

&lt;p&gt;Rounded interval arithmetic is very easy to implement by means of directed rounding arithmetic operators. Such operators are available in the IEEE floating point arithmetic of the transputer. When a few small pieces of assembly language code are used to access the directed rounding operators, the four basic rounded interval arithmetic operators can easily be expressed in the programming language Occam.&lt;/p&gt;&lt;p&gt;The performance of this implementation is assessed and it is shown that the time consuming part of the calculation are not the directed rounding floating point operations as one might have expected. Most of the time is spent with transport of operands to and from the on-chip floating point unit and the procedure call/parameter passing overhead. Based on this experience the implementation is improved. This implementation runs with 0.15 MIOPS (Million Interval Operations Per Second) or 0.30 MFLOPS on an example interval calculation proposed by Moore. Furthermore, it is demonstrated that an advanced interval language compiler may provide a performance of 0.30 MIOPS or 0.59 MFLOPS on this example calculation.&lt;/p&gt;

ΓCMC: Fast lazy functional languages

The efficient compilation of functional languages has been shown to be a difficult task. The most successful implementations so far generate code in assembly language. This makes implementation extremely hard and machine dependant. In this paper we present ΓCMC, a new abstract machine, in which we transfer the control of the execution flow to C, as much as possible. ΓCMC takes advantage of the extremely low costs of procedure calls in modern RISC architectures. This produced a substantial improvement in performance, as we show here.

A method for accelerating the design of optimal linear-phase FIR digital filters

A simple method is presented for reducing the execution time of the McClellan-Parks-Rabiner (1973) FIR (finite impulse response) digital filter design program on computers with a floating-point processor. It is found that 80% to 90% of the execution time of this program involves only four lines of the program code. By efficiently implementing these four lines of code in assembly language it is possible to significantly reduce the execution time. Examples of this method are given for personal computers based on both 8086-family and 68000-family microprocessors with a corresponding math coprocessor. It is found that for these computers the method reduces execution time by a factor of 1.6 to 1.9.< <ETX xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">&gt;</ETX>