CN105094825B - A kind of memory variable distribution dynamic discovery method - Google Patents
A kind of memory variable distribution dynamic discovery method Download PDFInfo
- Publication number
- CN105094825B CN105094825B CN201510430225.5A CN201510430225A CN105094825B CN 105094825 B CN105094825 B CN 105094825B CN 201510430225 A CN201510430225 A CN 201510430225A CN 105094825 B CN105094825 B CN 105094825B
- Authority
- CN
- China
- Prior art keywords
- memory
- path
- subprogram
- memory block
- instruction
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
Landscapes
- Devices For Executing Special Programs (AREA)
Abstract
The invention discloses a kind of memory variable distribution dynamics to find method.This method is：1) object statement is chosen from target software according to the instruction features of setting；2) input data for enabling to the target software that can reach the object statement is generated；3) target software executes the input data, obtains memory variable distribution when executing the object statement.The present invention can lack source code without analyzing all instructions, realize and speculate memory with certain relevant dynamic of instruction.
Description
Technical field
The invention mainly relates to a kind of software (executable file) variable analysis methods, are more specifically related to software analysis
In in the case that lack source code dynamically speculate memory variable distribution method.
Background technology
Memory variable is analyzed, and is that software is analyzed, especially leak analysis, malice component part important in analyzing.In source
In the presence of code, the variable in source code can be directly analyzed, to obtain memory variable distribution.But for lacking source
The binary executable of code seems extremely difficult to the acquisition of its memory variable distribution.
Data structure reverse engineering is similar with memory distribution discovery.DIVINE is calculated by using value set analysis and pointer analysis
Method restores variable entity, can identify in stack in 88% variable and heap 89% variable.But our method more lightweight.
IDA Pro are distributed using a simple algorithm to derive memory, but can only be directed to limited mould for global variable and stack
Formula (such as " [esp+offset] " or " [ebp.offset] ").There is no consideration local variables to pass through pointer, structure etc. in heap
It accesses.Laika identifies potential pointer to estimate object's position and size in the picture, then similar by block type
Sequence detects object.Reward types of identification parameter first when a known function (such as system calling) is called,
Then, type information is transmitted during program Dynamic Execution.But it obtains starting type by type.If data
Structure does not show that these data types would not be identified directly or indirectly in a well-known function.In fact,
Internal variable and data structure occupies significant proportion in a program.Howard Dynamic Extraction data knots from binary code
Structure.Compared with Howard, our method is a light weight method, without analyzing all instructions.In this way, we
Method not only increases efficiency, and reduces the rate of false alarm in processing procedure.
The generation of invariant can analyze in program circuit the not variable of change value, to a certain extent with present patent application phase
It closes.Daikon detects invariant from program process, tracks interested variable by being inserted into source program, then runs
The program of insertion simultaneously inputs some test sets, and derives and be inserted into variable and the variable derived, these variables in source program all
Do not occur.This method is used in multiple security fields, such as logic Hole Detection, behavior model generate.But these
Method has some shortcomings：1) they come generating routine path using stochastic inputs, therefore coverage rate is not high.2) they need manual
Point out the variable to be analyzed.3) their situational variables from path, and our method is sent out by analyzing binary system internal memory operation
Existing possible memory distribution.WIT regards the instruction of internal memory operation collection as invariant and is inserted into code to prevent modification from not gathering
In object.We use this method as mark instructions.
The above method has that the degree of automation is not high, analysis method is complicated, and the present invention is mainly to instruction execution mistake
Journey is analyzed, and proposes that a kind of memory variable distribution dynamic finds method, solves lacking source code, is realized and certain instruction phase
The dynamic of pass speculates memory.
Invention content
In view of the above-mentioned problems, it is an object of the invention to can be in the case where not needing source code, by target software
Dynamic analysis, to find to be distributed discovery method with the relevant memory variable of certain program statement.Due to memory variable structure with
The operation of program may change at any time, therefore it needs to be determined that certain program statement in dynamic analysis process, and observe journey
Sequence goes to sentence moment memory variable distribution situation.Concrete analysis process is as follows：First, it needs to analyze in option program
Object statement.Such as the sentence is loophole sentence that may be present or the required sensitive operation of malicious code.Secondly,
Generate the input for enabling to program to reach the object statement.It is different since program operation process and external world's input are closely related
Input calling program may be made to execute different paths.In order to make calling program reach target instruction target word, need structure specific
Input.Third is executed with the specific input built when program, is analyzed the object statement being performed in program, in acquisition
Deposit variant structural.Specific implementation flow is as follows：
1) memory is chosen according to object statement：Due to memory variable distribution as program operation changes at any time, we
Only it is concerned about the memory variable distribution situation of sometime program, such as certain the program statement time of running.This is leaked in software security
There is significant application value in hole detection, Malicious Code Detection.Such as we can focus on when detecting buffer-overflow vulnerability
The associated internal memory variable distribution situation for the test point position operation that latent fault instruction occurs.
2) it is generated to the path of object statement：When we obtain candidate object statement position (i.e. test point position), I
Generate a path and reach this position, then analyze the memory variable distribution situation that program goes to this position moment.
First, a static path from initial order sentence position to object statement position is generated, then along this static path
Program is dynamically run, and records reliable this of institute and inputs relevant constraints.By solving these constraints, we can be with
Obtain suitable input so that program runs to target location.
3) memory variable distribution derives：When the input that step 2) obtains enters program, we, which observe instruction in a program, is
How to be operated on memory, then generates the relevant memory variable distributed intelligence of target instruction target word.For example, if target is that identification is slow
Area's Overflow Vulnerability is rushed, we just need identification buffering area boundary, i.e. buffering area and its neighbours first.We use two-stage process
Infer memory variable distribution.First, the memory block m write in test point is identified.In this way, we need not analyze often
Item instructs, it is only necessary to find the instruction of operation memory block m.Then, possible memory variable distribution is derived in our these instructions, suddenly
The instruction not operated on m slightly.
Compared with prior art, the positive effect of the present invention is：
High degree of automation of the present invention can analyze the memory variable in heap and stack, belong to a kind of light weight method simultaneously,
Without analyzing all instructions, source code can lacked, realize and speculate memory with certain relevant dynamic of instruction.
Description of the drawings
Fig. 1 is basic framework figure；
Fig. 2 is the memory distribution situation of code in illustrating 1；
Fig. 3 is possible memory distribution in citing 1.
Specific implementation mode
We analyze an example first, illustrate memory variable distribution identification.
Citing 1：We have following binary code, we analyze it.
By analysis it is found that since sizein will move out more than 0x100 programs, but when sizein is equal to 0x100, follow
B [0x100] will obtain user's input in ring.Fig. 2 is respective code in citing 1 in Microsoft Visual Studio 2005
Distribution situation in run-time memory, and the actual spaces b are from b [0] to b [0x99], at this point, buffer overflow, if adjacent
Memory is significant field, such as size, and then 13 rows in back citing 1, apply for memory again according to this size, so that it may to divide
Buffering area with arbitrary size, malicious user can bring very big security threat with code implant to user.
Therefore, a kind of method that Dynamic Discovery memory distribution carries out Hole Detection as shown in Figure 1 includes mainly three parts：It is interior
Deposit selection, path generates and memory variable distribution derives.The method of the present invention can choose institute in the case where lacking source code
The test point position that the false command of concern occurs operates associated internal memory, then generates a path that can reach this position
Input is eventually found an input and reaches the test point, obtains associated internal memory variable distribution situation.Detailed process is as follows：
1) memory is chosen.We need to choose suitable part from entire memory block.Different types of loophole may have
Different instruction features.The position of false command is referred to as test position (check position) in binary code.Cause
This, we focus on the internal memory operation at check positions.Such as check position can arbitrarily choose one can
The instruction of loophole can be caused, such as recycle internal assignment directive.
2) path generates.In order to generate one from program initial order (writing Is) to the road of target instruction target word (writing Ie)
Diameter, we generate a static path from Is to Ie first.Then along static path dynamic operation program, and record foundation
Institute's Prescribed Properties of input data.By solving these constraints, we can obtain suitable input data, directly allow program
Run to Ie.One routine call path P is made of multiple and different subprogram Pi, we generate a routine call path P, it
Subprogram Pe where the subprogram Ps to target instruction target word where initial order.Assuming that Is, in program Ps, Ie is in program Pe
In.It is contemplated that generating static path using two-stage process：A the routine call path P from Ps to Pe) is generated；B) in P
The node Pi and Pj that each two is closed on generate individual path Bij.If Is and Ie are in identical program (such as Ps=Pe), we
Step A is can be omitted, individual path is generated using only step B.
A) routine call path generates
Assuming that there are two subprogram Ps and Pe (Ps ≠ Pe).Our target is that generating routine calls path in Ps and Pe
P.We generate one by the instruction calls analyzed in target program first and directly invoke figure Gc.Specific generation method is as follows：
It will be adjusted using the subprogram including program entry as first node if the subprogram includes call instruction (call instruction)
The subprogram used is added as node from first node to the side of the node；Later, to the two subprograms after
Continuous analysis, until the entire calling figure for generating this program.Notice that recursive call can make Gc recycle.We exclude those
Side in Gc backward.Then we can directly be by calling figure approachability analysis from Ps to Pe：All nodes in scanning figure
And side, a routine call path P can be generated with the path of unicom Ps and Pe by finding.It is indirect to call so that result is imperfect.
The purpose of indirect calling mainly determines by hardware and software environment, the feature of program language, such as virtual function and input data.
Dynamic analysis obtain the destination address that most of brief introduction is called by using seed input, including first two type and the third
A part of destination address of type.We analyze the indirect calling destination address in program using seed input.Although this is
It is incomplete, but we can use and more enter data to optimum results.
B) individual path generates
Assuming that Ii and Ij are two instructions in identical subprogram.In order to find an individual path B from Ii to Ij, we
It should find a command path I from Ii to Ij first.We generate a controlling stream graph Gf according to subprogram where Ii and Ij,
The path backward recycled in exclusion figure.Each node is an instruction in controlling stream graph Gf, and each edge is the stream between instruction
To relationship.If such as instruction a has a side from a to b followed by b；If a instructions are jump instructions, and jump to c, then have
One side from a to c.We still obtain I with direct figure approachability analysis.Pay attention to redirecting indirectly and can so that result is endless
It is whole, somewhat similar indirect calling.We solve the problems, such as this using the above method.Individual path B is the son of command path I
Collection.We only keep the individual path in I to generate B.In fact, being not that all branch nodes are all necessary in B.We
Remove two branches for reaching Ij in branch node.By this mode, we obtain the individual path B between Ii and Ij.
3) memory variable distribution derives.When one input enter program, we observe in a program instruction be how including
Operation is deposited, then generates and instructs relevant memory variable distributed intelligence.In order to effectively derive that memory variable is distributed
Situation, we first define some rules, these rules are mainly used for identifying different internal storage locations, are then advised according to these
Then, we can optimize, and derived using two-stage process and obtain corresponding memory variable distribution situation.
A) primitive rule
When an input enters program, we observe the operation instructed in program in memory.Then we refer to from these
It enables and generates corresponding memory distribution.
Table 1 shows the rule of internal memory operation.When a new memory block M is assigned, we specify an attribute CM to arrive
Its property set (being labeled as ε (M)).CM refers to essential attribute, its value is equal to the memory address of M.If a memory block does not have
It is assigned, just without the attribute.Memory Allocation operation includes Heap Allocation function (such as ' HeapAlloc ') and stack partition function.Stack
Partition function is implicit, because a function call can distribute one piece of memory in stack.Involved in this method to memory block and
Memory segment.One memory segment is one section of continuous memory block, by ' HeapAllocI indicates the memory address of instruction I.
Table 1 internal memory operation rule
| Internal memory operation | Respective rule |
| Memory Allocation | ε(M)←{CM} |
| Memory discharges | ε(M)←Ф |
| It reads | ε(M)←{AddrI} |
| It writes (cycle is outer) | ε(M)←{AddrI} |
| It writes (in cycle) | ε(M)←{CM} |
When this block memory is released, we also remove its attribute.Heap release function is the stack as ' HeapFree '
Release function is also implicit, as function returns.When one piece of memory is write (bad outer following) or is read, we allocate it a category
Property.This attribute should be able to distinguish the different region of memory operated in block.In we realize, we are to instruction distribution one
Block address operates on memory.By this mode, we easily dependence can know which instruction is in reading or writing
It deposits.
When memory is that one in being recycled instruction carries out write operation, we will remove its other than its essential attribute CM
His memory attribute.In this way, this memory segment can be connected with adjacent memory.This rule helps us to find
Memory slice section boundary.If read operation in the circulating cycle, we do not remove memory attribute.Because a program is usually swept
Memory is retouched for searching for or checking, memory distribution may be obscured.
B) two-stage process derives memory variable distributional assumption we is only concerned about some memory block m, then during actual analysis,
It is unnecessary that all memory blocks are analyzed, to improve efficiency.At this point, we derived using two-stage process it is possible
Memory is distributed.
First, we identify memory block m, and memory block m is the instruction write-in by test point position.Pass through this side
Formula, according to the principle of optimality, we need not analyze each instruction.In program operation process, we record all storage allocations
The instruction of block.When we identify that m is our the required memory blocks analyzed, it is only necessary to the record before inquiring, so that it may with
Find the instruction of storage allocation block m.
Second step, we start with from the instruction of storage allocation block m derives possible memory distribution.We, which ignore those, does not have
The instruction on m is operated, to improve efficiency.In pervious work, as a whole by m, and the structure inside m is not differentiated between.
Therefore only decision instruction on the boundaries m is read or write, and having ignored may leak caused by the covering write operation in m memory segments
Hole.We have found that the possible memories of m are distributed and execute fine granularity method to detect relevant vulnerability.
We carry out the identification of memory variable distribution using the rule in table 1, specifically：
In above-mentioned code, we mark the memory of memory block m to be distributed using shadow EMS memory ShM.When the one of memory block m
A memory block is assigned, we mark entire block using memory block m initial addresses.When memory block is released, we are by memory
The label of block is set as 0.When one section of memory (such as p) is commanded I to write or read, itself and other memory segments should be carried out area by us
Point.To put it more simply, we use the address of I as attribute.In this way, we are also known which instruction reads or writes
p.Instruction I in a memory segment is recycled writes, we mark ShM using the initial address in storage allocation space.It is logical
This mode is crossed, this section of memory segment can be attached with adjacent memory to form a buffering area.This rule helps me
Find the boundary of buffering area.Read operation for the memory in cycle, we need not empty its attribute, because of a program
Often scanning memory is used for searching or detecting.
Using the rule in table 1, we can obtain memory distribution such as Fig. 3, and left-hand component is memory address.Value on block
It is the final injunction in internal memory operation.In this way, memory is divided into several segments by us.Scheming hollow block will not be by
Any operation reads or writes.Have in block ' ... ' indicate attribute as in neighbouring memory block.From Fig. 3, it has been found that generation
Possible memory layout and real memory layout in Fig. 1 are essentially identical.Operation on memory is more, possible memory
Layout is finer.
Specifically, corresponding dis-assembling code is as follows in citing 1, we operate relevant code by display memory.
004017F0 push ebp //esp=0x12ff30
…
00401800 mov dword ptr[ebp-0Ch],eax
00401803 mov dword ptr[ebp-8],4017E0h
0040180A mov eax,dword ptr[ebp+8]
0040180D mov dword ptr[ebp-514h],eax
00401813 mov dword ptr[ebp-4],0
0040181A mov dword ptr[ebp-61Ch],0
…
00401826 mov ecx,dword ptr[ebp-61Ch]
…
0040182F mov dword ptr[ebp-61Ch],ecx
00401835 mov edx,dword ptr[ebp-61Ch]
0040183B cmp edx,dword ptr[ebp+8]
…
00401846 mov ecx,dword ptr[ebp-61Ch]
0040184C mov byte ptr[ebp+ecx-618h],al
…
Test point is arranged in we at 0X40184C, then uses table 1, operational objective application program, until first finger
It enables outer in cycle.Finally, it is memory address to obtain possible memory distribution such as Fig. 3 left-hand components.The value of right-hand component is operation
The last one is instructed in memory.In this way, memory block is divided into multiple segments by us.Some memory segments are empty
(the memory segment between such as 0x12F91D and 0x12FA18), it is shown that they all or are not write by any instruction.It is filled out in space
As ' ... ' show attribute with abut memory it is fast in attribute it is identical.Although our addresses from 0x12F914 to 12F91D in the example shown
' 0x40184C ' is collectively labeled as in space, ' writing (in cycle) ' rule by table 1 is removed it by us.In this way,
This section of memory block will be identical as the attribute in the memory between 0x12F91E to 0x12FA17.This also helps us to refine memory point
Cloth.From Fig. 3, it has been found that the possible memory distribution of generation is almost the same with true memory distribution in Fig. 1.Inside
Operation in depositing is more, and possible memory distribution is finer.
In conclusion the present invention proposes that a kind of memory variable distribution dynamic finds method.This method is not needing source code
In the case of, by target software dynamic analysis, to find and the relevant memory variable distribution situation of certain program statement.It should
Method chooses object statement in program first, these sentences be loophole exist or malicious code needed for sensitive operation；Then, raw
At the input that can reach object statement；Finally, by the analysis to executing sentence in program, memory variable structure is obtained.
Claims (8)
1. a kind of memory variable distribution dynamic finds that method, step are：
1) object statement is chosen from target software according to the instruction features of setting；
2) input data for enabling to the target software that can reach the object statement is generated；Wherein, the input number is generated
According to method be：A static path from target software initial order sentence position to the object statement position is generated first,
Then along the static path dynamic operation target software, and institute's Prescribed Properties according to input data are recorded, then solves this
A little constraintss obtain the input data；
3) target software executes the input data, obtains memory variable distribution when executing the object statement；Wherein, institute is obtained
Stating the method that memory variable is distributed is：When the target software executes an input data, all storage allocation blocks are recorded first
Instruction, identify memory block m to be analyzed；Memory block m is by the memory of the instruction write-in of the object statement position；Then
Possible memory distribution is derived from dependent instructions of the storage allocation block m with operation memory block m.
2. the method as described in claim 1, which is characterized in that the generation method of the static path is：It first determines whether to originate
Instruct whether Is and object statement Ie is located in identical subprogram, if it is, directly being generated in subprogram where Is and Ie
Individual path Bse；Otherwise the program tune from subprogram Pe where subprogram Ps to object statement Ie where initial order Is is generated
Use path P；Then individual path Bse is generated in calling path P, obtains several static paths.
3. method as claimed in claim 2, which is characterized in that according to static path length, since most short static path according to
It is secondary to choose the static path operational objective software, and institute's Prescribed Properties according to input data are recorded, then solve these
Constraints obtains the input data.
4. method as claimed in claim 2, which is characterized in that generating the method for calling path P is：By the target software
The subprogram of entrance is as first node, if the subprogram includes call instruction, using called subprogram as node, adds
Add from first node to the side of the node；Then the rest may be inferred until the entire calling figure Gc for generating the target software；
Wherein, side backward is excluded in calling figure Gc generating process；Then being found according to calling figure Gc can be with unicom subprogram Ps and Pe
Path, generate the calling path P.
5. method as claimed in claim 2, which is characterized in that generate individual path Bse's in subprogram where Is and Ie
Method is：Subprogram generates a controlling stream graph Gf where being first depending on Is and Ie；Then according to controlling stream graph Gf by the sub- journey
The command path that Is and Ie two is instructed in sequence is saved in a command path I, is then obtained between Is and Ie according to command path I
Individual path Bse.
6. method as claimed in claim 2, which is characterized in that middle between subprogram Ps and Pe to generate individual path Bse's
Method is：It is first depending on subprogram Ps and Pe generation and directly invokes figure Gc；Then approachability analysis is carried out to calling figure Gc to obtain
Calling path P between Ps and Pe；The command path between Ps and Pe is obtained according to the relationship between every adjacent node in the calling path P
Then I obtains the individual path Bse between Ps and Pe according to command path I.
7. the method as described in claim 1, which is characterized in that when the target software executes an input data, if one
A new memory block M is assigned, then an attribute CM is arranged for memory block M, and memory block M deletes the memory block when being released
Attribute CM, the wherein value of attribute CM are the memory address of memory block M；If a memory block M is read or is write outside cycle, for this
Each region of memory write in memory block M distributes an attribute AddrI, operated in the memory block for that can distinguish
Region of memory；If memory, which is one in being recycled instruction, carries out write operation, removes and each operated in memory block M
Other memory attributes of region of memory other than its essential attribute CM.
8. the method as described in claim 1, which is characterized in that mark the memory point of memory block m using shadow EMS memory ShM
Cloth；Then according to the record of shadow EMS memory ShM, if neighbor address region of memory has different attributes, then it is assumed that in this two pieces
Deposit the memory variable that region belongs to different；If adjacent memory region has same alike result, then it is assumed that they belong to the same variable.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201510430225.5A CN105094825B (en) | 2015-07-21 | 2015-07-21 | A kind of memory variable distribution dynamic discovery method |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201510430225.5A CN105094825B (en) | 2015-07-21 | 2015-07-21 | A kind of memory variable distribution dynamic discovery method |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN105094825A CN105094825A (en) | 2015-11-25 |
| CN105094825B true CN105094825B (en) | 2018-11-06 |
Family
ID=54575353
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201510430225.5A Active CN105094825B (en) | 2015-07-21 | 2015-07-21 | A kind of memory variable distribution dynamic discovery method |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN105094825B (en) |
Families Citing this family (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN110489291B (en) * | 2019-08-13 | 2021-09-07 | 晶晨半导体(上海)股份有限公司 | Method for implementing memory detection tool |
Citations (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101739283A (en) * | 2008-11-20 | 2010-06-16 | 联想(北京)有限公司 | Computer and method for virtual system to directly access computer hardware |
| CN103440457A (en) * | 2013-08-20 | 2013-12-11 | 上海交通大学 | Binary program analytic system based on process simulation |
Family Cites Families (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| JP4391464B2 (en) * | 2005-10-19 | 2009-12-24 | 日本電信電話株式会社 | Device for storing binary tree structure information and device for storing heap structure information |
-
2015
- 2015-07-21 CN CN201510430225.5A patent/CN105094825B/en active Active
Patent Citations (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101739283A (en) * | 2008-11-20 | 2010-06-16 | 联想(北京)有限公司 | Computer and method for virtual system to directly access computer hardware |
| CN103440457A (en) * | 2013-08-20 | 2013-12-11 | 上海交通大学 | Binary program analytic system based on process simulation |
Also Published As
| Publication number | Publication date |
|---|---|
| CN105094825A (en) | 2015-11-25 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| US8650538B2 (en) | Meta garbage collection for functional code | |
| CN108647520A (en) | A kind of intelligent fuzzy test method and system based on fragile inquiry learning | |
| CN109101237A (en) | The encryption Compilation Method and device of code | |
| CN104573503A (en) | Method and device for detecting memory access overflow | |
| Kofler et al. | Automatic data layout optimizations for gpus | |
| US9823913B2 (en) | Method of adding local variables in place of global in JavaScript | |
| Zhu et al. | Determining image base of firmware files for ARM devices | |
| CN107632832A (en) | One kind obscures method towards dalvik bytecode controlling streams | |
| CN103955354B (en) | Method for relocating and device | |
| CN113419960B (en) | Seed generation method and system for kernel fuzzy test of trusted operating system | |
| CN102708053A (en) | Method for determining context environmental effect of function call in program path | |
| CN107832446A (en) | A kind of searching method and computing device of configuration item information | |
| CN103793653B (en) | A kind of program dependence based on tree optimization analyzes method and system | |
| CN105094825B (en) | A kind of memory variable distribution dynamic discovery method | |
| US8769498B2 (en) | Warning of register and storage area assignment errors | |
| CN108399321B (en) | Software local plagiarism detection method based on dynamic instruction dependence graph birthmark | |
| CN101937395B (en) | Detected object program feature extraction method for vulnerability detection | |
| Giamblanco et al. | A dynamic memory allocation library for high-level synthesis | |
| CN103677746A (en) | Instruction recombining method and device | |
| Sasaki et al. | Why do programs have heavy tails? | |
| CN106528179B (en) | A kind of static recognition methods of java class dependence | |
| JP6274090B2 (en) | Threat analysis apparatus and threat analysis method | |
| KR101673151B1 (en) | Method and Apparatus for Analyzing Relationship Change of Program Source and DB Schema | |
| Dong et al. | A new method of software clone detection based on binary instruction structure analysis | |
| CN103677770A (en) | Instruction recombining method and device |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| C06 | Publication | ||
| PB01 | Publication | ||
| C10 | Entry into substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |