基于TEMU动态二进制分析平台的程序控制流转移指令追踪  

Tracing Control Transfer Instructions Based on TEMU Dynamic Binary Analysis Platform

作　　者：杨天放[1] 李舟军[1] 

机构地区：[1]北京航空航天大学,北京100191

出　　处：《信息安全与技术》2011年第12期8-14,共7页

摘　　要：执行路径追踪是一种重要的动态二进制分析技术,可用于程序优化、失效诊断、软件度量和动态测试生成等诸多方面。执行路径追踪的性能开销巨大,收集到的踪迹信息数量庞大,给该技术的应用带来了困难。一般情况下,只追踪程序中的控制流转移指令可以降低开销,同时保留执行路径上的关键信息。本文以TEMU动态二进制分析平台为基础,重点研究在该平台上追踪程序控制流转移指令的方法。根据TEMU平台的特征,本文给出了一种通过解码指令进行追踪的直观方法和一种利用TEMU的"基本块起始"回调函数进行追踪的启发式方法。通过对这两种方法进行对比实验和分析得出:启发式方法具有明显的速度优势,而直观方法具有精确性和可扩展性。Tracing program execution is an important technique of dynamic binary analysis. It can be used for program optimization, failure diagnosis, software meaaurement dynamic test generation and so on. However, it is not easy to utilize this technique because of its heavy performance overheads and the huge amount of information it may produce. Generally, we can trace only the control transfer instructions in programs so as to reduce the performance overheads, while the most critical information about the execution is kept. In this article, we make a research on the methods of tracing control transfer instructions in programs by using the TEMU dynamic binary analyses platform. Based on the features of the TEMU platform, we present a straightforward method of decoding the instruction and a heuristic method of utilizing the TEMU＇s ＂block begin＂ callback function. By performing comparing experiments on these two methods and analyzing them, we conclude that the heuristic method has an obvious advantage on speed, while the straightforward method is more precise and scalable.

关 键 词：执行路径追踪 控制流转移指令 TEMU 动态二进制分析 

分 类 号：TP332[自动化与计算机技术—计算机系统结构]