Abstract

Algorithmic identification is the crux for several binary analysis applications, including malware analysis, vulnerability discovery, and embedded firmware reverse engineering. However, data-driven and signature-based approaches often break down when encountering outlier realizations of a particular algorithm. Moreover, reverse engineering of domain-specific binaries often requires collaborative analysis between reverse engineers and domain experts. Communicating the behavior of an unidentified binary program to non-reverse engineers necessitates the recovery of algorithmic semantics in a human-digestible form. This paper presents PERFUME, a framework that extracts symbolic math expressions from low-level binary representations of an algorithm. PERFUME works by translating a symbolic output representation of a binary function to a high-level mathematical expression. In particular, we detail how …

Date

2021

Authors

Nicolaas Weideman, Virginia K Felkner, Wei-Cheng Wu, Jonathan May, Christophe Hauser, Luis Garcia

Book

Proceedings of the 2021 Research on offensive and defensive techniques in the Context of Man At The End (MATE) Attacks

Pages

59-69