Differentiating Code from Data in X86 Binaries
Abstract
Robust, static disassembly is an important part of achieving high coverage for many binary code analyses, such as reverse engineering, malware analysis, reference monitor in-lining, and software fault isolation. However, one of the major difficulties current disassemblers face is differentiating code from data when they are interleaved. This paper presents a machine learning-based disassembly algorithm that segments an x86 binary into subsequences of bytes and then classifies each subsequence as code or data. The algorithm builds a language model from a set of pre-tagged binaries using a statistical data compression technique. It sequentially scans a new binary executable and sets a breaking point at each potential code-to-code and code-to-data/data-to-code transition. The classification of each segment as code or data is based on the minimum cross-entropy. Experimental results are presented to demonstrate the effectiveness of the algorithm.
Cite
Text
Wartell et al. "Differentiating Code from Data in X86 Binaries." European Conference on Machine Learning and Principles and Practice of Knowledge Discovery in Databases, 2011. doi:10.1007/978-3-642-23808-6_34Markdown
[Wartell et al. "Differentiating Code from Data in X86 Binaries." European Conference on Machine Learning and Principles and Practice of Knowledge Discovery in Databases, 2011.](https://mlanthology.org/ecmlpkdd/2011/wartell2011ecmlpkdd-differentiating/) doi:10.1007/978-3-642-23808-6_34BibTeX
@inproceedings{wartell2011ecmlpkdd-differentiating,
title = {{Differentiating Code from Data in X86 Binaries}},
author = {Wartell, Richard and Zhou, Yan and Hamlen, Kevin W. and Kantarcioglu, Murat and Thuraisingham, Bhavani},
booktitle = {European Conference on Machine Learning and Principles and Practice of Knowledge Discovery in Databases},
year = {2011},
pages = {522-536},
doi = {10.1007/978-3-642-23808-6_34},
url = {https://mlanthology.org/ecmlpkdd/2011/wartell2011ecmlpkdd-differentiating/}
}