Rendezvous: A search engine for code

Add to your list(s) Download to your calendar using vCal

• Wei Ming Khoo, Security Group, Computer Laboratory, University of Cambridge
• Tuesday 12 February 2013, 16:15-17:15
• Lecture Theatre 2, Computer Laboratory, William Gates Building.

If you have a question about this talk, please contact Laurent Simon.

This talk has been canceled/deleted

The established approach to reverse engineering is decompilation, that is, the creation of high-level language code from machine code via disassembly, data-flow analysis, control-flow analysis, data type recovery and finally code generation. However, most large programs nowadays are put together from existing sources, with the addition of a small amount of new code. Much software is either available in public repositories of free and open-source software, or has appeared in previous offerings from the same vendor (or both). Large programs are put together from many small modules, most of which do standard things; new implementations often do standard things in slightly improved ways.

So we reframe the problem of understanding machine code as a search problem. We are building a search engine that indexes the available source and machine code, and treats decompilation as a source-binary matching problem. We have developed tools that index both disassembled procedures and source code libraries in multiple languages using a novel combination of test-based indexing, perturbation indexing, perturbation analysis, code translation and type inference. Experiments show that Rendezvous is able to match routines from several source code repositories and common C library routines; it already outperforms the current state-of-the-art binary matching tool BinDiff. Our innovation will bring radical changes to a number of areas, from vulnerability analysis through code obfuscation and patch management to copyright enforcement.

This talk is part of the Computer Laboratory Security Seminar series.

This talk is included in these lists:

This talk is not included in any other list

Note that ex-directory lists are not shown.