Context-sensitive analysis of obfuscated x86 executables

A method for context-sensitive analysis of binaries that may have obfuscated procedure call and return operations is presented. Such binaries may use operators to directly manipulate stack instead of using native call and ret instructions to achieve equivalent behavior. Since definition of context-sensitivity and algorithms for context-sensitive analysis have thus far been based on the specific semantics associated to procedure call and return operations, classic interprocedural analyses cannot be used reliably for analyzing programs in which these operations cannot be discerned. A new notion of context-sensitivity is introduced that is based on the state of the stack at any instruction. While changes in 'calling'-context are associated with transfer of control, and hence can be reasoned in terms of paths in an interprocedural control flow graph (ICFG), the same is not true of changes in 'stack'-context. An abstract interpretation based framework is developed to reason about stack-contexts and to derive analogues of call-strings based methods for the context-sensitive analysis using stack-context. The method presented is used to create a context-sensitive version of Venable et al.'s algorithm for detecting obfuscated calls. Experimental results show that the context-sensitive version of the algorithm generates more precise results and is also computationally more efficient than its context-insensitive counterpart. Copyright © 2010 ACM.

Context-sensitive analysis without calling-context

Since Sharir and Pnueli, algorithms for context-sensitivity have been defined in terms of 'valid' paths in an interprocedural flow graph. The definition of valid paths requires atomic call and ret statements, and encapsulated procedures. Thus, the resulting algorithms are not directly applicable when behavior similar to call and ret instructions may be realized using non-atomic statements, or when procedures do not have rigid boundaries, such as with programs in low level languages like assembly or RTL. We present a framework for context-sensitive analysis that requires neither atomic call and ret instructions, nor encapsulated procedures. The framework presented decouples the transfer of control semantics and the context manipulation semantics of statements. A new definition of context-sensitivity, called stack contexts, is developed. A stack context, which is defined using trace semantics, is more general than Sharir and Pnueli's interprocedural path based calling-context. An abstract interpretation based framework is developed to reason about stack-contexts and to derive analogues of calling-context based algorithms using stack-context. The framework presented is suitable for deriving algorithms for analyzing binary programs, such as malware, that employ obfuscations with the deliberate intent of defeating automated analysis. The framework is used to create a context-sensitive version of Venable et al.'s algorithm for analyzing x86 binaries without requiring that a binary conforms to a standard compilation model for maintaining procedures, calls, and returns. Experimental results show that a context-sensitive analysis using stack-context performs just as well for programs where the use of Sharir and Pnueli's calling-context produces correct approximations. However, if those programs are transformed to use call obfuscations, a contextsensitive analysis using stack-context still provides the same, correct results and without any additional overhead. © Springer Science+Business Media, LLC 2011.

Simbiótico e extratos naturais na dieta de codornas Japonesas na fase de postura

The objective of this study was to assess the performance, tonic immobility time (TIT), intensity of injuries (II) and heterophil to lymphocyte ratio (H:L) by the addition of the symbiotic and plant extract (Aloe vera and Symphytum officinale) to the diet of Japanese quails. Ninety quails were used, distributed in randomized blocks with 3 treatments (0-control; 250 and 750 mg symbiotic and plant extract/kg of diet), five repetitions and six birds per cage. Feed intake, feed conversion, production and weight of eggs, viability, TIT, II and H:L were evaluated. Results showed that the addition of the product to the diet did not affect the performance, however, it decreased the TIT, II and the H:L of quails which received the highest level of the product in the diet. Thus, the use of symbiotic and plant extract in the diet has been promising regarding the behavioral and physiological parameters, decreasing the stress of the animals, mainly for the level of 750 mg/kg diet.

Evaluation of the toxicity of Virola sebifera crude extracts, fractions and isolated compounds on the nest of leaf-cutting ants

The phytochemical study of Virola sebifera leaves led to the isolation of three lignans: (+)-sesamin, (-)-hinokinin, and (-)-kusunokinin and three flavonoids: quercetin-3-O - L-rhamnoside, quercetin-3-O - D-glucoside, and quercetin-3-methoxy-7-O - D-glucoside by using techniques as high-speed counter-current chromatography and high-performance liquid chromatography. The crude extracts, fractions, and isolated compounds were evaluated for their insecticidal and fungicidal potential against Atta sexdens rubropilosa and its symbiotic fungus Leucoagaricus gongylophorus. The bioassay results showed a high insecticidal activity for the methanol crude extract of the leaves of V. sebifera and its n-hexane, dichloromethane and ethyl acetate fractions. The fungicidal bioassay revealed high toxicity of the lignans against L. gongylophorus. © 2012 Keylla Utherdyany Bicalho et al.

Queen lipid content and nest growth in the leaf cutting ant (Atta sexdens rubropilosa) (Hymenoptera: Formicidae)

The relationship between the queens' lipid content and nest growth (population size, biomass and nest architecture) was studied from founding up to 1 year. Nests aged 3, 4, 5, 6, 9 and 12 months were dug in the field, and their dimensions were measured. The ant nest population and fungus garden was also collected. The sample was taken to the laboratory where we counted the worker population and weighed the biomass (fungus plus offspring) and queens. Queens were separated for the determination of lipids. The lipid content in the bodies of queens decreased in the first months, then stabilized (at 4-6 months) before increasing in months 9 and 12. Nest biomass (symbiotic fungus and offspring) and worker population increased over time. The structural growth of the nests was observed by excavating around them. Initially nests (3 months old) had one chamber at an average depth of 15 cm. By 1 year, the nests had three or four deep chambers, and were about 3-4 m deep. Our study contributes to knowledge of the dynamics of the energy-reserve expenditure by queens during colony founding and colony development for up to 1 year. © 2013 Copyright Taylor and Francis Group, LLC.

Brachyuran and anomuran crabs associated with Schizoporella unicornis (Ectoprocta, Cheilostomata) from southeastern Brazil

The main goals of this investigation were to describe the community structure of anomuran and brachyuran crabs inhabiting reefs constituted by colonies of Schizoporella unicornis, and to provide a species importance ranking for this community. Collections were carried out on S. unicornis reefs at two-month intervals from May 2003 to May 2004, in the rocky sublittoral of the southeastern Brazilian coast. Relative abundance and occurrence were used to rank these species in the hierarchy importance. A total of 2,018 individuals were obtained, in 11 families, 22 genera and 31 species. Porcellanidae and Pilumnidae were the most abundant families, comprising respectively almost 60% and 15% of individuals sampled. The species ranking indicated four main groups A, B, C and D, with group A subdivided. Subgroup A1 contained 9 species, including the species of greatest ecological importance for community regarding abundance and occurrence. The great abundance of crabs associated with S. unicornis seems to be the result of its recognized importance during the crab developmental cycle, and as shelter and food for some Decapod species. These observations reveal the importance of conserving the areas occupied by these reef colonies, which appear to be an important environment for maintaining local biodiversity.

Foraging of psilocybe basidiocarps by the leafcutting ant acromyrmex lobicornis in Santa Fé, Argentina

Background It is generally accepted that material collected by leaf-cutting ants of the genus Acromyrmex consists solely of plant matter, which is used in the nest as substrate for a symbiotic fungus providing nutrition to the ants. There is only one previous report of any leaf-cutting ant foraging directly on fungal basidiocarps. Findings Basidiocarps of Psilocybe coprophila growing on cow dung were actively collected by workers of Acromyrmex lobicornis in Santa Fé province, Argentina. During this behaviour the ants displayed typical signals of recognition and continuously recruited other foragers to the task. Basidiocarps of different stages of maturity were being transported into the nest by particular groups of workers, while other workers collected plant material. Conclusions The collection of mature basidiocarps with viable spores by leaf-cutting ants in nature adds substance to theories relating to the origin of fungiculture in these highly specialized social insects. © 2013 Masiulionis et al.

Association between Pseudonocardia symbionts and Atta leaf-cutting ants suggested by improved isolation methods

Fungus-growing ants associate with multiple symbiotic microbes, including Actinobacteria for production of antibiotics. The best studied of these bacteria are within the genus Pseudonocardia, which in most fungus-growing ants are conspicuously visible on the external cuticle of workers. However, given that fungus-growing ants in the genus Atta do not carry visible Actinobacteria on their cuticle, it is unclear if this genus engages in the symbiosis with Pseudonocardia. Here we explore whether improving culturing techniques can allow for successful isolation of Pseudonocardia from Atta cephalotes leaf-cutting ants. We obtained Pseudonocardia from 9 of 11 isolation method/colony component combinations from all 5 colonies intensively sampled. The most efficient technique was bead-beating workers in phosphate buffer solution, then plating the suspension on carboxymethylcellulose medium. Placing these strains in a fungus-growing ant-associated Pseudonocardia phylogeny revealed that while some strains grouped with clades of Pseudonocardia associated with other genera of fungus-growing ants, a large portion of the isolates fell into two novel phylogenetic clades previously not identified from this ant-microbe symbiosis. Our findings suggest that Pseudonocardia may be associated with Atta fungus-growing ants, potentially internalized, and that localizing the symbiont and exploring its role is necessary to shed further light on the association.

Deciphering the synergism of endogenous glycoside hydrolase families 1 and 9 from Coptotermes gestroi

Termites can degrade up to 90% of the lignocellulose they ingest using a repertoire of endogenous and symbiotic degrading enzymes. Termites have been shown to secrete two main glycoside hydrolases, which are GH1 (EC 3.2.1.21) and GH9 (EC 3.2.1.4) members. However, the molecular mechanism for lignocellulose degradation by these enzymes remains poorly understood. The present study was conducted to understand the synergistic relationship between GH9 (CgEG1) and GH1 (CgBG1) from Coptotermes gestroi, which is considered the major urban pest of São Paulo State in Brazil. The goal of this work was to decipher the mode of operation of CgEG1 and CgBG1 through a comprehensive biochemical analysis and molecular docking studies. There was outstanding degree of synergy in degrading glucose polymers for the production of glucose as a result of the endo-β-1,4-glucosidase and exo-β-1,4-glucosidase degradation capability of CgEG1 in concert with the high catalytic performance of CgBG1, which rapidly converts the oligomers into glucose. Our data not only provide an increased comprehension regarding the synergistic mechanism of these two enzymes for cellulose saccharification but also give insight about the role of these two enzymes in termite biology, which can provide the foundation for the development of a number of important applied research topics, such as the control of termites as pests as well as the development of technologies for lignocellulose-to-bioproduct applications. © 2013 Elsevier Ltd.

Inoculação e adubação molíbdica no amendoim cultivado em semeadura direta sobre forrageiras

Coordenação de Aperfeiçoamento de Pessoal de Nível Superior (CAPES)

Efeitos da ingestão de Yacon (Smallanthus sonchifolius) sobre o processo de carcinogênese de cólon induzido pela 1, 2-dimetilhidrazina em ratos wistar

Conselho Nacional de Desenvolvimento Científico e Tecnológico (CNPq)

Caracterização estrutural de polissacarídeos produzidos por bactérias dos gêneros Rhizobium e Mesorhizobium

Coordenação de Aperfeiçoamento de Pessoal de Nível Superior (CAPES)

O laboratório de anatomia sob a perspectiva da 'descrição densa': interfaces da cultura e o ensino de Ciências

Coordenação de Aperfeiçoamento de Pessoal de Nível Superior (CAPES)

Plutella xylostella: variabilidade populacional e suscetibilidade a Beauveria bassiana e a nematoides entomopatogênicos

Conselho Nacional de Desenvolvimento Científico e Tecnológico (CNPq)

Utilização de antibiótico probiótico, prebiótico, simbiótico e gluconato de sódio sobre o desempenho e características de carcaça de suínos

Coordenação de Aperfeiçoamento de Pessoal de Nível Superior (CAPES)