Context-sensitive analysis of obfuscated x86 executables

A method for context-sensitive analysis of binaries that may have obfuscated procedure call and return operations is presented. Such binaries may use operators to directly manipulate stack instead of using native call and ret instructions to achieve equivalent behavior. Since definition of context-sensitivity and algorithms for context-sensitive analysis have thus far been based on the specific semantics associated to procedure call and return operations, classic interprocedural analyses cannot be used reliably for analyzing programs in which these operations cannot be discerned. A new notion of context-sensitivity is introduced that is based on the state of the stack at any instruction. While changes in 'calling'-context are associated with transfer of control, and hence can be reasoned in terms of paths in an interprocedural control flow graph (ICFG), the same is not true of changes in 'stack'-context. An abstract interpretation based framework is developed to reason about stack-contexts and to derive analogues of call-strings based methods for the context-sensitive analysis using stack-context. The method presented is used to create a context-sensitive version of Venable et al.'s algorithm for detecting obfuscated calls. Experimental results show that the context-sensitive version of the algorithm generates more precise results and is also computationally more efficient than its context-insensitive counterpart. Copyright © 2010 ACM.

Context-sensitive analysis without calling-context

Since Sharir and Pnueli, algorithms for context-sensitivity have been defined in terms of 'valid' paths in an interprocedural flow graph. The definition of valid paths requires atomic call and ret statements, and encapsulated procedures. Thus, the resulting algorithms are not directly applicable when behavior similar to call and ret instructions may be realized using non-atomic statements, or when procedures do not have rigid boundaries, such as with programs in low level languages like assembly or RTL. We present a framework for context-sensitive analysis that requires neither atomic call and ret instructions, nor encapsulated procedures. The framework presented decouples the transfer of control semantics and the context manipulation semantics of statements. A new definition of context-sensitivity, called stack contexts, is developed. A stack context, which is defined using trace semantics, is more general than Sharir and Pnueli's interprocedural path based calling-context. An abstract interpretation based framework is developed to reason about stack-contexts and to derive analogues of calling-context based algorithms using stack-context. The framework presented is suitable for deriving algorithms for analyzing binary programs, such as malware, that employ obfuscations with the deliberate intent of defeating automated analysis. The framework is used to create a context-sensitive version of Venable et al.'s algorithm for analyzing x86 binaries without requiring that a binary conforms to a standard compilation model for maintaining procedures, calls, and returns. Experimental results show that a context-sensitive analysis using stack-context performs just as well for programs where the use of Sharir and Pnueli's calling-context produces correct approximations. However, if those programs are transformed to use call obfuscations, a contextsensitive analysis using stack-context still provides the same, correct results and without any additional overhead. © Springer Science+Business Media, LLC 2011.

Context-sensitive analysis of x86 obfuscated executables

Coordenação de Aperfeiçoamento de Pessoal de Nível Superior (CAPES)

Interpretation of Resistivity Piezocone Tests in a Contaminated Municipal Solid Waste Disposal Site

Fundação de Amparo à Pesquisa do Estado de São Paulo (FAPESP)

A geometric interpretation for transmission real losses minimization through the optimal power flow and its influence on voltage collapse

This work presents an approach for geometric solution of an optimal power flow (OPF) problem for a two bus system (a slack and a PV busses). Additionally, the geometric relationship between the losses minimization and the increase of the reactive margin and, therefore, the maximum loading point, is shown. The algebraic equations for the calculation of the Lagrange multipliers and for the minimum losses value are obtained. These equations are used to validate the results obtained using an OPF program. (C) 2002 Elsevier B.V. B.V. All rights reserved.

Major developments in conulariid research: problems of interpretation and future perspectives

Fundação de Amparo à Pesquisa do Estado de São Paulo (FAPESP)

Periodic solutions of abstract neutral functional differential equations

We characterize the existence of periodic solutions of some abstract neutral functional differential equations with finite and infinite delay when the underlying space is a UMD space. (C) 2011 Elsevier B.V. All rights reserved.

Status of a hybrid three-neutrino interpretation of neutrino data

We re-analyse the non-standard interaction (NSI) solutions to the solar neutrino problem in the light of the latest solar as well as atmospheric neutrino data. The latter require oscillations (OSC), while the former do not. Within such a three-neutrino framework the solar and atmospheric neutrino sectors are connected not only by the neutrino mixing angle theta(13) constrained by reactor and atmospheric data, but also by the flavour-changing (FC) and non-universal (NU) parameters accounting for the solar data. Since the NSI solution is energy-independent the spectrum is undistorted, so that the global analysis observables are the solar neutrino rates in all experiments as well as the Super-Kamiokande day-night measurements. We find that the NSI description of solar data is slightly better than that of the OSC solution and that the allowed NSI regions are determined mainly by the rate analysis. By using a few simplified ansatzes for the NSI interactions we explicitly demonstrate that the NSI values indicated by the solar data analysis are fully acceptable also for the atmospheric data. (C) 2002 Elsevier B.V. B.V. All rights reserved.

Strings in horizons, dissipation and a possible interpretation of the Hagedorn temperature

We consider the entanglement of closed bosonic strings intersecting the event horizon of a Rindler spacetime, and, by using some simplified (rather semiclassical) arguments and some elements of the string field theory, we show the existence of a critical temperature beyond which closed strings cannot be in thermal equilibrium. The order of magnitude of this critical value coincides with the Hagedorn temperature, which suggests an interpretation consistent with the fact of having a partition function that is ill defined for temperatures higher than it. Possible implications of the present approach for the microscopical structure of stretched horizons are also pointed out.

Husserl on Geometry and Spatial Representation

Husserl left many unpublished drafts explaining (or trying to) his views on spatial representation and geometry, such as, particularly, those collected in the second part of Studien zur Arithmetik und Geometrie (Hua XXI), but no completely articulate work on the subject. In this paper, I put forward an interpretation of what those views might have been. Husserl, I claim, distinguished among different conceptions of space, the space of perception (constituted from sensorial data by intentionally motivated psychic functions), that of physical geometry (or idealized perceptual space), the space of the mathematical science of physical nature (in which science, not only raw perception has a word) and the abstract spaces of mathematics (free creations of the mathematical mind), each of them with its peculiar geometrical structure. Perceptual space is proto-Euclidean and the space of physical geometry Euclidean, but mathematical physics, Husserl allowed, may find it convenient to represent physical space with a non-Euclidean structure. Mathematical spaces, on their turn, can be endowed, he thinks, with any geometry mathematicians may find interesting. Many other related questions are addressed here, in particular those concerning the a priori or a posteriori character of the many geometric features of perceptual space (bearing in mind that there are at least two different notions of a priori in Husserl, which we may call the conceptual and the transcendental a priori). I conclude with an overview of Weyl's ideas on the matter, since his philosophical conceptions are often traceable back to his former master, Husserl.

A laboratory study of the transfer of U-234 and U-238 during water-rock interactions in the Carnmenellis granite (Cornwall, England) and implications for the interpretation of field data

Laboratory time-scale experiments were conducted on gravels from the Carnmenellis granite, Cornwall, England, with the purpose of evaluating the release of natural uranium isotopes to the water phase. The implications of these results for the production of enhanced U-234/U-238 activity ratios in Cornish groundwaters are discussed. It is suggested that the U-234/U-238 lab data can be used to interpret activity ratios from Cornwall, even when the observed inverse relationship between dissolved U and U-234/U-238 in leachates/etchates is taken into account. (C) 2001 Elsevier B.V. Ltd. All rights reserved.

Design of Gaussian basis sets to the theoretical interpretation of IR-spectrum of hexaaquachromium (III) ion, tetraoxochromium (IV) ion, and tetraoxochromium (VI) ion

The Generator Coordinate Hartree-Fock (GCHF) method is employed to design 16s, 16s10p, 24s17p13d, 25s17p13d, and 26s17p Gaussian basis sets for the H ((2)S), O ((3)P), O(2-) ((1)S), Cr(3+) ((4)F), Cr(4+) ((3)F), and Cr(6+) ((1)S) atomic species. These basis sets are then contracted to (4s) for H ((2)S), (6s4p) for O ((3)P), and O(2-) ((1)S), (986p3d) for Cr(3+) ((4)F), (10s8p3d) for Cr(4+) ((3)F), and (13s7p) for Cr(6+) (1S) by a standard procedure. For evaluation of the quality of those basis sets in molecular calculations, we have accomplished studies of total and orbital (HOMO and HOMO-1) energies at the HF-Roothaan level for the molecular species of our interest. The results obtained with the contracted basis sets are compared to the values obtained with our extended basis sets and to the standard 6-311G basis set from literature. Finally, the contracted basis sets are enriched with polarization function and then utilized in the theoretical interpretation of IR-spectrum of hexaaquachromium (III) ion, [Cr(H(2)O)(6)](3+), tetraoxochromium (IV) ion, [CrO(4)](4-), and tetraoxochromium (VI) ion, [CrO(4)](2-). The respective theoretical harmonic frequencies and IR-intensities were computed at the density functional theory (DFT) level. In the DFT calculations we employed the Becke's 1988 functional using the LYP correlation functional. The comparison between the results obtained and the corresponding experimental values indicates a very good description of the IR-spectra of the molecular ions studied, and that the GCHF method is still a legitimate alternative for selection of Gaussian basis sets. (C) 2003 Elsevier B.V. All rights reserved.

Three- phase four-wire circuits interpretation by means of different power theories

Conselho Nacional de Desenvolvimento Científico e Tecnológico (CNPq)