Context-sensitive analysis of obfuscated x86 executables

A method for context-sensitive analysis of binaries that may have obfuscated procedure call and return operations is presented. Such binaries may use operators to directly manipulate stack instead of using native call and ret instructions to achieve equivalent behavior. Since definition of context-sensitivity and algorithms for context-sensitive analysis have thus far been based on the specific semantics associated to procedure call and return operations, classic interprocedural analyses cannot be used reliably for analyzing programs in which these operations cannot be discerned. A new notion of context-sensitivity is introduced that is based on the state of the stack at any instruction. While changes in 'calling'-context are associated with transfer of control, and hence can be reasoned in terms of paths in an interprocedural control flow graph (ICFG), the same is not true of changes in 'stack'-context. An abstract interpretation based framework is developed to reason about stack-contexts and to derive analogues of call-strings based methods for the context-sensitive analysis using stack-context. The method presented is used to create a context-sensitive version of Venable et al.'s algorithm for detecting obfuscated calls. Experimental results show that the context-sensitive version of the algorithm generates more precise results and is also computationally more efficient than its context-insensitive counterpart. Copyright © 2010 ACM.

Context-sensitive analysis without calling-context

Since Sharir and Pnueli, algorithms for context-sensitivity have been defined in terms of 'valid' paths in an interprocedural flow graph. The definition of valid paths requires atomic call and ret statements, and encapsulated procedures. Thus, the resulting algorithms are not directly applicable when behavior similar to call and ret instructions may be realized using non-atomic statements, or when procedures do not have rigid boundaries, such as with programs in low level languages like assembly or RTL. We present a framework for context-sensitive analysis that requires neither atomic call and ret instructions, nor encapsulated procedures. The framework presented decouples the transfer of control semantics and the context manipulation semantics of statements. A new definition of context-sensitivity, called stack contexts, is developed. A stack context, which is defined using trace semantics, is more general than Sharir and Pnueli's interprocedural path based calling-context. An abstract interpretation based framework is developed to reason about stack-contexts and to derive analogues of calling-context based algorithms using stack-context. The framework presented is suitable for deriving algorithms for analyzing binary programs, such as malware, that employ obfuscations with the deliberate intent of defeating automated analysis. The framework is used to create a context-sensitive version of Venable et al.'s algorithm for analyzing x86 binaries without requiring that a binary conforms to a standard compilation model for maintaining procedures, calls, and returns. Experimental results show that a context-sensitive analysis using stack-context performs just as well for programs where the use of Sharir and Pnueli's calling-context produces correct approximations. However, if those programs are transformed to use call obfuscations, a contextsensitive analysis using stack-context still provides the same, correct results and without any additional overhead. © Springer Science+Business Media, LLC 2011.

Context-sensitive analysis of x86 obfuscated executables

Coordenação de Aperfeiçoamento de Pessoal de Nível Superior (CAPES)

Bias na Representação de Assunto: Uma Discussão de Oposições Binárias nos Functional Requirements for Subject Authority Data (FRSAD)

Fundação de Amparo à Pesquisa do Estado de São Paulo (FAPESP)

Measuring the Spin of Black Holes in Binary Systems Using Gravitational Waves

Fundação de Amparo à Pesquisa do Estado de São Paulo (FAPESP)

A potência do cyborg no agenciamento de modos de subjetivação pós-identitários: conexões parciais entre arte, psicologia e gênero

In line with a psychology more attached to the becoming [devenir] rather than tothe essence, the goal of this paper is to ground the importance of understandingsubjectivity as a process, mainly when regarding our current discussions aboutidentity and gender. After that, we do some linkage between art and psychology. Forus, art is understood as a powerfulmanner to encourage modes of subjectivation thathave difference as an inherited relation. Lastly, we draw our attention upon somefragments of the contemporaneous artist, Mathew Barney's work-of-art (specially,Cremaster), to see how it runs through the binaries of gender boundaries andlaunches post-identity lines of subjectivation.

Planet formation in a triple stellar system: implications of the third star's orbital inclination

Fundação de Amparo à Pesquisa do Estado de São Paulo (FAPESP)

A cyclic bipolar wind in the interacting binary V 393 Scorpii

V393 Scorpii is a double periodic variable characterized by a relatively stable non-orbital photometric cycle of 253 d. Mennickent et al. argue for the presence of a massive optically thick disc around the more massive B-type component and describe the evolutionary stage of the system. In this paper, we analyse the behaviour of the main spectroscopic optical lines during the long non-orbital photometric cycle. We study the radial velocity of the donor determining its orbital elements and find a small but significant orbital eccentricity (e = 0.04). The donor spectral features are modelled and removed from the spectrum at every observing epoch using the light-curve model given by Mennickent et al. We find that the line emission is larger during eclipses and mostly comes from a bipolar wind. We also find that the long cycle is explained in terms of a modulation of the wind strength; the wind has a larger line and continuum emissivity at the high state. We report the discovery of highly variable chromospheric emission in the donor, as revealed by the Doppler maps of the emission lines Mg II 4481 and C I 6588. We discuss notable and some novel spectroscopic features like discrete absorption components, especially visible at blue depressed O I 7773 absorption wings during the second half-cycle, Balmer double emission with V/R curves showing 'Z-type' and 'S-type' excursions around secondary and main eclipses, respectively, and H beta emission wings extending up to +/- 2000 km s(-1). We also discuss possible causes for these phenomena and for their modulations with the long cycle.

MHD numerical simulations of colliding winds in massive binary systems - I. Thermal versus non-thermal radio emission

In the past few decades detailed observations of radio and X-ray emission from massive binary systems revealed a whole new physics present in such systems. Both thermal and non-thermal components of this emission indicate that most of the radiation at these bands originates in shocks. O and B-type stars and WolfRayet (WR) stars present supersonic and massive winds that, when colliding, emit largely due to the freefree radiation. The non-thermal radio and X-ray emissions are due to synchrotron and inverse Compton processes, respectively. In this case, magnetic fields are expected to play an important role in the emission distribution. In the past few years the modelling of the freefree and synchrotron emissions from massive binary systems have been based on purely hydrodynamical simulations, and ad hoc assumptions regarding the distribution of magnetic energy and the field geometry. In this work we provide the first full magnetohydrodynamic numerical simulations of windwind collision in massive binary systems. We study the freefree emission characterizing its dependence on the stellar and orbital parameters. We also study self-consistently the evolution of the magnetic field at the shock region, obtaining also the synchrotron energy distribution integrated along different lines of sight. We show that the magnetic field in the shocks is larger than that obtained when the proportionality between B and the plasma density is assumed. Also, we show that the role of the synchrotron emission relative to the total radio emission has been underestimated.

Transiting exoplanets from the CoRoT space mission XIX. CoRoT-23b: a dense hot Jupiter on an eccentric orbit

We report the detection of CoRoT-23b, a hot Jupiter transiting in front of its host star with a period of 3.6314 +/- 0.0001 days. This planet was discovered thanks to photometric data secured with the CoRoT satellite, combined with spectroscopic radial velocity (RV) measurements. A photometric search for possible background eclipsing binaries conducted at CFHT and OGS concluded with a very low risk of false positives. The usual techniques of combining RV and transit data simultaneously were used to derive stellar and planetary parameters. The planet has a mass of M-p = 2.8 +/- 0.3 M-Jup, a radius of R-pl = 1.05 +/- 0.13 R-Jup, a density of approximate to 3 gcm(-3). RV data also clearly reveal a nonzero eccentricity of e = 0.16 +/- 0.02. The planet orbits a mature G0 main sequence star of V = 15.5 mag, with a mass M-star = 1.14 +/- 0.08 M-circle dot, a radius R-star = 1. 61 +/- 0.18 R-circle dot and quasi-solar abundances. The age of the system is evaluated to be 7 Gyr, not far from the transition to subgiant, in agreement with the rather large stellar radius. The two features of a significant eccentricity of the orbit and of a fairly high density are fairly uncommon for a hot Jupiter. The high density is, however, consistent with a model of contraction of a planet at this mass, given the age of the system. On the other hand, at such an age, circularization is expected to be completed. In fact, we show that for this planetary mass and orbital distance, any initial eccentricity should not totally vanish after 7 Gyr, as long as the tidal quality factor Q(p) is more than a few 10(5), a value that is the lower bound of the usually expected range. Even if CoRoT-23b features a density and an eccentricity that are atypical of a hot Jupiter, it is thus not an enigmatic object.

Transiting exoplanets from the CoRoT space mission XXII. CoRoT-16b: a hot Jupiter with a hint of eccentricity around a faint solar-like star

Aims. We report the discovery of CoRoT-16b, a low density hot jupiter that orbits a faint G5V star (mV = 15.63) in 5.3523 +/- 0.0002 days with slight eccentricity. A fit of the data with no a priori assumptions on the orbit leads to an eccentricity of 0.33 +/- 0.1. We discuss this value and also derive the mass and radius of the planet. Methods. We analyse the photometric transit curve of CoRoT-16 given by the CoRoT satellite, and radial velocity data from the HARPS and HIRES spectrometers. A combined analysis using a Markov chain Monte Carlo algorithm is used to get the system parameters. Results. CoRoT-16b is a 0.535 -0.083/+0.085 M-J, 1.17 -0.14/+0.16 R-J hot Jupiter with a density of 0.44 -0.14/+0.21 g cm(-3). Despite its short orbital distance (0.0618 +/- 0.0015 AU) and the age of the parent star (6.73 +/- 2.8 Gyr), the planet orbit exhibits significantly non-zero eccentricity. This is very uncommon for this type of objects as tidal effects tend to circularise the orbit. This value is discussed taking into account the characteristics of the star and the observation accuracy.

EVOLUTIONARY TRAJECTORIES OF ULTRACOMPACT "BLACK WIDOW" PULSARS WITH VERY LOW MASS COMPANIONS

The existence of millisecond pulsars with planet-mass companions in close orbits is challenging from the stellar evolution point of view. We calculate in detail the evolution of binary systems self-consistently, including mass transfer, evaporation, and irradiation of the donor by X-ray feedback, demonstrating the existence of a new evolutionary path leading to short periods and compact donors as required by the observations of PSR J1719-1438. We also point out the alternative of an exotic nature of the companion planet-mass star.

DYNAMICAL EVOLUTION OF VISCOUS DISKS AROUND Be STARS. I. PHOTOMETRY

Be stars possess gaseous circumstellar disks that modify in many ways the spectrum of the central B star. Furthermore, they exhibit variability at several timescales and for a large number of observables. Putting the pieces together of this dynamical behavior is not an easy task and requires a detailed understanding of the physical processes that control the temporal evolution of the observables. There is an increasing body of evidence that suggests that Be disks are well described by standard alpha-disk theory. This paper is the first of a series that aims at studying the possibility of inferring several disk and stellar parameters through the follow-up of various observables. Here we study the temporal evolution of the disk density for different dynamical scenarios, including the disk buildup as a result of a long and steady mass injection from the star, the disk dissipation that occurs after mass injection is turned off, as well as scenarios in which active periods are followed by periods of quiescence. For those scenarios, we investigate the temporal evolution of continuum photometric observables using a three-dimensional non-LTE radiative transfer code. We show that light curves for different wavelengths are specific of a mass loss history, inclination angle, and alpha viscosity parameter. The diagnostic potential of those light curves is also discussed.

The relationship between gamma Cassiopeiae's X-ray emission and its circumstellar environment

gamma Cas is the prototypical classical Be star and is recently best known for its variable hard X-ray emission. To elucidate the reasons for this emission, we mounted a multiwavelength campaign in 2010 centered around four XMM-Newton observations. The observational techniques included long baseline optical interferometry (LBOI) from two instruments at CHARA, photometry carried out by an automated photometric telescope and H alpha observations. Because gamma Cas is also known to be in a binary, we measured radial velocities from the H alpha line and redetermined its period as 203.55 +/- 0.20 days and its eccentricity as near zero. The LBOI observations suggest that the star's decretion disk was axisymmetric in 2010, has an system inclination angle near 45 degrees, and a larger radius than previously reported. In addition, the Be star began an "outburst" at the beginning of our campaign, made visible by a brightening and reddening of the disk during our campaign and beyond. Our analyses of the new high resolution spectra disclosed many attributes also found from spectra obtained in 2001 (Chandra) and 2004 (XMM-Newton). As well as a dominant hot (approximate to 14 keV) thermal component, the familiar attributes included: (i) a fluorescent feature of Fe K even stronger than observed at previous times; (ii) strong lines of N VII and Ne XI lines indicative of overabundances; and (iii) a subsolar Fe abundance from K-shell lines but a solar abundance from L-shell ions. We also found that two absorption columns are required to fit the continuum. While the first one maintained its historical average of 1 x 10(21) cm(-2), the second was very large and doubled to 7.4 x 10(23) cm(-2) during our X-ray observations. Although we found no clear relation between this column density and orbital phase, it correlates well with the disk brightening and reddening both in the 2010 and earlier observations. Thus, the inference from this study is that much (perhaps all?) of the X-ray emission from this source originates behind matter ejected by gamma Cas into our line of sight.

THE GEMINI NICI PLANET-FINDING CAMPAIGN: DISCOVERY OF A MULTIPLE SYSTEM ORBITING THE YOUNG A STAR HD 1160

We report the discovery of two low-mass companions to the young A0V star HD 1160 at projected separations of 81 +/- 5 AU (HD 1160 B) and 533 +/- 25 AU (HD 1160 C) by the Gemini NICI Planet-Finding Campaign. Very Large Telescope images of the system taken over a decade for the purpose of using HD 1160 A as a photometric calibrator confirm that both companions are physically associated. By comparing the system to members of young moving groups and open clusters with well-established ages, we estimate an age of 50(-40)(+50) Myr for HD 1160 ABC. While the UVW motion of the system does not match any known moving group, the small magnitude of the space velocity is consistent with youth. Near-IR spectroscopy shows HD 1160 C to be an M3.5 +/- 0.5 star with an estimated mass of 0.22(-0.04)(+0.03) M-circle dot, while NIR photometry of HD 1160 B suggests a brown dwarf with a mass of 33(-9)(+12) M-Jup. The very small mass ratio (0.014) between the A and B components of the system is rare for A star binaries, and would represent a planetary-mass companion were HD 1160 A to be slightly less massive than the Sun.