Analysis of Low-Level Code Using Cooperating Decompilers

Code diversification, combined with execute-only memory, provides an effective defense against just-in-time code reuse attacks. However, existing techniques for combining code diversification and hardware-assisted memory protections typically require compiler support, as well as the deployment or modification of a hypervisor. These requirements often cannot be met, either because source code is not available, or because the required hardware features may not be available on the target system. In this paper we present SECRET, a software hardening technique tailored to legacy and closed-source software that provides equivalent protection to execute-only memory without relying on hardware features or recompilation. This is achieved using two novel techniques, code space isolation and code pointer remapping, which prevent read accesses to the executable memory of the protected code. Furthermore, SECRET thwarts code pointer harvesting attacks on ELF files by remapping existing code pointers to use random values. SECRET has been implemented on 32-bit Linux systems. Our evaluation shows that it introduces just 2% additional runtime overhead on top of a state-of-the-art CFI implementation, bringing the total average overhead to about 16%. In addition, it achieves better protection coverage compared to compiler-based techniques, as it can handle low-level machine code such as inline assembly or extra code introduced by the linker and loader.

Analysis of the source code of video games is not an integrated part of the formal analysis. Rather, few scholars have investigated how an analysis of the source code can inform a hermeneutic reading of the game. In this paper I will present a reading of the source code of Passage (Rohrer, 2007), argue for why a traditional focus on authorial intention is unnecessary when investigating the symbolism and metaphors of a game, and illustrate how source code analysis can inform the formal analysis of the executed game. Finally, I shall discuss how the source code relates to the game as a ‘work’, and how it can be used for studies of symbolism and metaphors. Thus, I will conclude that it is indeed a valuable method for game studies, although further studies should expand on the textual relation between executed game and source code.

The existing tools of deductive verification allow us to successfully prove the correctness of functions written in high-level languages such as C or Java. However, this may not be enough for critical software because even fully verified code cannot guarantee the correct generation of machine code by the compiler. At the moment, developers of such systems have to accept the compiler correctness assumption, which, however, is extremely undesirable, but inevitable due to the lack of full-fledged systems of formal verification of machine code. It is also worth noting that the verification of machine code by a person directly is an extremely time-consuming task due to the high complexity and large amounts of machine code. One of the approaches to simplify the verification of machine code is automatic deductive verification reusing the formal specification of the high-level language function. The formal specification of the function consists of the specification of the pre- and postcondition, as well as loop invariants, which specify conditions that are satified at each iteration of the loop. When compiling a program into machine code, pre- and postconditions are preserved, which, however, cannot be said about loop invariants. This fact is one of the main problems of automatic verification of machine code with loops. Another important problem is that high-level function variables often have ‘projections' to both registers and memory at the machine code level, and the verification procedure requires that invariants be described for each variable, and therefore the missing invariants must be generated. This paper presents an approach to solving these problems, based on the analysis of the control flow graph, and intelligent search of the locations of variables.

Correct Microkernel Primitives

This paper is a continuation of our previous work on solving source code authorship identification problems. The analysis of heterogeneous source code is a relevant issue for copyright protection in commercial software development. This is related to the specificity of development processes and the usage of collaborative development tools (version control systems). As a result, there are source codes written according to different programming standards by a team of programmers with different skill levels. Another application field is information security—in particular, identifying the author of computer viruses. We apply our technique based on a hybrid of Inception-v1 and Bidirectional Gated Recurrent Units architectures on heterogeneous source codes and consider the most common commercial development complex cases that negatively affect the authorship identification process. The paper is devoted to the possibilities and limitations of the author’s technique in various complex cases. For situations where a programmer was proficient in two programming languages, the average accuracy was 87%; for proficiency in three or more—76%. For the artificially generated source code case, the average accuracy was 81.5%. Finally, the average accuracy for source codes generated from commits was 84%. The comparison with state-of-the-art approaches showed that the proposed method has no full-functionality analogs covering actual practical cases.

To increase and maintain web application security, developers could use some different methods, one of them is static code analysis. This method could find security vulnerabilities inside a source code without the need of running the program. It could also be automated by using tools, which considered more efficient than manual reviews. One specific method which is commonly used in static code analysis is taint analysis. Taint analysis usually utilizes source code modeling to prepare the code for analysis process to detect any untrusted data flows into security sensitives computations. While this kind of analysis could be very helpful, static code analysis tool for Laravel-based web application is still quite rare, despite its popularity. Therefore, in this research, we want to know how static code (taint) analysis could be utilized to detect security vulnerabilities and how the projects (Laravel-based) should be modeled in order to facilitate this analysis. We then developed a static analysis tool, which models the application’s source code using AST and dictionary to be used as the base of the taint analysis. The tool first parsed the route file of Laravel project to get a list of controller files. Each file in that list would be parsed in order to build the source code representation, before actually being analyzed using taint analysis method. The experiments was done using this tool shows that the tools (with taint analysis) could detect 13 security vulnerabilities from 6 Laravel-based projects with one False Negative. An ineffective sanitizer was the suspected cause of this False Negative. This also shows that proposed modeling technique could be helpful in facilitating taint analysis in Laravel-based projects. For future development and studies, this tool should be tested with more Laravel and even other framework based web application with a wider range of security vulnerabilities.

Inspired by the great success of Deep Neural Networks (DNNs) in natural language processing (NLP), DNNs have been increasingly applied in source code analysis and attracted significant attention from the software engineering community. Due to its data-driven nature, a DNN model requires massive and high-quality labeled training data to achieve expert-level performance. Collecting such data is often not hard, but the labeling process is notoriously laborious. The task of DNN-based code analysis even worsens the situation because source code labeling also demands sophisticated expertise. Data augmentation has been a popular approach to supplement training data in domains such as computer vision and NLP. However, existing data augmentation approaches in code analysis adopt simple methods, such as data transformation and adversarial example generation, thus bringing limited performance superiority. In this paper, we propose a data augmentation approach MixCode that aims to effectively supplement valid training data, inspired by the recent advance named Mixup in computer vision. Specifically, we first utilize multiple code refactoring methods to generate transformed code that holds consistent labels with the original data. Then, we adapt the Mixup technique to mix the original code with the transformed code to augment the training data. We evaluate MixCode on two programming languages (Java and Python), two code tasks (problem classification and bug detection), four benchmark datasets (JAVA250, Python800, CodRep1, and Refactory), and seven model architectures (including two pretrained models CodeBERT and GraphCodeBERT). Experimental results demonstrate that MixCode outperforms the baseline data augmentation approach by up to 6.24% in accuracy and 26.06% in robustness.

Language analysis of scientific documents and analysis of source code have been done independently in the past. This work presents a network architecture and a self-supervised training approach to find alignments between published computer science research papers and their corresponding public source code by learning a representation of encodings from transformers, from which source code can be enriched with helpful information. We present our ideas, findings and plans for upcoming research.

Pattern matching or finding the occurrences of a pattern in a text arises frequently in many applications. The task of splitting the character stream or text into words is called tokenization. Search engines use tokenizers. The first phase of a compiler outputs a stream of tokens of the given high-level language program. The pattern rules are specified as regular expressions. Many tools have been developed in the past that generate the tokenizer automatically which are mostly sequential. The advent of multicore architectures has made it mandatory to use its features like multiple threads and SIMD instructions in generating software tools. This works attempts to parallelize tokenization. This is a simple prototype implementation of a parallelized lexical analyzer that recognizes the tokens of the given source code. Each Synergetic Processing Element (SPE) of the cell processor works on a block of source code and tokenizes them independently. The Power Processing Unit (PPE) is responsible for splitting the source code into a finite number of blocks to be used by the different processing elements. Each SPE sends the stream of identifiers to the PPE which maintains the symbol table. The parallel lexical analyzer developed runs on IBM Cell Processor simulator and the execution times are plotted varying the code size and the number of processing elements.

The SYMBOL 2R Computing System represents an attempt to bridge the gap between machine languages and higher level programming languages. This gap has always limited the users' ability to communicate with the machine, thus creating a communication problem. Early attempts at solving this communication problem consisted of developing a series of user-oriented programming languages, i.e., assembler languages and higher level languages, supplemented with a host of translator programs that would transform the higher level languages into machine language. For several years it seemed that this approach represented the only economically feasible solution. In 1965, W. H. Burkhardt (2) suggested the development of high-level language computers Burkhardt did suggest that the availability of low cost components would make high-level language computers an economically feasible solution. In fact, the recent decline in the cost of components as compared with the steady, if not increasing cost of the software needed to develop and maintain compilers for high-level languages, has made the high-level language computer solution seem even more attractive.

An architectural concept called Grammar-Programming is introduced which allows computers to be constructed that can directly execute a variety of high-level languages. Representing an intermediate level between the basic hardware/firmware functions of ordinary computers and the software operations of language translators, it is shown how grammar-programs can be constructed which specify the syntax and semantics of various programming languages. The Grammar-Programmable Machine (GPM) then uses these specifications to process directly the users' high-level language programs. In the Ph.D. dissertation* upon which this abstract is based, a model is first developed for representing the syntactic and semantic characteristics of context-free language generators, and an automaton called a Syntax Network (SN) is constructed. Next a simple, statement-directed language is introduced to express the states of the syntax network and to define the actual grammar-programming language. A simulator is then implemented which is used to test the grammar-programs written for ALGOL and SNOBOL. Finally, the architectural organization for the Grammar-Programmable Machine is described at the register-transfer level. By taking advantage of its intermediate position between software compilation and hardware interpretation of high-level languages, the Grammar-Programmable Machine is able to emphasize the best features of both techniques and to achieve a potential that neither can reach individually.

An architectural concept called Grammar-Programming is introduced which allows computers to be constructed that can directly execute a variety of high-level languages. Representing an intermediate level between the basic hardware/firmware functions of ordinary computers and the software operations of language translators, it is shown how grammar-programs can be constructed which specify the syntax and semantics of various programming languages. The Grammar-Programmable Machine (GPM) then uses these specifications to process directly the users' high-level language programs. In the Ph.D. dissertation* upon which this abstract is based, a model is first developed for representing the syntactic and semantic characteristics of context-free language generators, and an automaton called a Syntax Network (SN) is constructed. Next a simple, statement-directed language is introduced to express the states of the syntax network and to define the actual grammar-programming language. A simulator is then implemented which is used to test the grammar-programs written for ALGOL and SNOBOL. Finally, the architectural organization for the Grammar-Programmable Machine is described at the register-transfer level. By taking advantage of its intermediate position between software compilation and hardware interpretation of high-level languages, the Grammar-Programmable Machine is able to emphasize the best features of both techniques and to achieve a potential that neither can reach individually.

Self-adjusting computation offers a language-based approach to writing programs that automatically respond to dynamically changing data. Recent work made significant progress in developing sound semantics and associated implementations of self-adjusting computation for high-level, functional languages. These techniques, however, do not address issues that arise for low-level languages, i.e., stack-based imperative languages that lack strong type systems and automatic memory management. In this paper, we describe techniques for self-adjusting computation which are suitable for low-level languages. Necessarily, we take a different approach than previous work: instead of starting with a high-level language with additional primitives to support self-adjusting computation, we start with a low-level intermediate language, whose semantics is given by a stack-based abstract machine. We prove that this semantics is sound: it always updates computations in a way that is consistent with full reevaluation. We give a compiler and runtime system for the intermediate language used by our abstract machine. We present an empirical evaluation that shows that our approach is efficient in practice, and performs favorably compared to prior proposals.

Static code analysis is a very important stage in the development and implementation of software, and it needs to be used to obtain a better code. The most complicated in static analysis is the analysis of source code, and further analysis. Analysis of the source code can be done multiple times and expand the set of necessary grammar. The main goal was and remains to provide a solution to reduce the time needed for a global reassessment of static analysis at code level after a change.The main problem when using static code analysis is to build an abstract semantic graph, because each software solution is provided with a separate data warehouse. The proposed solution proposes to use as a database repository using graphs. Thus, the storage mechanisms of the created abstract semantic graph have been simplified, which in turn, in addition to increasing the clarity of the information we store, provides convenient ways to further work with the stored information.The developed solution can transform a rather large source repository into a graphic representation and maintain it later. It is found that the approach is suitable for carrying out code compliance checks and for performing static analysis tests on a graphic representation. This approach also uses advanced file-level detailing, accelerating static analysis. Based on my measurements, the frameworks are fast enough to help their users quickly change the repository of codes.This article confirms the thesis about the possibility of storing an abstract semantic graph in a graph database, and after refinement, if it contains sufficient transformations and requests for language processing, can become a complete transport for communication between various static analysis tools that usually perform one of two the functions of verification either for quality or for vulnerability, thereby making a unified creation of an abstract semantic graph.As an improvement it is necessary to consider the possibility of incremental analysis – the analysis of changes in the code, in order to minimize resource costs for a rather resource intensive operation of the structure of the abstract semantic graph.Manuscript received 09.06.2020

EDSA (expert data flow and static analysis tool) which uses static analysis of source code to help gain an understanding of existing code, is described. This may be for the purpose of tracking down a bug or to determine in advance whether an intended change will have any undesirable side effects. In either case, the phase of the development life cycle that is most likely to benefit from a tool like EDSA is the maintenance phase. EDSA provides three kinds of facilities. It helps to browse through code, following either the control flow or data flow, rather than the order in which the code happens to be written. It displays code with unimportant source lines eluded, so that the user can get a more global view of the program. Finally, it provides search management to make it easier to examine all possibilities when browsing. The mechanism used to create and display various views of programs is described and the approach to the user interface is discussed. The state of the current implementation is described. >