Closed trolldbois closed 7 years ago
RDS: Recursive data structure profiling, 2005
Laika: Digging For Data Structures, 2008 Keywords: Similarity in malware
SigGraph: Brute Force Scanning of Kernel Data Structure Instances Using Graph-based Signatures, 2011 Keywords: data structure isomorphism, signature creation, Kernel rootkit detection, kernel version inference Detection of kernel structures in memory dump. Compiler based approach. Generate signatures based on source code (AST).
KOP
MAS Microsoft efforts at rootkit detection in kernel memory dumps. Massive data source.
MemPick: High-Level Data Structure Detection in C/C++ Binaries Keywords: Shape analysis, Allocation dynamic analysis, overlay Uses Intel PIN to instrument allocation primitives. Creates a graph based on pointer values? Type analysis. Overlays detection. Classify linked list, trees shapes. Performance assessment of tree usage. Overall, conclusion seems focused on detection of linked list structures (hint at performance domain).
DDT: design and evaluation of a dynamic program analysis for optimizing data structure usage, 2009
Rewards: Automatic reverse engineering of data structures from binary execution, 2010
Howard: a dynamic excavator for reverse engineering data structures, 2011
TIE: Principled reverse engineering of types in binary programs, 2011
https://scholar.google.com/scholar?cluster=4083491147070699259&hl=en&as_sdt=0,5&sciodt=0,5
MemPick: High-Level Data Structure Detection in C/C++ Binaries