My 17 years of binary analysis has taught me one thing: “easy” things in compilation and program analysis are often the “hard” things in binary analysis. Want to analyze assembly? Write an IL (oh my)! Want to perform static analysis? Let’s implement this data-flow analysis from the dragon book (oh wait...). The experiments seem to be working out except this case, but that’s just an engineering issue (wait, there really is a fundamental science problem there...). Want to transition this tool to practice? I’ll just open source it (oh, maintaining is hard work). I could make a company out of that (uh, customers aren’t asking to solve the hard scientific problems, they just want it to work). I’ll share some hilariously naive mindsets I had, and share some dinosaur-sized research problems that can (mistakenly) look like just small bugs. Where do we go? What’s the next step in the evolution of binary analysis to truly be able to find and fix vulnerabilities in software we all use?
The hard things about analyzing 1’s and 0’s...
Dr. David Brumley, Carnegie Mellon University - ForAllSecure
View More Papers
Yihao Sun, Jeffrey Ching, Kristopher Micinski (Department of Electical Engineering and Computer Science, Syracuse University)Read More
Kimberly Redmond (University of South Carolina), Lannan Luo (University of South Carolina), Qiang Zeng (University of South Carolina)Read More
Navid Emamdoost (University of Minnesota), Vaibhav Sharma (University of Minnesota), Taejoon Byun (University of Minnesota), Stephen McCamant (University of Minnesota)Read More
Sheng-Han Wen (National Taiwan University), Wei-Loon Mow (National Taiwan University), Wei-Ning Chen (National Taiwan University), Chien-Yuan Wang (National Taiwan University),...Read More