150 likes | 163 Views
Summarizing Calling Contexts. Prathmesh Prabhu. Looking up the peep hole. Tell them what you're going to tell them. Contextualize Function summaries Context summaries. Machinery WPDS Post star and pre star operations. Translation: the idea. The system in effect
E N D
Summarizing Calling Contexts Prathmesh Prabhu Looking up the peep hole
Contextualize • Function summaries • Context summaries • Machinery • WPDS • Post star and pre star operations • Translation: the idea • The system in effect • Implementation & issues • Experiments & issues • Where do we go from here?
Function Summaries mS c1 r1 mE mS pS pS p2 p3 pE c1 p1 p2 p1 Flow sensetive, Context sensetive, Path insensetive Analysis r1 p3 mE pE
Function Summaries : recursion mS c1 r1 mE mS Summarize pS p1 pE pS Looking down The peep hole c1 c2 r2 p1 c2 pS p1 pE r1 r2 c2 r2 mE pE pS p1 pE c2 r2
Context Summaries mS m1 c1 c3 pS p1 c2 r1 r3 r2 m2 pE mE
Peep Up r3 c3 m2 mE m1 mS c1 r1 p1 pS pE pS p1 pE c2 r2 c2 r2 p1 pS pE up down pS p1 pE c2 r2 c2 r2
Weighted Push Down Systems p1 p2 The Magic Slide!!! a / b (w) w (p1, a) (p2, b) Pre* Post*
PDS - transformation Program mS Stack: program nodes pS c1 T(mS) (program, mS) (program, c1) p1 p2 T(c1) (program, c1) (program, pS . r1) T(pE) r1 p3 (program, pE) (program, * ) mE pE
Collecting our paths up down T(mS) down down (down, mS ) (down, c1 ) Stack: T(c1) down down down (down, c1 ) (down, pS . r1 ) down mS T(pE) down c1 (down, pE ) (down, * ) mS T(mS) c1 c1 (up, mS ) (up, c1 )
The reverse call T(pE) c1 # # (up, pE ) (up, r1 . pS ) c1 r1 T(c1) c1 (up, c1 ) (up, * ) pS pE And some more...
Implementation • Affine Relations Analysis • TSL-VSA eax + 20 * edx = 0 esp + (-4) * ebp = 0 • EWPDS
Experiments & Issues • TSL-VSA regression suite • Not representative • No promising results • Small real world binaries
Future directions • Other simple analysis: live-flag-analysis, may-kill-use, L-ARA • Translation to application domain
Thank you For your patience