Extracting compiler provenance from program binaries

13 years 9 months ago

Download pages.cs.wisc.edu

We present a novel technique that identiﬁes the source compiler of program binaries, an important element of program provenance. Program provenance answers fundamental questions of malware analysis and software forensics, such as whether programs are generated by similar tool chains; it also can allow development of debugging, performance analysis, and instrumentation tools speciﬁc to particular compilers. We formulate compiler identiﬁcation as a structured learning problem, automatically building models to recognize sequences of binary code generated by particular compilers. We evaluate our techniques on a large set of real-world test binaries, showing that our models identify the source compiler of binary code with over 90% accuracy, even in the presence of interleaved code from multiple compilers. A case study demonstrates the use of inferred compiler provenance to augment stripped binary parsing, reducing parsing errors by 18%. Categories and Subject Descriptors D.3.4 [Progr...

Nathan E. Rosenblum, Barton P. Miller, Xiaojin Zhu

Real-time Traffic