Sciweavers

Share
CCS
2008
ACM

Tupni: automatic reverse engineering of input formats

9 years 4 months ago
Tupni: automatic reverse engineering of input formats
Recent work has established the importance of automatic reverse engineering of protocol or file format specifications. However, the formats reverse engineered by previous tools have missed important information that is critical for security applications. In this paper, we present Tupni, a tool that can reverse engineer an input format with a rich set of information, including record sequences, record types, and input constraints. Tupni can generalize the format specification over multiple inputs. We have implemented a prototype of Tupni and evaluated it on 10 different formats: five file formats (WMF, BMP, JPG, PNG and TIF) and five network protocols (DNS, RPC, TFTP, HTTP and FTP). Tupni identified all record sequences in the test inputs. We also show that, by aggregating over multiple WMF files, Tupni can derive a more complete format specification for WMF. Furthermore, we demonstrate the utility of Tupni by using the rich information it provides for zeroday vulnerability signature g...
Weidong Cui, Marcus Peinado, Karl Chen, Helen J. W
Added 12 Oct 2010
Updated 12 Oct 2010
Type Conference
Year 2008
Where CCS
Authors Weidong Cui, Marcus Peinado, Karl Chen, Helen J. Wang, Luis Irún-Briz
Comments (0)
books