Oscar Llorente – S3lab

Loading binaries in Linux

Oscar Llorente — Sun, 14 Oct 2018 16:36:44 +0000

Executables are a static representation of a program and that at the time they are executed, the kernel uses the information included in those files to create a dynamic representation, better known as the process images. Before being able to execute…

Dynamic binary instrumentation

Oscar Llorente — Fri, 06 Jul 2018 12:53:23 +0000

In the previous post we talked about the possibilities to implement programs and carry out all kinds of tasks such as profiling or vulnerability detection. We also introduced Intel Pin, a dynamic binary instrumentation tool (mainly for IA32 and x86_64), which we are going to talk about in this installment. Like a debugger, Pin can launch an application or can be set to a running process, intrument it as necessary, collect the information of interest and separate at any time so that it can continue with its normal execution. To have control over the instrumented process uses calls to ptrace () (in Linux) that we saw in a previous post. The general architecture of Intel Pin is shown in the figure but for more detail I recommend reading the original article.

The post Dynamic binary instrumentation appeared first on S3lab.

Program instrumentation options

Oscar Llorente — Mon, 14 May 2018 13:00:52 +0000

Many of the methods of software testing and dynamic analysis of programs (not necessarily related to security) require inserting some additional instructions in the text of the program to obtain added information, that is, to instrument the program. For example, one of the options when measuring the performance of an application is to add statements to read the clock at the beginning and end of each function so that you can calculate the time it takes to run each and then optimize the that take longer than necessary.

The post Program instrumentation options appeared first on S3lab.

Starting code debugging (II) – Breakpoints

Oscar Llorente — Fri, 16 Mar 2018 10:57:02 +0000

One of the most useful functions provided by debuggers is setting breakpoints in certain lines of code to stop execution at those points and examine the status of the program. Breakpoints can be both hardware and software. GDB can set…

Starting code debugging (I)

Oscar Llorente — Wed, 31 Jan 2018 16:23:30 +0000

Errors are a collateral (and undesired) phenomenon that occur when writing code. Some, like syntactic errors, are easy to detect and correct, since normally the compiler, interpreter or IDE itself will warn us that we have some open parentheses for example. However, other errors can produce intense headaches, such as a segmentation fault somewhere within miles of lines of code that is triggered by a series of specific conditions.

The post Starting code debugging (I) appeared first on S3lab.

The idea behind the symbolic execution

Oscar Llorente — Tue, 07 Nov 2017 09:31:09 +0000

Following in the line of program analysis techniques, this time we are going to talk about a technique that is somewhere in between static techniques and dynamics, symbolic execution. It is a type of analysis that covers different limitations of static and dynamic analysis and provides a solution to address the limited semantic view of fuzzing, which is why it is used by a huge number of security applications, such as vulnerability detection. , malware analysis or generation of test cases.

The post The idea behind the symbolic execution appeared first on S3lab.