SOK: (State of) The Art of War: Offensive Techniques in Binary Analysis
By Yan Shoshitaishvili, Ruoyu Wang, Christopher Salls, Nick Stephens, Mario Polino, Andrew Dutcher, John Grosen, Siji Feng, Christophe Hauser, Christopher Krügel and 1 more. IEEE Symposium on Security and Privacy, 2016
1,132 citations recorded by the source corpus.
Subfields: Artificial Intelligence, Software, Signal Processing
View Paper: https://www.semanticscholar.org/paper/a500e615cc4315c5ab5bd7419dbdb36699d978b7
How researchers see this paper
The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.
In Artificial Intelligence
- Guoxing Chen
- Sanchuan Chen
- Yinqian Zhang
- Michael W. Hicks
- Mathias Payer
- Michael Bailey
- Andrew K. Miller
- Peng Chen
In Software
- Bihuan Chen
- Yang Liu
- Yan Shoshitaishvili
- Mathias Payer
- Hui Peng
- Andrea Fioraldi
- Marc Heuse
- Dominik Christian Maier
In Signal Processing
- Bihuan Chen
- Mathias Payer
- Yan Shoshitaishvili
- Hui Peng
- Yang Liu
- Andrea Fioraldi
- Marc Heuse
- Dominik Christian Maier
Citations in the corpus
- Erays: Reverse Engineering Ethereum's Opaque Smart Contracts (2018, methodology): “Indirect branches present a challenge when determining the target address [46].”
- Manticore: A User-Friendly Symbolic Execution Framework for Binaries and Smart Contracts (2019, background): “angr [18] is a well known binary analysis framework, including extensive symbolic execution functionality.”
- AFL++ : Combining Incremental Steps of Fuzzing Research (2020, methodology): “In tests performed by Shoshitaishvili et al., symbolically-assisted fuzzing identified almost three times more vulnerabilities than symbolic execution [39].”
- SgxPectre Attacks: Leaking Enclave Secrets via Speculative Execution (2018, methodology): “isfy the path conditions. Using symbolic execution techniques, we can explore multiple execution paths in the enclave programs to find gadgets of SgxPectre Attacks. More specifically, we leverageangr [66], a popular binary analysis framework to perform the symbolic execution. During the simulated ex”
- SgxPectre: Stealing Intel Secrets from SGX Enclaves Via Speculative Execution (2018, methodology): “isfy the path conditions. Using symbolic execution techniques, we can explore multiple execution paths in the enclave programs to find gadgets of SgxPectre Attacks. More specifically, we leverageangr [66], a popular binary analysis framework to perform the symbolic execution. During the simulated ex”
- Steelix: program-state based binary fuzzing (2017, background): “They usually apply heavy-weight program analysis such as symbolic execution [43] to improve the effectiveness but may have scalability problems.”
- QSYM : A Practical Concolic Execution Engine Tailored for Hybrid Fuzzing (2018, methodology): “This is a common way to handle functions that cannot be emulated in symbolic execution [4, 19], but it is difficult to apply to forking-based symbolic execution, which breaks process boundaries [20].”
- Angora: Efficient Fuzzing by Principled Search (2018, background): “But the challenges of path explosion and constraint solving make symbolic execution hard to scale [6, 27].”
- T-Fuzz: Fuzzing by Program Transformation (2018, methodology): “False-positive-prone static analyses report false positive rates of around 90% for the analysis of binary software [21], [27].”
- Understanding security mistakes developers make: Qualitative analysis from Build It, Break It, Fix It (2020, methodology): “Moreover, we believe that modern analysis tools and testing techniques [6,7,13,14,23,27,37, 40,43,70,71,81] should uncover many of them.”