DOE OSTI · 1813903
Understanding Data Structures by Extracting Memory Access Graphs
Abstract
Understanding the data structures employed by a program is important for reverse engineering activities and can improve the results of automated software analysis techniques. In a compiled binary, access to data structure fields and array indices defined in the source program are replaced by raw pointer arithmetic. We present a representation for capturing the essential details of how a program accesses memory regions, which we call a Memory Access Graph (MAG), and a static analysis for automatically extracting this information from a program binary. The static analysis to extract the MAGs from the program is straightforward and does not require sophisticated integer or pointer analysis. The MAGs are readily understood by reverse engineers; they are generally able to perceive the data structure definition corresponding to a MAG. We briefly discuss automatic extraction of structure definitions outlining some of the difficulties in doing so.
Explore related subjects
Keep this discovery
Explore connections, maps & timelines
Reedy, Geoffrey Edward, Bertels, Alex, Sorensen, Asael Hal. 2017-09-01. Understanding Data Structures by Extracting Memory Access Graphs. https://doi.org/10.2172/1813903
Cite the original work for its findings. Save a collection to share your selection of sources.