The Experts below are selected from a list of 2928 Experts worldwide ranked by ideXlab platform

Sebastian Fischmeister - One of the best experts on this subject based on the ideXlab platform.

  • qdime qos aware dynamic Binary Instrumentation
    Modeling Analysis and Simulation On Computer and Telecommunication Systems, 2017
    Co-Authors: Pansy Arafa, Hany Kashif, Guy Martin Tchamgoue, Sebastian Fischmeister
    Abstract:

    Software systems with quality of service (QoS), such as database management systems and web servers, are ubiquitous. Such systems must meet strict performance requirements. Instrumentation is a useful technique for the analysis and debugging of QoS systems. Dynamic Binary Instrumentation (DBI) extracts runtime information to comprehend system's behavior and detect performance bottlenecks. However, existing DBI tools are intrusive; adding unacceptable delay to the program execution. Such delay alters the performance requirements and degrades the overall quality and the user experience of the system. Moreover, the delay may change the system behavior, thus, producing misleading run-time information.This paper presents QDIME, a QoS-aware dynamic Binary Instrumentation technique that respects system's performance requirements. QDIME takes a user-defined QoS threshold as an input and periodically gathers QoS feedback from the system under analysis to decide its Instrumentation budget.We implemented QDIME on top of PIN, a popular DBI framework. We evaluated QDIME with Gzip, MySQL server, Apache HTTP server, and Redis. The experiments show that QDIME respects the user-defined QoS threshold and, thus, improves the performance of the monitored application by manifolds. QDIME is able to provide up to 100% Instrumentation coverage with an average of 92% when compared to PIN. Moreover, QDIME reduces the slow-down factor of the instrumented application by 1.41, 5.67, and 10.26 folds for Sys-trace, Call-trace, and Branch-profile respectively. A release of QDIME is available for download at https://github.com/pansy-arafa/qdime.

  • Redundancy Suppression In Time-Aware Dynamic Binary Instrumentation.
    arXiv: Software Engineering, 2017
    Co-Authors: Pansy Arafa, Hany Kashif, Sebastian Fischmeister
    Abstract:

    Software tracing techniques are well-established and used by Instrumentation tools to extract run-time information for program analysis and debugging. Dynamic Binary Instrumentation as one tool instruments program binaries to extract information. Unfortunately, Instrumentation causes perturbation that is unacceptable for time-sensitive applications. Consequently we developed DIME*, a tool for dynamic Binary Instrumentation that considers timing constraints. DIME* uses Pin and a rate-based server approach to extract information only as long as user-specified constraints are maintained. Due to the large amount of redundancies in program traces, DIME* reduces the Instrumentation overhead by one to three orders of magnitude compared to native Pin while extracting up to 99% of the information. We instrument VLC and PostgreSQL to demonstrate the usability of DIME*.

  • MASCOTS - QDIME: QoS-Aware Dynamic Binary Instrumentation
    2017 IEEE 25th International Symposium on Modeling Analysis and Simulation of Computer and Telecommunication Systems (MASCOTS), 2017
    Co-Authors: Pansy Arafa, Hany Kashif, Guy Martin Tchamgoue, Sebastian Fischmeister
    Abstract:

    Software systems with quality of service (QoS), such as database management systems and web servers, are ubiquitous. Such systems must meet strict performance requirements. Instrumentation is a useful technique for the analysis and debugging of QoS systems. Dynamic Binary Instrumentation (DBI) extracts runtime information to comprehend system's behavior and detect performance bottlenecks. However, existing DBI tools are intrusive; adding unacceptable delay to the program execution. Such delay alters the performance requirements and degrades the overall quality and the user experience of the system. Moreover, the delay may change the system behavior, thus, producing misleading run-time information.This paper presents QDIME, a QoS-aware dynamic Binary Instrumentation technique that respects system's performance requirements. QDIME takes a user-defined QoS threshold as an input and periodically gathers QoS feedback from the system under analysis to decide its Instrumentation budget.We implemented QDIME on top of PIN, a popular DBI framework. We evaluated QDIME with Gzip, MySQL server, Apache HTTP server, and Redis. The experiments show that QDIME respects the user-defined QoS threshold and, thus, improves the performance of the monitored application by manifolds. QDIME is able to provide up to 100% Instrumentation coverage with an average of 92% when compared to PIN. Moreover, QDIME reduces the slow-down factor of the instrumented application by 1.41, 5.67, and 10.26 folds for Sys-trace, Call-trace, and Branch-profile respectively. A release of QDIME is available for download at https://github.com/pansy-arafa/qdime.

  • dime time aware dynamic Binary Instrumentation using rate based resource allocation
    Embedded Software, 2013
    Co-Authors: Pansy Arafa, Hany Kashif, Sebastian Fischmeister
    Abstract:

    Program analysis tools are essential for understanding programs, analyzing performance, and optimizing code. Some of these tools use code Instrumentation to extract information at runtime. The Instrumentation process can alter program behavior such as timing behavior and memory consumption. Time-sensitive programs, however, must meet specific timing constraints and thus require that the Instrumentation process, for instance, bounds the timing overhead. Time-aware Instrumentation techniques try to honor the timing constraints of such programs. All previous techniques, however, support only static source-code Instrumentation methods. Hence, they become impractical beyond microcontroller code for instrumenting large programs along with all their library dependencies. In this work, we propose DIME, a time-aware dynamic Binary Instrumentation technique that adds an adjustable bound on the timing overhead to the program under analysis. We implement DIME using the dynamic Instrumentation framework, Pin. Quantitative evaluation of the three implementation alternatives shows an average reduction of the Instrumentation overhead by 12, 7, and 3 folds compared to native Pin. Instrumenting the VLC media player and a laser beam stabilization experiment demonstrate the practicality and scalability of DIME.

  • EMSOFT - DIME: time-aware dynamic Binary Instrumentation using rate-based resource allocation
    2013 Proceedings of the International Conference on Embedded Software (EMSOFT), 2013
    Co-Authors: Pansy Arafa, Hany Kashif, Sebastian Fischmeister
    Abstract:

    Program analysis tools are essential for understanding programs, analyzing performance, and optimizing code. Some of these tools use code Instrumentation to extract information at runtime. The Instrumentation process can alter program behavior such as timing behavior and memory consumption. Time-sensitive programs, however, must meet specific timing constraints and thus require that the Instrumentation process, for instance, bounds the timing overhead. Time-aware Instrumentation techniques try to honor the timing constraints of such programs. All previous techniques, however, support only static source-code Instrumentation methods. Hence, they become impractical beyond microcontroller code for instrumenting large programs along with all their library dependencies. In this work, we propose DIME, a time-aware dynamic Binary Instrumentation technique that adds an adjustable bound on the timing overhead to the program under analysis. We implement DIME using the dynamic Instrumentation framework, Pin. Quantitative evaluation of the three implementation alternatives shows an average reduction of the Instrumentation overhead by 12, 7, and 3 folds compared to native Pin. Instrumenting the VLC media player and a laser beam stabilization experiment demonstrate the practicality and scalability of DIME.

Pansy Arafa - One of the best experts on this subject based on the ideXlab platform.

  • qdime qos aware dynamic Binary Instrumentation
    Modeling Analysis and Simulation On Computer and Telecommunication Systems, 2017
    Co-Authors: Pansy Arafa, Hany Kashif, Guy Martin Tchamgoue, Sebastian Fischmeister
    Abstract:

    Software systems with quality of service (QoS), such as database management systems and web servers, are ubiquitous. Such systems must meet strict performance requirements. Instrumentation is a useful technique for the analysis and debugging of QoS systems. Dynamic Binary Instrumentation (DBI) extracts runtime information to comprehend system's behavior and detect performance bottlenecks. However, existing DBI tools are intrusive; adding unacceptable delay to the program execution. Such delay alters the performance requirements and degrades the overall quality and the user experience of the system. Moreover, the delay may change the system behavior, thus, producing misleading run-time information.This paper presents QDIME, a QoS-aware dynamic Binary Instrumentation technique that respects system's performance requirements. QDIME takes a user-defined QoS threshold as an input and periodically gathers QoS feedback from the system under analysis to decide its Instrumentation budget.We implemented QDIME on top of PIN, a popular DBI framework. We evaluated QDIME with Gzip, MySQL server, Apache HTTP server, and Redis. The experiments show that QDIME respects the user-defined QoS threshold and, thus, improves the performance of the monitored application by manifolds. QDIME is able to provide up to 100% Instrumentation coverage with an average of 92% when compared to PIN. Moreover, QDIME reduces the slow-down factor of the instrumented application by 1.41, 5.67, and 10.26 folds for Sys-trace, Call-trace, and Branch-profile respectively. A release of QDIME is available for download at https://github.com/pansy-arafa/qdime.

  • Redundancy Suppression In Time-Aware Dynamic Binary Instrumentation.
    arXiv: Software Engineering, 2017
    Co-Authors: Pansy Arafa, Hany Kashif, Sebastian Fischmeister
    Abstract:

    Software tracing techniques are well-established and used by Instrumentation tools to extract run-time information for program analysis and debugging. Dynamic Binary Instrumentation as one tool instruments program binaries to extract information. Unfortunately, Instrumentation causes perturbation that is unacceptable for time-sensitive applications. Consequently we developed DIME*, a tool for dynamic Binary Instrumentation that considers timing constraints. DIME* uses Pin and a rate-based server approach to extract information only as long as user-specified constraints are maintained. Due to the large amount of redundancies in program traces, DIME* reduces the Instrumentation overhead by one to three orders of magnitude compared to native Pin while extracting up to 99% of the information. We instrument VLC and PostgreSQL to demonstrate the usability of DIME*.

  • MASCOTS - QDIME: QoS-Aware Dynamic Binary Instrumentation
    2017 IEEE 25th International Symposium on Modeling Analysis and Simulation of Computer and Telecommunication Systems (MASCOTS), 2017
    Co-Authors: Pansy Arafa, Hany Kashif, Guy Martin Tchamgoue, Sebastian Fischmeister
    Abstract:

    Software systems with quality of service (QoS), such as database management systems and web servers, are ubiquitous. Such systems must meet strict performance requirements. Instrumentation is a useful technique for the analysis and debugging of QoS systems. Dynamic Binary Instrumentation (DBI) extracts runtime information to comprehend system's behavior and detect performance bottlenecks. However, existing DBI tools are intrusive; adding unacceptable delay to the program execution. Such delay alters the performance requirements and degrades the overall quality and the user experience of the system. Moreover, the delay may change the system behavior, thus, producing misleading run-time information.This paper presents QDIME, a QoS-aware dynamic Binary Instrumentation technique that respects system's performance requirements. QDIME takes a user-defined QoS threshold as an input and periodically gathers QoS feedback from the system under analysis to decide its Instrumentation budget.We implemented QDIME on top of PIN, a popular DBI framework. We evaluated QDIME with Gzip, MySQL server, Apache HTTP server, and Redis. The experiments show that QDIME respects the user-defined QoS threshold and, thus, improves the performance of the monitored application by manifolds. QDIME is able to provide up to 100% Instrumentation coverage with an average of 92% when compared to PIN. Moreover, QDIME reduces the slow-down factor of the instrumented application by 1.41, 5.67, and 10.26 folds for Sys-trace, Call-trace, and Branch-profile respectively. A release of QDIME is available for download at https://github.com/pansy-arafa/qdime.

  • dime time aware dynamic Binary Instrumentation using rate based resource allocation
    Embedded Software, 2013
    Co-Authors: Pansy Arafa, Hany Kashif, Sebastian Fischmeister
    Abstract:

    Program analysis tools are essential for understanding programs, analyzing performance, and optimizing code. Some of these tools use code Instrumentation to extract information at runtime. The Instrumentation process can alter program behavior such as timing behavior and memory consumption. Time-sensitive programs, however, must meet specific timing constraints and thus require that the Instrumentation process, for instance, bounds the timing overhead. Time-aware Instrumentation techniques try to honor the timing constraints of such programs. All previous techniques, however, support only static source-code Instrumentation methods. Hence, they become impractical beyond microcontroller code for instrumenting large programs along with all their library dependencies. In this work, we propose DIME, a time-aware dynamic Binary Instrumentation technique that adds an adjustable bound on the timing overhead to the program under analysis. We implement DIME using the dynamic Instrumentation framework, Pin. Quantitative evaluation of the three implementation alternatives shows an average reduction of the Instrumentation overhead by 12, 7, and 3 folds compared to native Pin. Instrumenting the VLC media player and a laser beam stabilization experiment demonstrate the practicality and scalability of DIME.

  • EMSOFT - DIME: time-aware dynamic Binary Instrumentation using rate-based resource allocation
    2013 Proceedings of the International Conference on Embedded Software (EMSOFT), 2013
    Co-Authors: Pansy Arafa, Hany Kashif, Sebastian Fischmeister
    Abstract:

    Program analysis tools are essential for understanding programs, analyzing performance, and optimizing code. Some of these tools use code Instrumentation to extract information at runtime. The Instrumentation process can alter program behavior such as timing behavior and memory consumption. Time-sensitive programs, however, must meet specific timing constraints and thus require that the Instrumentation process, for instance, bounds the timing overhead. Time-aware Instrumentation techniques try to honor the timing constraints of such programs. All previous techniques, however, support only static source-code Instrumentation methods. Hence, they become impractical beyond microcontroller code for instrumenting large programs along with all their library dependencies. In this work, we propose DIME, a time-aware dynamic Binary Instrumentation technique that adds an adjustable bound on the timing overhead to the program under analysis. We implement DIME using the dynamic Instrumentation framework, Pin. Quantitative evaluation of the three implementation alternatives shows an average reduction of the Instrumentation overhead by 12, 7, and 3 folds compared to native Pin. Instrumenting the VLC media player and a laser beam stabilization experiment demonstrate the practicality and scalability of DIME.

Ramesh Yerraballi - One of the best experts on this subject based on the ideXlab platform.

  • spike engineering malware analysis tools using unobtrusive Binary Instrumentation
    ACSC '06 Proceedings of the 29th Australasian Computer Science Conference - Volume 48, 2006
    Co-Authors: Amit Vasudevan, Ramesh Yerraballi
    Abstract:

    Malware -- a generic term that encompasses viruses, trojans, spywares and other intrusive code -- is widespread today. Malware analysis is a multi-step process providing insight into malware structure and functionality, facilitating the development of an antidote. Behavior monitoring, an important step in the analysis process, is used to observe malware interaction with respect to the system and is achieved by employing dynamic coarse-grained Binary-Instrumentation on the target system. However, current research involving dynamic Binary-Instrumentation, categorized into probe-based and just-in-time compilation (JIT), fail in the context of malware. Probe-based schemes are not transparent. Most if not all malware are sensitive to code modification incorporating methods to prevent their analysis and even instrument the system themselves for their functionality and stealthness. Current JIT schemes, though transparent, do not support multithreading, self-modifying and/or self-checking (SM-SC) code and are unable to capture code running in kernel-mode. Also, they are an overkill in terms of latency for coarse-grained Instrumentation.To address this problem, we have developed a new dynamic coarse-grained Binary-Instrumentation framework codenamed SPiKE, that aids in the construction of powerful malware analysis tools to combat malware that are becoming increasingly hard to analyze. Our goal is to provide a Binary-Instrumentation framework that is unobtrusive, portable, efficient, easy-to-use and reusable, supporting multithreading and SM-SC code, both in user- and kernel-mode. In this paper, we discuss the concept of unobtrusive Binary-Instrumentation and present the design, implementation and evaluation of SPiKE. We also illustrate the framework utility by describing our experience with a tool employing SPiKE to analyze a real world malware.

  • ACSC - SPiKE: engineering malware analysis tools using unobtrusive Binary-Instrumentation
    2006
    Co-Authors: Amit Vasudevan, Ramesh Yerraballi
    Abstract:

    Malware -- a generic term that encompasses viruses, trojans, spywares and other intrusive code -- is widespread today. Malware analysis is a multi-step process providing insight into malware structure and functionality, facilitating the development of an antidote. Behavior monitoring, an important step in the analysis process, is used to observe malware interaction with respect to the system and is achieved by employing dynamic coarse-grained Binary-Instrumentation on the target system. However, current research involving dynamic Binary-Instrumentation, categorized into probe-based and just-in-time compilation (JIT), fail in the context of malware. Probe-based schemes are not transparent. Most if not all malware are sensitive to code modification incorporating methods to prevent their analysis and even instrument the system themselves for their functionality and stealthness. Current JIT schemes, though transparent, do not support multithreading, self-modifying and/or self-checking (SM-SC) code and are unable to capture code running in kernel-mode. Also, they are an overkill in terms of latency for coarse-grained Instrumentation.To address this problem, we have developed a new dynamic coarse-grained Binary-Instrumentation framework codenamed SPiKE, that aids in the construction of powerful malware analysis tools to combat malware that are becoming increasingly hard to analyze. Our goal is to provide a Binary-Instrumentation framework that is unobtrusive, portable, efficient, easy-to-use and reusable, supporting multithreading and SM-SC code, both in user- and kernel-mode. In this paper, we discuss the concept of unobtrusive Binary-Instrumentation and present the design, implementation and evaluation of SPiKE. We also illustrate the framework utility by describing our experience with a tool employing SPiKE to analyze a real world malware.

Barton P Miller - One of the best experts on this subject based on the ideXlab platform.

  • anywhere any time Binary Instrumentation
    Workshop on Program Analysis For Software Tools and Engineering, 2011
    Co-Authors: Andrew R Bernat, Barton P Miller
    Abstract:

    The Dyninst Binary Instrumentation and analysis framework distinguishes itself from other Binary Instrumentation tools through its abstract, machine independent interface; its emphasis on anywhere, any-time Binary Instrumentation; and its low overhead that is proportional to the number of instrumented locations. Dyninst represents the program in terms of familiar control flow structures such as functions, loops, and basic blocks, and users manipulate these representations to insert Instrumentation anywhere in the Binary. We use graph transformation techniques to insure that this Instrumentation executes when desired even when instrumenting highly optimized (or malicious) code that other instrumenters cannot correctly instrument. Unlike other Binary instrumenters, Dyninst can instrument at any time in the execution continuum, from static Instrumentation (Binary rewriting) to instrumenting actively executing code (dynamic Instrumentation). Furthermore, we allow users to modify or remove Instrumentation at any time, with such modifications taking immediate effect. Our analysis techniques allow us to insert new code without modifying uninstrumented code; as a result, all uninstrumented code executes at native speed. We demonstrate that our techniques provide this collection of capabilities while imposing similar or lower overhead than other widely used instrumenters.

  • efficient sensitivity resistant Binary Instrumentation
    International Symposium on Software Testing and Analysis, 2011
    Co-Authors: Andrew R Bernat, Kevin Roundy, Barton P Miller
    Abstract:

    Binary Instrumentation allows users to inject new code into programs without requiring source code, symbols, or debugging information. Instrumenting a Binary requires structural modifications such as moving code, adding new code, and overwriting existing code; these modifications may unintentionally change the program's semantics. Binary instrumenters attempt to preserve the intended semantics of the program by further transforming the code to compensate for these structural modifications. Current instrumenters may fail to correctly preserve program semantics or impose significant unnecessary compensation cost because they lack a formal model of the impact of their structural modifications on program semantics. These weaknesses are particularly acute when instrumenting highly optimized or malicious code, making current instrumenters less useful as tools in the security or high-performance domains. We present a formal specification of how the structural modifications used by Instrumentation affect a Binary's visible behavior, and have adapted the Dyninst Binary instrumenter to use this specification, thereby guaranteeing correct Instrumentation while greatly reducing compensation costs. When compared against the fastest widely used instrumenters our technique imposed 46% less overhead; furthermore, we can successfully instrument highly defensive binaries that are specifically looking for code patching and Instrumentation.

  • PASTE - Anywhere, any-time Binary Instrumentation
    Proceedings of the 10th ACM SIGPLAN-SIGSOFT workshop on Program analysis for software tools - PASTE '11, 2011
    Co-Authors: Andrew R Bernat, Barton P Miller
    Abstract:

    The Dyninst Binary Instrumentation and analysis framework distinguishes itself from other Binary Instrumentation tools through its abstract, machine independent interface; its emphasis on anywhere, any-time Binary Instrumentation; and its low overhead that is proportional to the number of instrumented locations. Dyninst represents the program in terms of familiar control flow structures such as functions, loops, and basic blocks, and users manipulate these representations to insert Instrumentation anywhere in the Binary. We use graph transformation techniques to insure that this Instrumentation executes when desired even when instrumenting highly optimized (or malicious) code that other instrumenters cannot correctly instrument. Unlike other Binary instrumenters, Dyninst can instrument at any time in the execution continuum, from static Instrumentation (Binary rewriting) to instrumenting actively executing code (dynamic Instrumentation). Furthermore, we allow users to modify or remove Instrumentation at any time, with such modifications taking immediate effect. Our analysis techniques allow us to insert new code without modifying uninstrumented code; as a result, all uninstrumented code executes at native speed. We demonstrate that our techniques provide this collection of capabilities while imposing similar or lower overhead than other widely used instrumenters.

  • ISSTA - Efficient, sensitivity resistant Binary Instrumentation
    Proceedings of the 2011 International Symposium on Software Testing and Analysis - ISSTA '11, 2011
    Co-Authors: Andrew R Bernat, Kevin Roundy, Barton P Miller
    Abstract:

    Binary Instrumentation allows users to inject new code into programs without requiring source code, symbols, or debugging information. Instrumenting a Binary requires structural modifications such as moving code, adding new code, and overwriting existing code; these modifications may unintentionally change the program's semantics. Binary instrumenters attempt to preserve the intended semantics of the program by further transforming the code to compensate for these structural modifications. Current instrumenters may fail to correctly preserve program semantics or impose significant unnecessary compensation cost because they lack a formal model of the impact of their structural modifications on program semantics. These weaknesses are particularly acute when instrumenting highly optimized or malicious code, making current instrumenters less useful as tools in the security or high-performance domains. We present a formal specification of how the structural modifications used by Instrumentation affect a Binary's visible behavior, and have adapted the Dyninst Binary instrumenter to use this specification, thereby guaranteeing correct Instrumentation while greatly reducing compensation costs. When compared against the fastest widely used instrumenters our technique imposed 46% less overhead; furthermore, we can successfully instrument highly defensive binaries that are specifically looking for code patching and Instrumentation.

Andrew R Bernat - One of the best experts on this subject based on the ideXlab platform.

  • anywhere any time Binary Instrumentation
    Workshop on Program Analysis For Software Tools and Engineering, 2011
    Co-Authors: Andrew R Bernat, Barton P Miller
    Abstract:

    The Dyninst Binary Instrumentation and analysis framework distinguishes itself from other Binary Instrumentation tools through its abstract, machine independent interface; its emphasis on anywhere, any-time Binary Instrumentation; and its low overhead that is proportional to the number of instrumented locations. Dyninst represents the program in terms of familiar control flow structures such as functions, loops, and basic blocks, and users manipulate these representations to insert Instrumentation anywhere in the Binary. We use graph transformation techniques to insure that this Instrumentation executes when desired even when instrumenting highly optimized (or malicious) code that other instrumenters cannot correctly instrument. Unlike other Binary instrumenters, Dyninst can instrument at any time in the execution continuum, from static Instrumentation (Binary rewriting) to instrumenting actively executing code (dynamic Instrumentation). Furthermore, we allow users to modify or remove Instrumentation at any time, with such modifications taking immediate effect. Our analysis techniques allow us to insert new code without modifying uninstrumented code; as a result, all uninstrumented code executes at native speed. We demonstrate that our techniques provide this collection of capabilities while imposing similar or lower overhead than other widely used instrumenters.

  • efficient sensitivity resistant Binary Instrumentation
    International Symposium on Software Testing and Analysis, 2011
    Co-Authors: Andrew R Bernat, Kevin Roundy, Barton P Miller
    Abstract:

    Binary Instrumentation allows users to inject new code into programs without requiring source code, symbols, or debugging information. Instrumenting a Binary requires structural modifications such as moving code, adding new code, and overwriting existing code; these modifications may unintentionally change the program's semantics. Binary instrumenters attempt to preserve the intended semantics of the program by further transforming the code to compensate for these structural modifications. Current instrumenters may fail to correctly preserve program semantics or impose significant unnecessary compensation cost because they lack a formal model of the impact of their structural modifications on program semantics. These weaknesses are particularly acute when instrumenting highly optimized or malicious code, making current instrumenters less useful as tools in the security or high-performance domains. We present a formal specification of how the structural modifications used by Instrumentation affect a Binary's visible behavior, and have adapted the Dyninst Binary instrumenter to use this specification, thereby guaranteeing correct Instrumentation while greatly reducing compensation costs. When compared against the fastest widely used instrumenters our technique imposed 46% less overhead; furthermore, we can successfully instrument highly defensive binaries that are specifically looking for code patching and Instrumentation.

  • PASTE - Anywhere, any-time Binary Instrumentation
    Proceedings of the 10th ACM SIGPLAN-SIGSOFT workshop on Program analysis for software tools - PASTE '11, 2011
    Co-Authors: Andrew R Bernat, Barton P Miller
    Abstract:

    The Dyninst Binary Instrumentation and analysis framework distinguishes itself from other Binary Instrumentation tools through its abstract, machine independent interface; its emphasis on anywhere, any-time Binary Instrumentation; and its low overhead that is proportional to the number of instrumented locations. Dyninst represents the program in terms of familiar control flow structures such as functions, loops, and basic blocks, and users manipulate these representations to insert Instrumentation anywhere in the Binary. We use graph transformation techniques to insure that this Instrumentation executes when desired even when instrumenting highly optimized (or malicious) code that other instrumenters cannot correctly instrument. Unlike other Binary instrumenters, Dyninst can instrument at any time in the execution continuum, from static Instrumentation (Binary rewriting) to instrumenting actively executing code (dynamic Instrumentation). Furthermore, we allow users to modify or remove Instrumentation at any time, with such modifications taking immediate effect. Our analysis techniques allow us to insert new code without modifying uninstrumented code; as a result, all uninstrumented code executes at native speed. We demonstrate that our techniques provide this collection of capabilities while imposing similar or lower overhead than other widely used instrumenters.

  • ISSTA - Efficient, sensitivity resistant Binary Instrumentation
    Proceedings of the 2011 International Symposium on Software Testing and Analysis - ISSTA '11, 2011
    Co-Authors: Andrew R Bernat, Kevin Roundy, Barton P Miller
    Abstract:

    Binary Instrumentation allows users to inject new code into programs without requiring source code, symbols, or debugging information. Instrumenting a Binary requires structural modifications such as moving code, adding new code, and overwriting existing code; these modifications may unintentionally change the program's semantics. Binary instrumenters attempt to preserve the intended semantics of the program by further transforming the code to compensate for these structural modifications. Current instrumenters may fail to correctly preserve program semantics or impose significant unnecessary compensation cost because they lack a formal model of the impact of their structural modifications on program semantics. These weaknesses are particularly acute when instrumenting highly optimized or malicious code, making current instrumenters less useful as tools in the security or high-performance domains. We present a formal specification of how the structural modifications used by Instrumentation affect a Binary's visible behavior, and have adapted the Dyninst Binary instrumenter to use this specification, thereby guaranteeing correct Instrumentation while greatly reducing compensation costs. When compared against the fastest widely used instrumenters our technique imposed 46% less overhead; furthermore, we can successfully instrument highly defensive binaries that are specifically looking for code patching and Instrumentation.

  • scalable dynamic Binary Instrumentation for blue gene l
    ACM Sigarch Computer Architecture News, 2005
    Co-Authors: Martin Schulz, Andrew R Bernat, D Ahn, Bronis R. De Supinski, Gregory L. Lee, Barry Rountree
    Abstract:

    Dynamic Binary Instrumentation for performance analysis on new, large scale architectures such as the IBM Blue Gene/L system (BG/L) poses new challenges. Their scale---with potentially hundreds of thousands of compute nodes---requires new, more scalable mechanisms to deploy and to organize Binary Instrumentation and to collect the resulting data gathered by the inserted probes. Further, many of these new machines don't support full operating systems on the compute nodes; rather, they rely on light-weight custom compute kernels that do not support daemon-based implementations.We describe the design and current status of a new implementation of the DPCL (Dynamic Probe Class Library) API for BG/L. DPCL provides an easy to use layer for dynamic Instrumentation on parallel MPI applications based on the DynInst dynamic Instrumentation mechanism for sequential platforms. Our work includes modifying DynInst to control Instrumentation from remote I/O nodes and porting DPCL's communication to use MRNet, a scalable data reduction network for collecting performance data. We describe extensions to the DPCL API that support Instrumentation of task subsets and aggregation of collected performance data. Overall, our implementation provides a scalable infrastructure that provides efficient Binary Instrumentation on BG/L.