BAHK: Flexible Automated Binary Analysis Method with the Assistance of Hardware and System Kernel To protect core functions, applications often utilize the countermeasure techniques such as antidebugging to avoid analysis by outsiders, especially the malware. Dynamic binary instrumentation is commonly used in the analysis of binary programs. However, it can be easily detected and has stability and applicability problems as it involves program rewriting and justintime compilation. This paper proposes a new lightweight analysis method for binary programs with the assistance of hardware features and the operating system kernel, named BAHK, which can automatically analyze the target program by stealth and has wide applicability. With the support of underlying infrastructures, this paper designs several optimization strategies and specific analysis approaches at instruction level to reduce the impact of finegrained analysis on the performance of target program so that it can be well applied in practice. The experimental results show that the proposed method has good stealthiness, low memory consumption, and positive user experience. In some cases, it shows better analysis performance than the traditional dynamic binary instrumentation method. Finally, the real case studies further show its feasibility and effectiveness.

Batch Alias Analysis Many programanalysis based tools require precise pointstoalias information only for some program variables. To meet this requirement efficiently, there have been many works on demanddriven analyses that perform only the work necessary to compute the pointsto or alias information on the requested variables (queries). However, these demanddriven analyses can be very expensive when applied on large systems where the number of queries can be significant. Such a blowup in analysis time is unacceptable in cases where scalability with realtime constraints is crucial; for example, when program analysis tools are plugged into an IDE (Integrated Development Environment). In this paper, we propose schemes to improve the scalability of demanddriven analyses without compromising on precision. Our work is based on novel ideas for eliminating irrelevant and redundant dataflow paths for the given queries. We introduce the idea of batch analysis, which can answer multiple given queries in batch mode. Batch analysis suits the environments with strict time constraints, where the queries come in batch. We present a batch alias analysis framework that can be used to speed up given demanddriven alias analysis. To show the effectiveness of this framework, we use two demanddriven alias analyses (1) the existing best performing demanddriven alias analysis tool for racedetection clients and (2) an optimized version thereof that avoids irrelevant computation. Our evaluations on a simulated datarace client, and on a recent programunderstanding tool, show that batch analysis leads to significant performance gains, along with minor gains in precision.