Overvew

This is a graduate-level research-oriented course. The goal of this course is to teach graduate students the state-of-the-art binary analysis techniques and tools and their applications to security problems. This course is aimed to balance between lectures, lab assignments and projects, such that the students can grasp the core concepts, gain first-hand experience through lab assignments to reinforce the understanding of these concepts, and further explore unknowns via course projects.

• Instructor: Heng Yin
• Email: heng AT cs DOT ucr DOT edu
• Office: Winston Chung Hall 316
• Office hours: Mon/Thu 1-3PM
• Location and Time:CHASS Interdisciplinary-South 2138, Tue/Thu 5:10-6:30PM

Topics

• Security Applications
• Malware analysis and deobfuscation
• Vulnerability discovery and mitigation
• Basics about binary code
• Disassembler and debugger
• Call graph, control-flow graph, stack frames, global and local variables, calling conventions, vTables, etc.
• Dynamic binary analysis
• Dynamic binary instrumentation
• Dynamic taint analysis
• Fuzzing: blackbox/greybox/whitebox, mutation and generation based.
• Symbolic execution: online and offline, concolic testing
• Static binary analysis
• Data flow analysis
• Value set analysis
• Slicing
• Program integrity models
• Control flow integrity
• Data flow integrity
• Software fault isolation
• Code pointer integrity

Schedule

Date	Topics	Note
01/10	Course Syllabus Introduction of Software Security Introduction of DARPA Cyber Grand Challenge
01/12	Introduction of Software Security (cont'ed)
01/17	Disassembly Basics Buffer Overflow Exploit Construction	Lab 1 is out. Due next Tuesday
01/19	Dynamic Binary Translation and Instrumentation Reading materials: Pin: Building Customized Program Analysis Tools with Dynamic Instrumentation Valgrind: A Framework for Heavyweight Dynamic Binary Instrumentation QEMU, a Fast and Portable Dynamic Translator
01/24	How to write a pintool Dynamic Taint Analysis: Pointer Tainting, Taint Explosion, Soundness and Precision Reading materials: Dynamic Taint Analysis for Automatic Detection, Analysis, and Signature Generation of Exploits on Commodity Software Pointless Tainting? Evaluating the Practicality of Pointer Tainting On the Soundness and Precision of Dynamic Taint Analysis	Lab 2 is out, due next Tuesday.
01/26	Whole-System Dynamic Binary Analysis: System-Wide Tainting, Virtual Machine Introspection, TEMU, DECAF. Reading materials: Panorama: capturing system-wide information flow for malware detection and analysis Make It Work, Make It Right, Make It Fast: Building a Platform-Neutral Whole-System Dynamic Binary Analysis Platform
01/31	Whole-System Dynamic Analysis (cont'ed):Panda, DroidScope. Reading materials: Repeatable Reverse Engineering for the Greater Good with PANDA DroidScope: Seamlessly Reconstructing the OS and Dalvik Semantic Views for Dynamic Android Malware Analysis	Lab 3 is out, due next Tuesday.
02/02	Fuzzing: blackbox, whitebox, greybox, mutation based, generation based. Reading materials: Optimizing Seed Selection for Fuzzing Scheduling Black-box Mutational Fuzzing Revolutionizing the Field of Grey-box Attack Surface Testing with Evolutionary Fuzzing
02/07	Introduction to symbolic execution Reading materials: Symbolic Execution for Software Testing: Three Decades Later Unleashing MAYHEM on Binary Code Driller: Augmenting Fuzzing Through Selective Symbolic Execution	Lab 4 is out, due next Tuesday.
02/09	Introduction to Angr
02/14	Control Flow Integrity Reading materials: Control-Flow Integrity Control Flow Integrity for COTS Binaries	Lab 5 is out, due next Tuesday.
02/16	More about Control Flow Integrity; Software-based Fault Isolation Reading materials: vfGuard: Strict Protection for Virtual Function Calls in COTS C++ Binaries Binary Code Continent: Finer-Grained Control Flow Integrity for Stripped Binaries Efficient Software-based Fault Isolation Native Client: A Sandbox for Portable, Untrusted x86 Native Code
02/21	Introduction to Program Slicing Reading materials: Program Slicing Dynamic Program Slicing
02/23	Data Structure Reverse Engineering and Type Inference Reading materials: Automatic Reverse Engineering of Program Data Structures from Binary Execution TIE: Principled Reverse Engineering of Types in Binary Programs	Project proposal is due by now
02/28	No Class	Due to conference travel
03/02
03/07
03/09
03/14
03/16
03/18	Final Project Presentation

Lab Assignments (Tentative)

1. Binary Code Comprehension: Construct simple exploits from binary code.
2. Dynamic Binary Instrumentation: Develop a simple pintool for shadow stack protection.
3. Dynamic Taint Analysis: Develop a simple DECAF plugin to perform dynamic taint analysis to detect exploits.
4. Symbolic Execution: Write simple angr scripts to find vulnerabilities.
5. Control Flow Integrity: Implement CFI in pintool.
6. Automatic Exploit Generation: Modify/enhance angr scripts to generate exploits.

Projects

A list of suggeted projects will be provided. Students may also propose their own projects.

Grading (Tentative)

• Class participation: 10%
• Lab assignments: 60%
• Project presentation: 15%
• Final report: 15%