This ebook is the first authorized digital version of Kernighan and Ritchie's 1988 classic, The C Programming Language (2nd Ed.). One of the best-selling programming books published in the last fifty years, "K&R" has been called everything from the "bible" to "a landmark in computer science" and it has influenced generations of programmers. Available now for all leading ebook platforms, this concise and beautifully written text is a "must-have" reference for every serious programmers digital library.

As modestly described by the authors in the Preface to the First Edition, this "is not an introductory programming manual; it assumes some familiarity with basic programming concepts like variables, assignment statements, loops, and functions. Nonetheless, a novice programmer should be able to read along and pick up the language, although access to a more knowledgeable colleague will help."

The C programming language

IEEE transactions on very large scale integration (VLSI) systems

It is well-known that static disassembly is an unsolved problem, but how much of a problem is it in real software—for instance, for binary protection schemes? This work studies the accuracy of nine state-of-the-art disassemblers on 981 real-world compiler-generated binaries with a wide variety of properties. In contrast, prior work focuses on isolated corner cases; we show that this has led to a widespread and overly pessimistic view on the prevalence of complex constructs like inline data and overlapping code, leading reviewers and researchers to underestimate the potential of binary-based research. On the other hand, some constructs, such as function boundaries, are much harder to recover accurately than is reflected in the literature, which rarely discusses much needed error handling for these primitives. We study 30 papers recently published in six major security venues, and reveal a mismatch between expectations in the literature, and the actual capabilities of modern disassemblers. Our findings help improve future research by eliminating this mismatch.

/pdf/an-in-depth-analysis-of-disassembly-on-full-scale-x86-x64-2wvcrz31ju.pdf

An In-Depth Analysis of Disassembly on Full-Scale x86/x64 Binaries

Machine learning techniques are widely used in addition to signatures and heuristics to increase the detection rate of anti-malware software, as they automate the creation of detection models, making it possible to handle an ever-increasing number of new malware samples. In order to foil the analysis of anti-malware systems and evade detection, malware uses packing and other forms of obfuscation. However, few realize that benign applications use packing and obfuscation as well, to protect intellectual property and prevent license abuse. In this paper, we study how machine learning based on static analysis features operates on packed samples. Malware researchers have often assumed that packing would prevent machine learning techniques from building effective classifiers. However, both industry and academia have published results that show that machine-learning-based classifiers can achieve good detection rates, leading many experts to think that classifiers are simply detecting the fact that a sample is packed, as packing is more prevalent in malicious samples. We show that, different from what is commonly assumed, packers do preserve some information when packing programs that is “useful” for malware classification. However, this information does not necessarily capture the sample’s behavior. We demonstrate that the signals extracted from packed executables are not rich enough for machine-learning-based models to (1) generalize their knowledge to operate on unseen packers, and (2) be robust against adversarial examples. We also show that a na¨ive application of machine learning techniques results in a substantial number of false positives, which, in turn, might have resulted

/pdf/when-malware-is-packin-heat-limits-of-machine-learning-4uu4zoz1j8.pdf

When Malware is Packin' Heat; Limits of Machine Learning Classifiers Based on Static Analysis Features.

More and more app developers use the packing services (or packers) to prevent attackers from reverse engineering and modifying the executable (or Dex files) of their apps At the same time, malware authors also use the packers to hide the malicious component and evade the signature-based detection Although there are a few recent studies on unpacking Android apps, it has been shown that the evolving packers can easily circumvent them because they are not adaptive to the changes of packers In this paper, we propose a novel adaptive approach and develop a new system, named PackerGrind, to unpack Android apps We also evaluate PackerGrind with real packed apps, and the results show that PackerGrind can successfully reveal the packers' protection mechanisms and recover the Dex files with low overhead, showing that our approach can effectively handle the evolution of packers

Adaptive unpacking of Android apps

Fighting malware involves analyzing large numbers of suspicious binary files. In this context, disassembly is a crucial task in malware analysis and reverse engineering. It involves the recovery of assembly instructions from binary machine code. Correct disassembly of binaries is necessary to produce a higher level representation of the code and thus allow the analysis to develop high-level understanding of its behavior and purpose. Nonetheless, it can be problematic in the case of malicious code, as malware writers often employ techniques to thwart correct disassembly by standard tools. In this paper, we focus on the disassembly of x86 self-modifying binaries with overlapping instructions. Current state-of-the-art disassemblers fail to interpret these two common forms of obfuscation, causing an incorrect disassembly of large parts of the input. We introduce a novel disassembly method, called concatic disassembly, that combines CONCrete path execution with stATIC disassembly. We have developed a standalone disassembler called CoDisasm that implements this approach. Our approach substantially improves the success of disassembly when confronted with both self-modification and code overlap in analyzed binaries. To our knowledge, no other disassembler thwarts both of these obfuscations methods together.

/pdf/codisasm-medium-scale-concatic-disassembly-of-self-modifying-246bsc3cb4.pdf

CoDisasm: Medium Scale Concatic Disassembly of Self-Modifying Binaries with Overlapping Instructions

Multi-core systems are increasingly interesting candidates for executing parallel real-time applications, in avionic, space or automotive industries, as they provide both computing capabilities and power efficiency. However, ensuring that timing constraints are met on such platforms is challenging, because some hardware resources are shared between cores. Assuming worst-case contentions when analyzing the schedulability of applications may result in systems mistakenly declared unschedulable, although the worst-case level of contentions can never occur in practice. In this paper, we present two contention-aware scheduling strategies that produce a time-triggered schedule of the application’s tasks. Based on knowledge of the application’s structure, our scheduling strategies precisely estimate the effective contentions, in order to minimize the overall makespan of the schedule. An Integer Linear Programming (ILP) solution of the scheduling problem is presented, as well as a heuristic solution that generates schedules very close to ones of the ILP (5% longer on average), with a much lower time complexity. Our heuristic improves by 19% the overall makespan of the resulting schedules compared to a worst-case contention baseline.

/pdf/tightening-contention-delays-while-scheduling-parallel-ndat714y43.pdf

Tightening Contention Delays While Scheduling Parallel Applications on Multi-core Architectures

Estimation of worst-case execution times (WCETs) is required to validate the temporal behavior of hard real time systems. Heptane is an open-source software program that estimates upper bounds of execution times on MIPS and ARM v7 architectures, offered to the WCET estimation community to experiment new WCET estimation techniques. The software architecture of Heptane was designed to be as modular and extensible as possible to facilitate the integration of new approaches. This paper is devoted to a description of Heptane, and includes information on the analyses it implements, how to use it and extend it.

The Heptane Static Worst-Case Execution Time Estimation Tool

Multi-core systems using ScratchPad Memories (SPMs) are attractive architectures for executing time-critical embedded applications, because they provide both predictability and performance. In this paper, we propose a scheduling technique that jointly selects SPM contents off-line, in such a way that the cost of SPM loading/unloading is hidden. Communications are fragmented to augment hiding possibilities. Experimental results show the effectiveness of the proposed technique on streaming applications and synthetic task-graphs. The overlapping of communications with computations allows the length of generated schedules to be reduced by 4% on average on streaming applications, with a maximum of 16%, and by 8% on average for synthetic task graphs. We further show on a case study that generated schedules can be implemented with low overhead on a predictable multi-core architecture (Kalray MPPA).

https://drops.dagstuhl.de/opus/volltexte/2019/10762/pdf/LIPIcs-ECRTS-2019-25.pdf/

Hiding Communication Delays in Contention-Free Execution for SPM-Based Multi-Core Architectures

The emergence of battery-powered devices has led to an increase of interest in the energy consumption of computing devices. For embedded systems, dispatching the workload on different computing units enables the optimisation of the overall energy consumption on high-performance heterogeneous platforms. However, to use the full power of heterogeneity, architecture specific binary blocks are required, each with different energy/time trade-offs. Finding a scheduling strategy that minimises the energy consumption, while guaranteeing timing constraints creates new challenges. These challenges can only be met by using the full heterogeneous capacity of the platform (e.g. heterogeneous CPU, GPU, DVFS, dynamic frequency changes from within an application). We propose an off-line scheduling algorithm for dependent multiversion tasks based on Forward List Scheduling to minimise the overall energy consumption. Our heuristic accounts for Dynamic Voltage and Frequency Scaling (DVFS) and enables applications to dynamically adapt voltage and frequency during run time. We demonstrate the benefits of multi-version task models coupled with an energy-aware scheduler. We observe that selecting the most energy efficient version for each task does not lead to the lowest energy consumption for the whole application. Then we show that our approach produces schedules that are on average 45.6% more energy efficient than schedules produced by a state-of-the-art scheduling algorithm. Next we compare our heuristic against an optimal solution derived by an Integer Linear Programming (ILP) formulation (deviation of 1.6% on average). Lastly, we empirically show that the energy consumption predicted by our scheduler is close to the actual measured energy consumption on a Odroid-XU4 board (at most-15.8%).

Benjamin Rouxel

Papers

CoDisasm: Medium Scale Concatic Disassembly of Self-Modifying Binaries with Overlapping Instructions

Tightening Contention Delays While Scheduling Parallel Applications on Multi-core Architectures

The Heptane Static Worst-Case Execution Time Estimation Tool

Hiding Communication Delays in Contention-Free Execution for SPM-Based Multi-Core Architectures

Energy-aware scheduling of multi-version tasks on heterogeneous real-time systems