HALF: Binary Analysis Framework with Kernel Module Assistance

This paper addresses the challenges of fine-grained binary program analysis, such as dynamic taint analysis, by introducing a new framework called HALF. The framework leverages kernel modules to enhance dynamic binary instrumentation and employs process hollowing within a containerized environment to improve usability and performance. The focus on practical application, demonstrated through experiments and analysis of exploits and malware, highlights the paper's significance in system security.