HALF: Binary Analysis Framework with Kernel Module Assistance
Analysis
Key Takeaways
- •Proposes a new binary program analysis framework (HALF) to improve usability and performance of fine-grained analysis.
- •Utilizes kernel modules to enhance dynamic binary instrumentation.
- •Employs process hollowing within a containerized environment.
- •Demonstrates effectiveness through experiments with benchmark and actual programs, exploit programs, and malicious code.
“The framework mainly uses the kernel module to further expand the analysis capability of the traditional dynamic binary instrumentation.”