GPU-disasm

A GPU-based x86 disassembler

Evangelos Ladakis, Giorgos Vasiliadis, Michalis Polychronakis, Sotiris Ioannidis, Georgios Portokalidis

Research output: Chapter in Book/Report/Conference proceedingConference contribution

Abstract

Static binary code analysis and reverse engineering are crucial operations for malware analysis, binary-level software protections, debugging, and patching, among many other tasks. Faster binary code analysis tools are necessary for tasks such as analyzing the multitude of new malware samples gathered every day. Binary code disassembly is a core functionality of such tools which has not received enough attention from a performance perspective. In this paper we introduce GPUDisasm, a GPU-based disassembly framework for x86 code that takes advantage of graphics processors to achieve efficient large-scale analysis of binary executables. We describe in detail various optimizations and design decisions for achieving both inter-parallelism, to disassemble multiple binaries in parallel, as well as intra-parallelism, to decode multiple instructions of the same binary in parallel. The results of our experimental evaluation in terms of performance and power consumption demonstrate that GPU-Disasm is twice as fast than a CPU disassembler for linear disassembly and 4.4 times faster for exhaustive disassembly, with power consumption comparable to CPU-only implementations.

Original languageEnglish
Title of host publicationInformation Security - 18th International Conference, ISC 2015, Proceedings
PublisherSpringer Verlag
Pages472-489
Number of pages18
Volume9290
ISBN (Print)9783319233178
DOIs
Publication statusPublished - 2015
Externally publishedYes
Event18th International Conference on Information Security, ISC 2015 - Trondheim, Norway
Duration: 9 Sep 201511 Sep 2015

Publication series

NameLecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
Volume9290
ISSN (Print)03029743
ISSN (Electronic)16113349

Other

Other18th International Conference on Information Security, ISC 2015
CountryNorway
CityTrondheim
Period9/9/1511/9/15

Fingerprint

Disassembly
Binary codes
Binary Code
Binary
Malware
Program processors
Electric power utilization
Computer debugging
Power Consumption
Parallelism
Reverse engineering
Graphics Processors
Decode
Reverse Engineering
Debugging
Experimental Evaluation
Software
Necessary
Graphics processing unit
Optimization

ASJC Scopus subject areas

  • Theoretical Computer Science
  • Computer Science(all)

Cite this

Ladakis, E., Vasiliadis, G., Polychronakis, M., Ioannidis, S., & Portokalidis, G. (2015). GPU-disasm: A GPU-based x86 disassembler. In Information Security - 18th International Conference, ISC 2015, Proceedings (Vol. 9290, pp. 472-489). (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics); Vol. 9290). Springer Verlag. https://doi.org/10.1007/978-3-319-23318-5_26

GPU-disasm : A GPU-based x86 disassembler. / Ladakis, Evangelos; Vasiliadis, Giorgos; Polychronakis, Michalis; Ioannidis, Sotiris; Portokalidis, Georgios.

Information Security - 18th International Conference, ISC 2015, Proceedings. Vol. 9290 Springer Verlag, 2015. p. 472-489 (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics); Vol. 9290).

Research output: Chapter in Book/Report/Conference proceedingConference contribution

Ladakis, E, Vasiliadis, G, Polychronakis, M, Ioannidis, S & Portokalidis, G 2015, GPU-disasm: A GPU-based x86 disassembler. in Information Security - 18th International Conference, ISC 2015, Proceedings. vol. 9290, Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics), vol. 9290, Springer Verlag, pp. 472-489, 18th International Conference on Information Security, ISC 2015, Trondheim, Norway, 9/9/15. https://doi.org/10.1007/978-3-319-23318-5_26
Ladakis E, Vasiliadis G, Polychronakis M, Ioannidis S, Portokalidis G. GPU-disasm: A GPU-based x86 disassembler. In Information Security - 18th International Conference, ISC 2015, Proceedings. Vol. 9290. Springer Verlag. 2015. p. 472-489. (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)). https://doi.org/10.1007/978-3-319-23318-5_26
Ladakis, Evangelos ; Vasiliadis, Giorgos ; Polychronakis, Michalis ; Ioannidis, Sotiris ; Portokalidis, Georgios. / GPU-disasm : A GPU-based x86 disassembler. Information Security - 18th International Conference, ISC 2015, Proceedings. Vol. 9290 Springer Verlag, 2015. pp. 472-489 (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)).
@inproceedings{eadce1b3805f4d18a6c1380d8ca1081f,
title = "GPU-disasm: A GPU-based x86 disassembler",
abstract = "Static binary code analysis and reverse engineering are crucial operations for malware analysis, binary-level software protections, debugging, and patching, among many other tasks. Faster binary code analysis tools are necessary for tasks such as analyzing the multitude of new malware samples gathered every day. Binary code disassembly is a core functionality of such tools which has not received enough attention from a performance perspective. In this paper we introduce GPUDisasm, a GPU-based disassembly framework for x86 code that takes advantage of graphics processors to achieve efficient large-scale analysis of binary executables. We describe in detail various optimizations and design decisions for achieving both inter-parallelism, to disassemble multiple binaries in parallel, as well as intra-parallelism, to decode multiple instructions of the same binary in parallel. The results of our experimental evaluation in terms of performance and power consumption demonstrate that GPU-Disasm is twice as fast than a CPU disassembler for linear disassembly and 4.4 times faster for exhaustive disassembly, with power consumption comparable to CPU-only implementations.",
author = "Evangelos Ladakis and Giorgos Vasiliadis and Michalis Polychronakis and Sotiris Ioannidis and Georgios Portokalidis",
year = "2015",
doi = "10.1007/978-3-319-23318-5_26",
language = "English",
isbn = "9783319233178",
volume = "9290",
series = "Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)",
publisher = "Springer Verlag",
pages = "472--489",
booktitle = "Information Security - 18th International Conference, ISC 2015, Proceedings",

}

TY - GEN

T1 - GPU-disasm

T2 - A GPU-based x86 disassembler

AU - Ladakis, Evangelos

AU - Vasiliadis, Giorgos

AU - Polychronakis, Michalis

AU - Ioannidis, Sotiris

AU - Portokalidis, Georgios

PY - 2015

Y1 - 2015

N2 - Static binary code analysis and reverse engineering are crucial operations for malware analysis, binary-level software protections, debugging, and patching, among many other tasks. Faster binary code analysis tools are necessary for tasks such as analyzing the multitude of new malware samples gathered every day. Binary code disassembly is a core functionality of such tools which has not received enough attention from a performance perspective. In this paper we introduce GPUDisasm, a GPU-based disassembly framework for x86 code that takes advantage of graphics processors to achieve efficient large-scale analysis of binary executables. We describe in detail various optimizations and design decisions for achieving both inter-parallelism, to disassemble multiple binaries in parallel, as well as intra-parallelism, to decode multiple instructions of the same binary in parallel. The results of our experimental evaluation in terms of performance and power consumption demonstrate that GPU-Disasm is twice as fast than a CPU disassembler for linear disassembly and 4.4 times faster for exhaustive disassembly, with power consumption comparable to CPU-only implementations.

AB - Static binary code analysis and reverse engineering are crucial operations for malware analysis, binary-level software protections, debugging, and patching, among many other tasks. Faster binary code analysis tools are necessary for tasks such as analyzing the multitude of new malware samples gathered every day. Binary code disassembly is a core functionality of such tools which has not received enough attention from a performance perspective. In this paper we introduce GPUDisasm, a GPU-based disassembly framework for x86 code that takes advantage of graphics processors to achieve efficient large-scale analysis of binary executables. We describe in detail various optimizations and design decisions for achieving both inter-parallelism, to disassemble multiple binaries in parallel, as well as intra-parallelism, to decode multiple instructions of the same binary in parallel. The results of our experimental evaluation in terms of performance and power consumption demonstrate that GPU-Disasm is twice as fast than a CPU disassembler for linear disassembly and 4.4 times faster for exhaustive disassembly, with power consumption comparable to CPU-only implementations.

UR - http://www.scopus.com/inward/record.url?scp=84945937249&partnerID=8YFLogxK

UR - http://www.scopus.com/inward/citedby.url?scp=84945937249&partnerID=8YFLogxK

U2 - 10.1007/978-3-319-23318-5_26

DO - 10.1007/978-3-319-23318-5_26

M3 - Conference contribution

SN - 9783319233178

VL - 9290

T3 - Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)

SP - 472

EP - 489

BT - Information Security - 18th International Conference, ISC 2015, Proceedings

PB - Springer Verlag

ER -