Abstract: To solve the problem in dynamic control flow reconstruction that not all program execution paths can be explored, an algorithm based on execution path driven is presented. The main idea of this algorithm is to run the binary program in a controllable instrument environment, and drives it to execute the program paths which can’t be explored under current input set by modifying the value of Program Counter(PC), so that Control Flow Graph(CFG) can be reconstructed. Based on this algorithm, a dynamic path drive control flow recovery system is designed and implemented. Experimental results illustrate that this algorithm is effective in exploring execution paths. Compared with traditional dynamic algorithm and Interactive Disassembler(IDA), the coverage of CFG reconstructed by this algorithm is higher.
Control Flow Graph(CFG),
simulation instrument environment,