How to find bugs in your (x86) code: Applications that use RIVER

Speaker: Bogdan Ghimiș (University of Bucharest)

Abstract: From a security perspective, discovering bugs before shipping a product is crucial. This presentation will be about RIVER, a tool that can help us to inspect x86 binary code. This lecture will encompass two papers describing methods of finding problematic inputs: a genetic algorithm and a method using taint analysis. The genetic algorithm is used in conjunction with Apache Spark – an engine used for big data and distributed computing – to determine the inputs that provide the best code coverage. The second method uses taint analysis in order to infer which parts of the input are used by the program to determine a model with which we can generate new inputs that adhere to a certain format and that allows us to get better code coverage.