Creative Commons License
This work is licensed under a Creative Commons Attribution-NonCommercial 4.0 International License
ORCID
https://orcid.org/0009-0008-9901-7684
Date of Graduation
5-15-2026
Semester of Graduation
Spring
Degree Name
Master of Science (MS)
Department
Department of Computer Science
First Advisor
Xunhua Wang
Abstract
Real-world binary computer programs are typically generated from corresponding source code (and companion libraries). Source code in a high-level programming language is often much easier to develop than binaries. In information security, however, there are situa- tions where new binaries must be generated directly from existing binaries without the corresponding source code. The mutant and the original binary should ideally be indistin- guishable in terms of binary attribution. In this thesis, we develop an inline binary instrumentation toolkit (IBIT) that can gen- erate binary mutants in an inline manner: the instrumentation code is organically inserted into the existing binary code. The inputs to this tool include an existing binary to be instrumented, a set of instrumentation points specified by memory addresses, and a set of instrumentation code — one for each instrumentation point. IBIT uses existing binary analysis libraries like angr and LIEF. We develop heuristic algorithms for the inline instru- mentation, including complete coverage of machine instructions that need to be updated and computation of update values. IBIT has been tested successfully on several real-world 32-bit and 64-bit Windows binary programs, including the 2013 and 2014 NSA Codebreaker Challenge programs and the DarkSide ransomware.
