Augmenting Static Analysis Using Pintool: Ablation
summary
Ablation is a PIN-based tool that instruments a process, records each basic block only on first execution, resolves virtual calls (including targets in external modules), and emits a Python script that imports runtime traces into IDA to create interactive x‑refs and colorized coverage. It diffs samples by executed basic blocks (used on VGX/MSHTML and Firefox WebGL test suites), highlights untested or adjacent code to find undocumented features, and speeds crash/fuzz triage; source release happens at BH2016.
AI-written summary · about
chapters (9)
- 0:00Start
- 1:49What is Ablation?
- 5:17Using Ablation
- 6:42Control flow data
- 9:17Resolving Virtual Calls
- 19:11How Ablation augments static analysis
- 23:38Observing Live Execution
- 32:16ExSample (Execution Sample)
- 33:59Simple crash analysis
related talks
40mEnterprise-scale static analysis: A Pinpoint experience
28mMPI: Multiple Perspective Attack Investigation...
30mBIN2TL: Visualizing Program Dynamics with Perfetto
20mBluePill: Neutralizing Anti-Analysis Behavior in Malware Dissection
45mFinding Vulnerabilities through Static Analysis and Scripting
55mHiding PIN's Artifacts to Defeat Evasive Malware
16mHardTaint: Production-Run Dynamic Taint Analysis via Selective Hardware Tracing
28mPostmortem Program Analysis with Hardware-Enhanced Post-Crash Artifacts