6

I have read that dynamic instrumentation can be done using tools like PIN or Valgrind. However Valgrind provides intermediate representation and converts the binary into SSA which makes it more convenient to perform binary analysis. Could anyone please explain why using an SSA form is more convenient. Why is it difficult to perform dynamic analysis using PIN without an Intermediate representation?

Thank you

Improve this question

1 Answer 1

Reset to default
7

Answering this questions will require a lot more space than what is provided. I rather point you to the best references you can find in order to deeply understand the requirement for SSA.

First, start with Wikipedia so that you get familiarized with the basic structure and building blocks of SSA (Phi functions, ...). Then, move to this reference article published in 1991, which is a bit more hairy than the Wikipedia article.

If you want a more detailed document, though incomplete, read this book.
It covers a wide range of algorithms for construction/destruction and also analysis.

If you wish a long/detailed answer, let me know so that I can write a proper one.

Improve this answer
1
  • Thank you @yaspr for the references, I would go over and read them. Also it would help me a lot if you could mention the cons of doing dynamic taint analysis without an Intermediate Representation.
    – user1004985
    Commented Apr 17, 2015 at 20:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.