{"id":425,"date":"2026-08-08T06:30:09","date_gmt":"2026-08-08T06:30:09","guid":{"rendered":"https:\/\/43.156.46.27\/?p=425"},"modified":"2026-08-08T06:30:09","modified_gmt":"2026-08-08T06:30:09","slug":"black-hat-europe-2025-abstractions-for-program-analysis","status":"publish","type":"post","link":"https:\/\/haco.zone\/?p=425","title":{"rendered":"Black Hat Europe 2025 | Abstractions For Program Analysis"},"content":{"rendered":"\n<figure class=\"wp-block-embed is-type-video is-provider-youtube wp-block-embed-youtube wp-embed-aspect-16-9 wp-has-aspect-ratio\"><div class=\"wp-block-embed__wrapper\">\n<iframe loading=\"lazy\" title=\"Black Hat Europe 2025 | Abstractions For Program Analysis\" width=\"640\" height=\"360\" src=\"https:\/\/www.youtube.com\/embed\/Hjw6EEOeWDo?feature=oembed\" frameborder=\"0\" allow=\"accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share\" referrerpolicy=\"strict-origin-when-cross-origin\" allowfullscreen><\/iframe>\n<\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">&#8220;Abstractions for Program Analysis&#8221; by Kyle Martin, explores how different abstractions simplify the process of analyzing software to find bugs, understand malware, or verify code behavior.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Here are the key takeaways from the talk:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Redefining &#8220;Program&#8221;:<\/strong>\u00a0Martin suggests viewing a program not just as a list of instructions, but as a set of states and the transformations that move and manipulate data between them. This perspective is more useful for automated analysis and fuzzing.<\/li>\n\n\n\n<li><strong>The &#8220;Standard Model&#8221; of Analysis:<\/strong>\u00a0He introduces a foundational framework for querying code based on four concepts: analyzing data flow\u00a0<strong>forwards<\/strong>\u00a0or\u00a0<strong>backwards<\/strong>, and asking what\u00a0<strong>may<\/strong>\u00a0happen versus what\u00a0<strong>must<\/strong>\u00a0happen. Combinations of these queries can identify common vulnerabilities like uninitialized variables, null pointer dereferences, and use-after-free bugs.<\/li>\n\n\n\n<li><strong>The Importance of Semantics and Types:<\/strong>\u00a0While emulators focus on the mechanical execution of bits (execution characteristics), analysts need to understand the\u00a0<em>meaning<\/em>\u00a0or intent of the code (semantics). Types are the ultimate abstraction for this, as they define the structure of data and the rules for how it can be manipulated.<\/li>\n\n\n\n<li><strong>Intermediate Languages (ILs):<\/strong>\u00a0Because languages like C and assembly lack strict semantic context, analysts use ILs to translate code into a more structured, rule-based format. There are many flavors of ILs, each with different trade-offs regarding verbosity, ease of parsing, and the amount of type information they retain.<\/li>\n\n\n\n<li><strong>Normal Forms:<\/strong>\u00a0These are established rules for rewriting code to make specific questions easier to answer.\n<ul class=\"wp-block-list\">\n<li><strong>A-Normal Form (ANF):<\/strong>\u00a0Simplifies complex expressions to ensure evaluation order is explicit.<\/li>\n\n\n\n<li><strong>Single Static Assignment (SSA):<\/strong>\u00a0A crucial abstraction where every variable is defined only once. It uses a\u00a0<strong><code>\u03a6\u03a6<\/code><\/strong><strong>\u00a0(Phi) function<\/strong>\u00a0to merge different possible states of a variable after a branch, making data flow tracking straightforward and enabling parallelizable analysis.<\/li>\n\n\n\n<li><strong>Single Static Information (SSI):<\/strong>\u00a0While SSA handles merging paths, SSI improves upon it by using a\u00a0<strong><code>\u03c3<em>\u03c3<\/em><\/code><\/strong><strong>\u00a0(Sigma) function<\/strong>\u00a0to split variable uses at branches. This allows analysts to track more precise constraints on a variable&#8217;s value along specific execution paths, which is necessary for analyzing loops and complex conditionals.<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li><strong>Conclusion:<\/strong>\u00a0Martin advises the audience to stop writing custom parsers and compilers. Instead, analysts should leverage existing tools and choose the specific abstraction (or translate between several) that best fits the problem they are trying to solve, rather than seeking a single, universal IL.<\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>&#8220;Abstractions for Program Analysis&#8221; by Kyle Martin, explores how different [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[61,60,5],"class_list":["post-425","post","type-post","status-publish","format-standard","hentry","category-black-hat","tag-abstraction","tag-program-analysis","tag-security"],"_links":{"self":[{"href":"https:\/\/haco.zone\/index.php?rest_route=\/wp\/v2\/posts\/425","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/haco.zone\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/haco.zone\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/haco.zone\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/haco.zone\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=425"}],"version-history":[{"count":1,"href":"https:\/\/haco.zone\/index.php?rest_route=\/wp\/v2\/posts\/425\/revisions"}],"predecessor-version":[{"id":426,"href":"https:\/\/haco.zone\/index.php?rest_route=\/wp\/v2\/posts\/425\/revisions\/426"}],"wp:attachment":[{"href":"https:\/\/haco.zone\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=425"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/haco.zone\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=425"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/haco.zone\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=425"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}