{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,9,28]],"date-time":"2025-09-28T20:28:33Z","timestamp":1759091313432},"reference-count":40,"publisher":"Springer Science and Business Media LLC","issue":"3","license":[{"start":{"date-parts":[[2015,3,29]],"date-time":"2015-03-29T00:00:00Z","timestamp":1427587200000},"content-version":"unspecified","delay-in-days":0,"URL":"http:\/\/creativecommons.org\/licenses\/by\/4.0"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["Empir Software Eng"],"published-print":{"date-parts":[[2016,6]]},"DOI":"10.1007\/s10664-015-9362-z","type":"journal-article","created":{"date-parts":[[2015,3,29]],"date-time":"2015-03-29T05:48:28Z","timestamp":1427608108000},"page":"753-777","update-policy":"http:\/\/dx.doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":6,"title":["On the detection of custom memory allocators in C binaries"],"prefix":"10.1007","volume":"21","author":[{"given":"Xi","family":"Chen","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Asia","family":"Slowinska","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Herbert","family":"Bos","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"297","published-online":{"date-parts":[[2015,3,29]]},"reference":[{"key":"9362_CR1","unstructured":"Akritidis P (2010) Cling: a memory allocator to mitigate dangling pointers. In: Proceedings of the 19th USENIX conference on security, SSYM\u201910. USENIX Association. http:\/\/dl.acm.org\/citation.cfm?id=1929820.1929836"},{"key":"9362_CR2","doi-asserted-by":"crossref","unstructured":"Balakrishnan G, Reps T (2004) Analyzing memory accesses in x86 binary executables. In: Proceedings of the conference on compiler construction, CC\u201904","DOI":"10.1007\/978-3-540-24723-4_2"},{"key":"9362_CR3","doi-asserted-by":"crossref","first-page":"23:1","DOI":"10.1145\/1749608.1749612","volume":"32","author":"G Balakrishnan","year":"2010","unstructured":"Balakrishnan G, Reps T (2010) WYSINWYX: what you see is not what you execute. ACM Trans Program Lang Syst 32:23:1\u201323:84. doi: 10.1145\/1749608.1749612","journal-title":"ACM Trans Program Lang Syst"},{"key":"9362_CR4","doi-asserted-by":"crossref","unstructured":"Berger ED, Zorn BG (2006) DieHard: probabilistic memory safety for unsafe languages. In: Proceedings of the 2006 ACM conference on programming language design and implementation, PLDI\u201906. doi: 10.1145\/1133981.1134000","DOI":"10.1145\/1133981.1134000"},{"key":"9362_CR5","doi-asserted-by":"crossref","unstructured":"Berger ED, Zorn BG, McKinley KS (2002) Reconsidering custom memory allocation. In: Proceedings of the 17th ACM SIGPLAN conference on Object-oriented programming, systems, languages, and applications, OOPSLA\u2019 02, vol 37. doi: 10.1145\/583854.582421","DOI":"10.1145\/583854.582421"},{"key":"9362_CR6","unstructured":"Caballero J, Grieco G, Marron M, Nappa A (2012) Undangle: early detection of dangling pointers in use-after-free and double-free vulnerabilities. In: Proceedings of the 2012 international symposium on software testing and analysis, ISSTA\u201912. doi: 10.1145\/04000800.2336769"},{"key":"9362_CR7","doi-asserted-by":"crossref","unstructured":"Calvet J, Fernandez JM, Marion JY (2012) Aligot: cryptographic function identification in obfuscated binary programs. In: Proceedings of the 2012 ACM Conference on computer and communications security CCS\u201912. ACM, New York, pp 169\u2013182. doi: 10.1145\/2382196.2382217","DOI":"10.1145\/2382196.2382217"},{"key":"9362_CR8","doi-asserted-by":"crossref","unstructured":"Chen X, Slowinska A, Bos H (2013) Who allocated my memory? Detecting custom memory allocators in C binaries. In: Proceedings of the 20th working conference on reverse engineering, WCRE\u201913, pp 22\u201331. doi: 10.1109\/WCRE.2013.6671277","DOI":"10.1109\/WCRE.2013.6671277"},{"key":"9362_CR9","doi-asserted-by":"crossref","unstructured":"Chipounov V, Kuznetsov V, Candea G (2011) S2E: a platform for in vivo multi-path analysis of software systems. In: Proceedings of the 16th international conference on architectural support for programming languages and operating systems, ASPLOS\u201911","DOI":"10.1145\/1950365.1950396"},{"key":"9362_CR10","doi-asserted-by":"crossref","unstructured":"Dhurjati D, Adve V (2006) Efficiently detecting all dangling pointer uses in production servers. In: Proceedings of the international conference on dependable systems and networks, DSN\u201906. IEEE. doi: 10.1109\/DSN.2006.31","DOI":"10.1109\/DSN.2006.31"},{"key":"9362_CR11","doi-asserted-by":"crossref","unstructured":"ElWazeer K, Anand K, Kotha A, Smithson M, Barua R (2013) Scalable variable and data type detection in a binary rewriter. In: Proceedings of the 34th ACM SIGPLAN conference on programming language design and implementation, PLDI\u201913","DOI":"10.1145\/2491956.2462165"},{"key":"9362_CR12","doi-asserted-by":"crossref","unstructured":"Gr\u00f6bert F, Willems C, Holz T (2011) Automated identification of cryptographic primitives in binary programs. In: Proceedings of the 14th international conference on recent advances in intrusion detection, RAID\u201911. Springer, Berlin, pp 41\u201360. doi: 10.1007\/978-3-642-23644-0_3","DOI":"10.1007\/978-3-642-23644-0_3"},{"key":"9362_CR13","unstructured":"Guo Z, Wang X, Tang J, Liu X, Xu Z (2008) R2: an application-level kernel for record and replay. In: Proceedings of the 8th USENIX conference on operating systems design and implementation, OSDI\u201908. http:\/\/dl.acm.org\/citation.cfm?id=1855755"},{"key":"9362_CR14","doi-asserted-by":"crossref","unstructured":"Hanson DR (1990) Fast allocation and deallocation of memory based on object lifetimes. Softw Pract Experience 20(1). doi: 10.1002\/spe.4380200104","DOI":"10.1002\/spe.4380200104"},{"key":"9362_CR15","unstructured":"Hastings R, Joyce B (1992) Purify: fast detection of memory leaks and access errors, winter USENIX conference"},{"key":"9362_CR16","doi-asserted-by":"crossref","unstructured":"Honarmand N, Dautenhahn N (2013) Cyrus: unintrusive application-level record-replay for replay parallelism. In: Proceedings of the 18th international conference on architectural support for programming languages and operating systems, ASPLOS\u201913. http:\/\/dl.acm.org\/citation.cfm?id=2451138","DOI":"10.1145\/2451116.2451138"},{"key":"9362_CR17","unstructured":"Intel (2011) Pin - A dynamic binary instrumentation tool. http:\/\/www.pintool.org\/"},{"key":"9362_CR18","unstructured":"Jones MT (2007) Anatomy of the linux slab allocator. http:\/\/www.ibm.com\/developerworks\/linux\/library\/l-linux-slab-allocator\/"},{"key":"9362_CR19","doi-asserted-by":"crossref","unstructured":"Jula A, Rauchwerger L (2007) Custom memory allocation for free. In: Proceedings of the 19th international conference on languages and compilers for parallel computing, LCPC\u201906. Springer, Heidelberg","DOI":"10.1007\/978-3-540-72521-3_22"},{"key":"9362_CR20","doi-asserted-by":"crossref","unstructured":"Jula A, Rauchwerger L (2009) Two memory allocators that use hints to improve locality. In: Proceedings of the 2009 international symposium on memory management, ISMM\u201909. ACM Press, New York. doi: 10.1145\/1542431.1542447","DOI":"10.1145\/1542431.1542447"},{"key":"9362_CR21","doi-asserted-by":"crossref","unstructured":"Jung C, Clark N (2009) DDT: design and evaluation of a dynamic program analysis for optimizing data structure usage. In: Proceedings of the 42nd annual IEEE\/ACM international symposium on microarchitecture, MICRO-42. doi: 10.1145\/1669112.1669122","DOI":"10.1145\/1669112.1669122"},{"key":"9362_CR22","doi-asserted-by":"crossref","unstructured":"Kemerlis VP, Portokalidis G, Jee K, Keromytis AD (2012) Libdft: practical dynamic data flow tracking for commodity systems. In: Proceedings of the 8th annual international conference on virtual execution environments, VEE\u201912","DOI":"10.1145\/2151024.2151042"},{"key":"9362_CR23","unstructured":"Lin Z, Zhang X, Xu D (2010) Automatic reverse engineering of data structures from binary execution. In: Proceedings of the 17th annual network and distributed system security symposium, NDSS\u201910"},{"key":"9362_CR24","doi-asserted-by":"crossref","unstructured":"Liu R, Chen H (2012) SSMalloc: a low-latency, locality-conscious memory allocator with stable performance scalability. In: Proceedings of the third ACM SIGOPS Asia-Pacific workshop on systems, ApSys\u201912. USENIX association. http:\/\/dl.acm.org\/citation.cfm?id=2387841.2387856","DOI":"10.1145\/2349896.2349911"},{"key":"9362_CR25","volume-title":"Towards revealing attackers\u2019 intent by automatically decrypting network traffic. Master\u2019s thesis","author":"N Lutz","year":"2008","unstructured":"Lutz N (2008) Towards revealing attackers\u2019 intent by automatically decrypting network traffic. Master\u2019s thesis. ETH, Zurich"},{"key":"9362_CR26","doi-asserted-by":"crossref","unstructured":"Lvin VB , Novark G, Berger ED, Zorn BG (2008) Archipelago: trading address space for reliability and security. In: Proceedings of the 13th international conference on architectural support for programming languages and operating systems, ASPLOS XIII. doi: 10.1145\/1346281.1346296","DOI":"10.1145\/1346281.1346296"},{"key":"9362_CR27","doi-asserted-by":"crossref","unstructured":"Lyberis S, Pratikakis P, Nikolopoulos DS, Schulz M, Gamblin T, de Supinski BR (2012) The myrmics memory allocator. In: Proceedings of the 2012 international symposium on memory management, ISMM\u201912. ACM Press, New York. doi: 10.1145\/2258996.2259001","DOI":"10.1145\/2258996.2259001"},{"key":"9362_CR28","doi-asserted-by":"crossref","unstructured":"Novark G, Berger ED (2010) DieHarder: securing the heap. In: Proceedings of the 17th ACM conference on computer and communications security, CCS\u201910. ACM, New York, pp 573\u2013584. doi: 10.1145\/1866307.1866371","DOI":"10.1145\/1866307.1866371"},{"key":"9362_CR29","doi-asserted-by":"crossref","unstructured":"Novark G, Berger ED, Zorn BG (2009) Efficiently and precisely locating memory leaks and bloat. In: Proceedings of the 2009 ACM SIGPLAN conference on programming language design and implementation, PLDI\u201909. ACM, New York, pp 397\u2013407. doi: 10.1145\/1542476.1542521","DOI":"10.1145\/1542476.1542521"},{"key":"9362_CR30","doi-asserted-by":"crossref","unstructured":"Portokalidis G, Slowinska A, Bos H (2006) Argos: an emulator for fingerprinting zero-day attacks. In: Proceedings of the 1st ACM european conference on computer systems 2006, EuroSys\u201906. doi: 10.1145\/1218063.1217938","DOI":"10.1145\/1218063.1217938"},{"key":"9362_CR31","doi-asserted-by":"crossref","unstructured":"Reps T, Balakrishnan G (2008) Improved memory-access analysis for x86 executables. In: Proceedings of the joint european conferences on theory and practice of software 17th international conference on compiler construction, CC\u201908\/ETAPS\u201908","DOI":"10.1007\/978-3-540-78791-4_2"},{"key":"9362_CR32","doi-asserted-by":"crossref","unstructured":"Ross DT (1967) The AED free storage package. Commun ACM 10(8). doi: 10.1145\/363534.363546","DOI":"10.1145\/363534.363546"},{"key":"9362_CR33","doi-asserted-by":"crossref","unstructured":"Schneider S, Antonopoulos CD, Nikolopoulos DS (2006) Scalable locality-conscious multithreaded memory allocation. In: Proceedings of the 2006 international symposium on memory management, ISMM\u201906. ACM Press, New York, p 84. doi: 10.1145\/1133956.1133968","DOI":"10.1145\/1133956.1133968"},{"key":"9362_CR34","unstructured":"Serebryany K, Bruening D, Potapenko A, Vyukov D (2012) AddressSanitizer: a fast address sanity checker. In: Proceedings of USENIX annual technical conference"},{"key":"9362_CR35","unstructured":"Slowinska A, Stancescu T, Bos H (2011) Howard: a dynamic excavator for reverse engineering data structures. In: Proceedings of the 18th annual network & distributed system security symposium, NDSS\u201911"},{"key":"9362_CR36","unstructured":"Slowinska A, Stancescu T, Bos H (2012) Body armor for binaries: preventing buffer overflows without recompilation. In: Proceedings of USENIX annual technical conference, USENIX ATC\u201912"},{"key":"9362_CR37","unstructured":"The FreeBSD Project FreeBSD Kernel Developer\u2019s Manual. ZONE(9). http:\/\/www.freebsd.org\/cgi\/man.cgi?query=uma"},{"key":"9362_CR38","unstructured":"The GNU C library Obstacks. http:\/\/www.gnu.org\/software\/libc\/manual\/html_node\/Obstacks.html"},{"key":"9362_CR39","unstructured":"Valgrind. http:\/\/valgrind.org"},{"key":"9362_CR40","doi-asserted-by":"crossref","unstructured":"Wilson PR, Johnstone MS, Neely M, Boles D (1995) Dynamic storage allocation: A survey and critical review","DOI":"10.1007\/3-540-60368-9_19"}],"container-title":["Empirical Software Engineering"],"original-title":[],"language":"en","link":[{"URL":"http:\/\/link.springer.com\/content\/pdf\/10.1007\/s10664-015-9362-z.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"http:\/\/link.springer.com\/article\/10.1007\/s10664-015-9362-z\/fulltext.html","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"http:\/\/link.springer.com\/content\/pdf\/10.1007\/s10664-015-9362-z","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2019,8,22]],"date-time":"2019-08-22T15:33:27Z","timestamp":1566488007000},"score":1,"resource":{"primary":{"URL":"http:\/\/link.springer.com\/10.1007\/s10664-015-9362-z"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2015,3,29]]},"references-count":40,"journal-issue":{"issue":"3","published-print":{"date-parts":[[2016,6]]}},"alternative-id":["9362"],"URL":"https:\/\/doi.org\/10.1007\/s10664-015-9362-z","relation":{},"ISSN":["1382-3256","1573-7616"],"issn-type":[{"value":"1382-3256","type":"print"},{"value":"1573-7616","type":"electronic"}],"subject":[],"published":{"date-parts":[[2015,3,29]]}}}