Robust Low-Overhead Binary Rewriting: Design, Extensibility, And Customizability

Binary rewriting is the foundation of a wide range of binary analysis tools and techniques, including securing untrusted code, enforcing control-flow integrity, dynamic optimization, profiling, race detection, and taint tracking to prevent data leaks. There are two equally important and necessary criteria that a binary rewriter must have: it must be robust and incur low overhead. First, a binary rewriter must work for different binaries, including those produced by commercial compilers from a wide variety of languages, and possibly modified by obfuscation tools. Second, the binary rewriter must be low overhead. Although the off-line use of programs, such as testing and profiling, can tolerate large overheads, the use of binary rewriters in deployed programs must not introduce significant overheads; typically, it should not be more than a few percent. Existing binary rewriters have their challenges: static rewriters do not reliably work for stripped binaries (i.e., those without relocation information), and dynamic rewriters suffer from high base overhead. Because of this high overhead, existing dynamic rewriters are limited to off-line testing and cannot be practically used in deployment. In the first part, we have designed and implemented a dynamic binary rewriter called RL-Bin, a robust binary rewriter that can instrument binaries reliably with very low overhead. Unlike existing static rewriters, RL-Bin works for all benign binaries, including stripped binaries that do not contain relocation information. In addition, RL-Bin does not suffer from high overhead because its design is not based on the code-cache, which is the primary mechanism for other dynamic rewriters such as Pin, DynamoRIO, and Dyninst. RL-Bin's design and optimization methods have empowered RL-Bin to rewrite binaries with very low overhead (1.04x on average for SPECrate 2017) and very low memory overhead (1.69x for SPECrate 2017). In comparison, existing dynamic rewriters have a high runtime overhead (1.16x for DynamoRIO, 1.29x for Pin, and 1.20x for Dyninst) and have a bigger memory footprint (2.5x for DynamoRIO, 2.73x for Pin, and 2.3x for Dyninst). RL-Bin differentiates itself from other rewriters by having negligible overhead, which is proportional to the added instrumentation. This low overhead is achieved by utilizing an in-place design and applying multiple novel optimization methods. As a result, lightweight instrumentation can be added to applications deployed in live systems for monitoring and analysis purposes. In the second part, we present RL-Bin++, an improved version of RL-Bin, that handles various problematic real-world features commonly found in obfuscated binaries. We demonstrate the effectiveness of RL-Bin++ for the SPECrate 2017 benchmark obfuscated with UPX, PECompact, and ASProtect obfuscation tools. RL-Bin++ can efficiently instrument heavily obfuscated binaries (overhead averaging 2.76x, compared to 4.11x, 4.72x, and 5.31x overhead respectively caused by DynamoRIO, Dyninst, and Pin). However, the major accomplishment is that we achieved this while maintaining the low overhead of RL-Bin for unobfuscated binaries (only 1.04x). The extra level of robustness is achieved by employing dynamic deobfuscation techniques and using a novel hybrid in-place and code-cache design. Finally, to show the efficacy of RL-Bin in the development of sophisticated and efficient analysis tools, we have designed, implemented, and tested two novel applications of RL-Bin; An application-level file access permission system and a security tool for enforcing secure execution of applications. Using RL-Bin's system call instrumentation capability, we developed a fine-grained file access permission system that enables the user to define separate file access policies for each application. The overhead is very low, only 6%, making this tool practical to be used in live systems. Secondly, we designed a security enforcement tool that instruments indirect control transfer instructions to ensure that the program execution follows the predetermined anticipated path. Hence, it would protect the application from being hijacked. Our implementation showed effectiveness in detecting exploits in real-world programs while being practical with a low overhead of only 9%

Spiritual Well-Being and Quality of Life of Iranian Adults with Type 2 Diabetes

Introduction. Diabetes is a major public health problem. Little is known about the spiritual well-being and its relationship with quality of life (QOL) in Iranian Muslim patients with diabetes. This study investigated the spiritual well-being and QOL of Iranian adults with type 2 diabetes and the association between spiritual well-being, QOL, and depression. Methods. A cross-sectional study was done among 203 patients with type 2 diabetes mellitus in Isfahan, Iran. Quality of life and spiritual well-being were measured using the functional assessment of chronic illness therapy-spiritual well-being (FACIT-Sp). Depression was assessed using the Patient Health Questionnaire-2 (PHQ-2). Descriptive analysis, Pearson’s correlation, and multiple regression analysis were performed for statistical assessment. Results. The mean QOL was 61.00 (SD = 9.97) and the mean spiritual well-being was 30.59 (SD = 6.14). Sixty-four percent of our studied population had depressive disorders. There was a significant positive correlation between all QOL subscales and meaning, peace, and total spiritual well-being score. Conclusion. The results of this study showed poor QOL and spiritual well-being and high prevalence of depression in Iranian patients with type 2 diabetes compared to other studies’ findings especially western studies. This indicates the need for psychosocial and spiritual support in caring for Iranian patients with diabetes

Global Distribution of Human Protoparvoviruses

Development of next-generation sequencing and metagenomics has revolutionized detection of novel viruses. Among these viruses are 3 human protoparvoviruses: bufavirus, tusavirus, and cutavirus. These viruses have been detected in feces of children with diarrhea. In addition, cutavirus has been detected in skin biopsy specimens of cutaneous T-cell lymphoma patients in France and in 1 melanoma patient in Denmark. We studied seroprevalences of IgG against bufavirus, tusavirus, and cutavirus in various populations (n = 840), and found a striking geographic difference in prevalence of bufavirus IgG. Although prevalence was low in adult populations in Finland (1.9%) and the United States (3.6%), bufavirus IgG was highly prevalent in populations in Iraq (84.8%), Iran (56.1%), and Kenya (72.3%). Conversely, cutavirus IgG showed evenly low prevalences (0%-5.6%) in all cohorts, and tusavirus IgG was not detected. These results provide new insights on the global distribution and endemic areas of protoparvoviruses.Peer reviewe

Global Distribution of Human Protoparvoviruses

Development of next-generation sequencing and metagenomics has revolutionized detection of novel viruses. Among these viruses are 3 human protoparvoviruses: bufavirus, tusavirus, and cutavirus. These viruses have been detected in feces of children with diarrhea. In addition, cutavirus has been detected in skin biopsy specimens of cutaneous T-cell lymphoma patients in France and in 1 melanoma patient in Denmark. We studied seroprevalences of IgG against bufavirus, tusavirus, and cutavirus in various populations (n = 840), and found a striking geographic difference in prevalence of bufavirus IgG. Although prevalence was low in adult populations in Finland (1.9%) and the United States (3.6%), bufavirus IgG was highly prevalent in populations in Iraq (84.8%), Iran (56.1%), and Kenya (72.3%). Conversely, cutavirus IgG showed evenly low prevalences (0%-5.6%) in all cohorts, and tusavirus IgG was not detected. These results provide new insights on the global distribution and endemic areas of protoparvoviruses

Stock Market Returns and Consumption

This paper employs Swedish data on households' stock holdings to investigate how consumption responds to changes in stock market returns. We instrument the actual capital gains and dividend payments with past portfolio weights. Unrealized capital gains lead to a marginal propensity to consume (MPC) of 13 percent for the bottom 50% of the wealth distribution, but a flat 5 percent for the rest of the distribution. Households' consumption is significantly more responsive to dividend payouts across all parts of the wealth distribution. Our findings are consistent with households treating capital gains and dividends as separate sources of income

Improvement of aqueous nitrate removal by using continuous electrocoagulation/electroflotation unit with vertical monopolar electrodes

The present study is to investigate removal of nitrate from water solutions by the Electro-Coagulation-Flotation (ECF) process in continuous operation under different conditions. Experimental results indicated that the maximum nitrate removal was achieved by aluminum–aluminum electrode arrangement as anode–cathode. The increase in current density from 0.4 to 3.2 mA cm−2 increased nitrate removal efficiency from 55 to 96% under optimum conditions of time and pH during the ECF. Continuous operation of the ECF reactor led to an increase of nitrate removal from 37% at a detention time of 10 min–96% at a detention time of 30 min. Mean energy consumption and current efficiency were found to be about 2.66 kWh g−1 NO3− and 160%, respectively

Detection of plasmid-mediated quinolone resistance in clinical isolates of Enterobacteriaceae strains in Hamadan, West of Iran

Plasmid mediated quinolone resistance (PMQR) determinants have arisen as a significant concern in recent years. The aim of this study was screening of resistant-clinical isolates to fluoroquinolone antibiotics and detection of qnr and aac(6′)-Ib-cr genes.For this purpose we collected 100 fluoroquinolone-resistant Enterobacteriaceae which were from 3 hospitals in Hamadan, west provinces of Iran, between October 2012 and June 2013. The all samples were identified by biochemical tests and confirmed by PCR method. Antimicrobial susceptibility to 14 antimicrobial agents including levofloxacin and ciprofloxacin were determined by disk diffusion methods and ciprofloxacin MIC was obtained by broth microdilution method as Clinical Laboratory Standards Institute (CLSI) recommendations. The isolates were screened for the presence of qnrA, qnrB, qnrS and aac(6′)-Ib-cr genes using PCR assay. Among the screened isolates, 64 strains (64%) of Escherichia coli, 23 strains (23%) of Klebsiella pneumoniae, 13 strains (13%) of Proteus mirabilis were collected as quinolone-resistant isolates. out of 100 isolates, two (2%) were positive for qnrS, seventeen (17%) isolates were positive for qnrB and we did not find qnrA gene in any of the isolates. There were also 32 positive isolates for aac(6′)-Ib-cr determinant. We described the prevalence of qnr and aac(6′)-Ib-cr genes in fluoroquinolone-resistant Enterobacteriaceae in Hamadan city. The carriage rate of multidrug-resistant Enterobacteriaceae in healthy people in Hamadan City is extremely high. Moreover, genes encoding transferable quinolones, in particular aac(6′)-Ib-cr, are highly prevalent in these strains. Keywords: Enterobacteriaceae, Antibiotic resistance, Plasmid, Quinolone resistance, Fluoroquinolon

A comparison of running kinetics in children with and without genu varus: A cross sectional study

<div><p>Introduction</p><p>Varus knee alignment has been identified as a risk factor for the progression of medial knee osteoarthritis. However, the underlying mechanisms have not been elucidated yet in children. Thus, the aims of the present study were to examine differences in ground reaction forces, loading rate, impulses, and free moment values during running in children with and without genu varus.</p><p>Methods</p><p>Thirty-six boys aged 9–14 volunteered to participate in this study. They were divided in two age-matched groups (genu varus versus healthy controls). Body weight adjusted three dimensional kinetic data (Fx, Fy, Fz) were collected during running at preferred speed using two Kistler force plates for the dominant and non-dominant limb.</p><p>Results</p><p>Individuals with knee genu varus produced significantly higher (<i>p</i> = .01; <i>d</i> = 1.09; 95%) body weight adjusted ground reaction forces in the lateral direction (Fx) of the dominant limb compared to controls. On the non-dominant limb, genu varus patients showed significantly higher body weight adjusted ground reaction forces values in the lateral (<i>p</i> = .01; <i>d</i> = 1.08; 86%) and medial (<i>p</i> < .001; <i>d</i> = 1.55; 102%) directions (Fx). Further, genu varus patients demonstrated 55% and 36% greater body weight adjusted loading rates in the dominant (<i>p</i> < .001; <i>d</i> = 2.09) and non-dominant (<i>p <</i> .<i>001</i>; <i>d</i> = 1.02) leg, respectively. No significant between-group differences were observed for adjusted free moment values (<i>p</i>>.05).</p><p>Discussion</p><p>Higher mediolateral ground reaction forces and vertical loading rate amplitudes in boys with genu varus during running at preferred running speed may accelerate the development of progressive joint degeneration in terms of the age at knee osteoarthritis onset. Therefore, practitioners and therapists are advised to conduct balance and strength training programs to improve lower limb alignment and mediolateral control during dynamic movements.</p></div

A comparison of running kinetics in children with and without genu varus: A cross sectional study - Fig 4

<p>Means and standard deviations of (a) impulse x, (b) impulse y, and (c) impulse z values for both groups during the stance phase of a running cycle.</p