DDE: dynamic data structure excavation

Abstract

Dynamic Datastructure Excavation (DDE) is a new approach to extract datastructures from C binaries without any need for debugging symbols. Unlike most existing tools, DDE uses dynamic analysis (on a QEMU-based emulator) and detects data structures by tracking how a program uses memory. Its results are much more accurate than those of previous methods.