ࡱ>   !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdeghijklmnopqrstuwxyz{|}~RdO)/QPictures>PowerPoint Document(fSummaryInformation(3 <7+qQEEJ|=E|~NE%3V/kmvt.e ?ߕT 5KT3T;:IzGP`5DW#UO5;TG59:ek5'gjjjjVjj֫ j*6j R;Uڭ}:c_V9yY]V5FT)\WICD=F8"oɛ~"P)hÔ'TlIJLҪ^e *d3EdW$)T}SM_S$@))K5EI Rz)HiGʨRN TTפ+U#KuVjORK}ft]FC}_*CэTzdҍUVDeMn*n6htwRt? pz`&a)VlVi>/)~“:." H΍Diɯ+꣱-%za%oOyy@( ww0TBnxC\| ق(jjܟd1\2RдT606~r$_0 x=pI۰~Z5[ 8Kpw[lY]K7_A]sfz{Z-@'F/JQ~*[wtJT#m>nv匑ՈQ= 6Urݯ˪*PTmT&NjBq꫆AjzWDRMQAT3TK5K5SsUP5TKT=LV+UMFUSTeAUPTEڥ=گC_W9Y]PFP)m\SIC' LEJ)ZJ-UIJ2^Ҫ Ie*QY*%Uv)rHUK(?i+A*tU*$UaU\2G*@V2AU刪,T UCXՒUu哪'T}-vN)T3UsIYUK]~Σ輪Χڣί.z.`$B1QRS1 ka/..y  o ?u!WH,ȭ HA@9T69|=0\:a&bc)cVIdNKz?cJF+[uRh?:ڤ:ڢ㩭:oS۵Q;).vGGFHO^ O\EnMzj\P嬚Koϐ*L)rTMjTcd%p٣.5Pv~MfͪlR9d *P֨Z5,W e)#e fC櫪2561 dF$5XWWM1K- M_fa7#*DI\3$Y!zeb4qAb[3HqX+bl6,Ql VV?l=ݶTlgNQ<ѮRfWzgzc#kYE9A钩W.zrzJzjW_=uM`@ p(HZR~.ޚ^j7yhɏȍɂLI4VHDVL|AL8h++>O|/y#kԼS<.~d4~`aovc{_l:}׬w ,"}ӷl4}P}݌P} @};:JNWٺ/u]Jo,8b#M].٥2.iv̴sd)m,e/1!cKNnrv۶<-m"l=ikjڲ:-B:ͣK캒ͨԺM:Cc=| [Ƽ[ק-}\'u93L|դ4LF2 +L Ĕ3 L536L#343a&eڙɦh og9CI3#L31|ba)V`5am)+Yo_:Aj@V{mYno2{,Yh{Rc2̲{e%٭f7k~O椭Q9~ޮ v=mwvvld۸ֶkfFk?l}W+Y6pe^6u%l Wlg:a;̶Kg{䟘Ag9v+;>];^Y+n:]fwڹv x{܎gl{ma6ִlEiKٷ`Wi)1s6ic8fK`KnްpifBR3j. ;NsŪ^WSVڷSmj+]Нj'}U{! #TGA| ߅վ+wvdd-6>(}a6G vq;Puv;jHyTWVUScW5A~C(5sj'<5xyXXXu؈{݉=8<{qq#x7O:F4<%!ZIZd@f%ّS)(ߥJ7)+I*UTR>-Ԗx'x"u"gpG |Vc`yOhRCvRMZ9ukzR+sTo9Bq(xG.),Ȉc*)#ɥ$AbJĻ'b(Zd~%m*$$b3}RT?$OROF'~+TW%zpɨ_ߖJVu$:- S\jW7J^N5R@DXPEP %PJAjCmfDh-22ǯDoOY1\#!Du_)cf̳@m# .+# E"B܋a:@DxP.~Wa#r:qW) /O(r-1a\Ɠk_yqgpGq{%flj]0z &b>G!z^%t:y A;_foŹ;W|D47Xb͊bEޯi״k c >C11Ѭ ѬѬ#Y[޳޼g zZ)Z-e仔,=wk|քy sY#/a-',NXCf2fg`Og>?|gB K4# bBPCiS (FQ(H1b*%_iT (8')lAb| F Fڨ*(BȋȂtHD oxY6wp p ~لXŘLxsPFc8CfK'7G Z9*Mшs}sBSR˜kR\mjIԕ3Ĺy'8[7?5RB)cٿm: YJI [5RS1UZzh)©'"v4PnV0Q0A8^ ϲR)b">HqRJtReF6)rI.u+.\ JIM \iHCWVrܕ֮UnrU*C\5%\ s5eCb%ڲ\!WONrW]D OH;\,$@RFdCnGa@iW@Tw u-CC@7quSttWWsu{WSwrUQIwvuWFwut7WLwwWpuOMH{H{ذ/+>==^E=ОaуlJ,lLx A7t@k4.(;+2"I亷MD6nc.VͭZjsVR(ȋ\ȆVtZ@G,{Vw|{KM\%\`=c6Hvc9H`M>@#l m0aɘX\[oe좏0w3wG[MrծVa90?bfc¨C-;XnG~k?Y?kG#?P ( 1 SXX];؇8J^+Uq\7 G1s&)i ml?k[W2V8q{b#a Vbcb&a L8HA艮vD;A+4ǟԩ!6sTG%Ykˡ.Nl`?e6|g>S>`^ iGg<ӎ?c 1'h{?ƀsݏC~~:ͭ" R 5!#"r#/ (k#t%ϞޑG6cQumQR(볗շ5Q t'-=0c0S1|`Vc#P.Q?E=.*nZRxkӺ!j.)RU]z,ˡ+\坿.(Bȏ<ȍȊHK,ϤHOxrg'F.'qRNr G]v9q]VeXCl\&.#XrieK#1.q\*I|ť K.\R$%6.؈ #/|VĚiӒ=#u\*,\L$C1Rٗm]iC܆yӖ-s&coǞߞx=q@#1C'b/j#{g2uԟ'8؇k zNS ף =üzF@5}hxuQ hJ(R(Cvd@*}{x'k;8؄u7 1ZtC9EtЃ]⚡ja*)f+GҌr9u˪GsPJ$3nK'Mqq_.n`>".Sfp1>iq>"HIlȃ(jΘ6јXX؃n.bvvl%kZu+97s0zLT4JF+׫n o`HOB޸:u7bn&!)R!2!r! (J*:jZ-:+z`F`4DLAf`aai` 6k\/6]_ 0[ P}&qY妙nY|qa03?!A>FwtAC Z!j**J$0 /(?# 9S,c\#nQ_?FlN1 y_U^kxH$HHLȆ\ȃ(Ce:hhv肞1yY.X ]4۱q]0'pyօn.s);;r}#a Vbc a &.EF`\;k}gt@ZMSc4@bm+(B y ۸k.9 9C؋؂XXDp D/tE;D%A>D&A2GL_F4"] ḏ[8S8#8{;]!"z+3lqe+UG-C#8ck7 t$^zz 8L% SvqDb^b ^z#D  ^^ )9[ ? ^GI8maWZofކ؋sGqp+o!HȀȃʚ!-c"Ҧa``"cW,u6+ivNx%9\_'.n{sDWX^Q+^b"66 )Rp=WܦJڌ^╳YJQl&M5i6&Ŀ*xE1Y];ˠ"jwZ7E :wxqI$}qRN㸄xFc&R!wB9BS>6C$hC38x0Qq6' ʣ!Ё=w؁1;;eGzh2r[vw׎aC;G?x6{lۢyO(=P̋yg3M=1s KW/vB hGg/Ҵ@T@Dć8CEQ.8`Vb>"C]hE* J( J^j΅^=a=]U\"E];{t)Xq%/`?㌯ {ڇV}kj_(_}WFj+(=?ޗYx&}KoRǾ䙜$/1e&qח_ /]Kc2ؕLv/]i_>;WJYV{"_]6&<یG Hpۧo"]F:"c1Kc* 7&WO88Y\\-D㳞)?C,3t0#I:S>uJ=kHןua a%Vl+%։t)O'm%VzʭBi ?FRoRIfHoQxXzTe"GDF@8!s6u[6[Qݐu,Wd:/sN2Y ꈌUd: #> [Wm^jtgtQ(=:iHZU@zjd #fJ%556Q7MPFF$FDY$o@ p_B0ēP2qe!8Ė-&1Sㆉ!O^O>'bıFRX-H$ROUPMw~S}W5~Qg5~R+G~P{uF+z`ߪl_+qT$s/UBtUg W mc==R0C1#0pI5]=ө\Ne3d< @~EndGdB:lD2#6#bA _I2OJ7/W\6yߙ ~汾摾bK>ec8އ]ގ-mKsM=1zƙk:U==L耨/zp*UI:{m_N%v,3d-l<7;MJd4M._erS,6|S1LL7-Lic2$L0=xی3}ߌ5aFfaffb cbY//:yaJnWCR^w2iu]$9o;WN9rΒCve&;im6TؿdɲF5L_\/\Wu]\;]35\[ճ\m+Yյe^5 $mtl>wlfvm:OnXaō_xi'v}lgv knn柵v]j9 8{l?Rw7l[{6m]V/m9֖lA6 %1]<Ű Po&`R7&0c3Y-]79e]49ΘNv*G.]NWrZRHE^Q",ڨ'XUCub='Mh&T iڰNR]ѓQa0S}gjtSK;VJ^j6Io>/~f9.ii,U5}lz ^(}Ꝅ2=q) ='WNTVOR):s+kb+v`7!)%\%xp<ʍ'?Eh Dt"$S"-2/Ɍ-?_~H>.PXIq*䋔|*&)k.ϥ[C2.HMF@ 9؇]؊XU1{2aR G4Sڨ.UAʣ4@1rwG.d2xRRH$F"LȻ'(#3#i"$ɤ|KF>I)?Tj'"*U[(rTV MΪrh)GT.9r>G|/ۉ7A嗵*@V|*(@ * *jRuрg)Y 5̳5DkU7"n'7) 򯚌c5KdZNܷ:?Cm#Ip?y3_]*&M9̜;Bx9s۸x"['|!E"7qGOa_.ypq%lzRYdz!$ B_)=(3Z'-IH UI}G}Kֻ<Bw'ޫ kKH`Q14sJuo[ 8θ<<8=*ː4y"LAr]^ř;@ WŨsQڥ[D>3²`UHHȈ,NR`ɊU$'+L.V\3YrKGCoXkiN&yI^d$LdLeeIsKZ:lfjY . 6^rgPCz?K&y"$""PyY)q13<-\y!}f6b c~3 Q*@A9d6mi񦎜45嬩鹚\2U助"7qT$]Q ;SuYaʈe$-% ܖt6X %-.%PJUԱŤ1Z٢mQd s*, ؂83[xҽgHLWT# RbJfW\!+!.H`)JI1WV"ARՒRv k,e]s)ZKy^*.RJTv *.DRͅonHuLjAjRq'pN0ܔz>Rsw ِQ FYT\TGm]u\4Ե]S]˵5\]͵Օ\]e\G]u%\g]u]W]7u]]O]/m!/wppЇ@+00]uy:*,P eBVΈtHE}:!g8ercpٖڳʹ>jsrZR("(ȅlZlFE $A|ǂxxxbm\eqx4~a_i70VKlq8O,t҉8K',ΐsy:+rpmH^p.@(c'I;Q RuxihaI[tD7;9V`F12mL ̵e!aa#`N<.y!RA]yv] -)oi ;{\")\*n)#!eM_ڤ9M.nMxOb;6TzVz9`!a&`B0}x#66nmVԭulXkXkiIK ##qpWpEP-JGU>d{K0ʠ<*:j.uu>[:;` a4&` fb>,*lf줬}8z&]Y~oᇭ=WUB`}y1|$ ?M+>- i]inlZ[q~6M;2J0>O qa8#؋mt1K6$( ׭![yuKf^{u]Bu((!;2  |Pi!/w\}p]?7z.bGz0Sst 4r9 P]e0s sQ:)&Duct*78V :̊8nfsEXƊtL ۱Wpq ]]VpG|9\\$EZc]6ABeBC4uB/ (L ,r! xxwD_bs1pqRlw m$wl*umFfAd6 KnQ֥Qͥ;Tڢ3zԶ4v$bv6`)Vc=6a; ###r^ g}xwi8b~x<6]\%Q}nۈs1 Fa01^[4E}@EBQ 2# !b+-3<}u\a.]ҿyiqIoOwqWp q'q q{k'XUX%^yM=f`*u|.wYwa+z󣟻{2Gz{{p D;~C,3]\"$E*C&dC.AA FyT1]uhfha;阅s[l3/զ[kz hͦ?t }$r[i%f[hy| Jޡn"r$c 7z+:ڠj:ʡ4QEQ ?D6d4HĈO"&|׋6Y3i3ljYL?-w?Y ~` Їp~IƳWXUI PA( J>5Q m DŽ?11\vS0s\rE[\`}0y\2m<s=hg s 'Xa'p_lZ ,"٘PLf]1aDY=X뻢#ڡ 7ф:5廓mQ=2P}"ŨawtL;&ikKKpGp{ 0 hhZJeȇȄ4H :HSzzZ0`lV]mfbMʺuTq)6nFnnխeM[5skHuɘ ɭbnJڕ̋+XW[xpt;|who )9:7 ? x+u!V%:[:ۄ{GN,..͞S{pD$O8SڋDH Ȏ<( 3mJz {}1M70M o6` vAY]uS8LQ%)}-B^؋HHt /-eQսLچ^JKf{mK/ `}+O{PUQPZ> XL<'nǽ|<1Ǽx(QWJ:9pL2Gf9c;x~dg~0Ȁv@AeD=4B3F;t$}gtCO{kzao= 'Q7^7{'}}FheyMP5cJ'^QS੗13p2y6ϽmX5/^pzuDҫ(H0_毼;c؍Xy FotBk4F}/(("(ȧ_xKGx9M{Yc>yM]%Mi/z>g X8 [iw޶mm[Ƕm{a^/}|m%'[ٖBߋ[?,6M{dSgJNf.$w&Էu6oM[a3L6oo}l>\[73V{U| muz<ۀ<WlN-(e̶"Vj}uxkhkتԖ{1a _m޹:ulsʣ$\// QO?[]՗| ҦE(啦ܨ?E%@R(.}ۤoTEuf"1vb7 <.4]-C?|}>F|$FrB:d|ِyQ(JM7ﺉnkVhu}tM_{] Q%}mt0HkK| )ᫍ UPP AD! r#;2#=R#9# X(| $ x۸+, 8S88=؍JFu_n;p3`4 D͵5(&R* ꮵhh6^!$LA(yNm:t1S4NADnS\FqT4џ讗 !-Zc&qƙ( F !3# Qd $ABCl`N0xgv<5Тgh t4\O)JPRɵO~:b:IoI/I=GOHz&u.NJ7ޱڍwƻw ؈XUXŘY0Ɛh)}|G!2IGGG.~= Tu§,(>ŒOؗ.h`'xUnD>viӺR)B '۵PPHe%pq֪wƲ]JP.O !x.g<^Piv;9s<o9nn| WنZuޤy lx@pQ.2Hf 0[ LG$Uybr,R//`|SyxA5$WGɄw6uv5Q/̊e}͡F7՜S^x+pYFGFG8[֮vc=,)Ak|>7aFIX1;IxysXL:#Z\6Ǖu\cN$9Q#NTrt~] g9,o=(O3o^2QK;L\\I!oİ2o(lY;do"2Y ˬϑiIfα^h(C4*VYRL)@*ؘ [>h<"$y"~' 62={97șs£ -+$ww;3XfԑnN!U+k21Ӫ'iVXKQ*,Uf`[z}_n`R ;v 3-"lRU&5'94j,^; (ze2Rph2kBbԡgj9KbzpxGycܚ-cp. ]CV<8ᵈ| oB =m-x P{|@Nb=OG:r%=B\y)~*!~$_a)6,%va]*|p\ .`ͥqjQ|LJ~ !(5Mi~"˙B~5te~7y9Ne5cr|D:% )WcxYo~Ln|y pLW.YA E1ޗԷvn9ۍX,] W'vE?x^zt XbпܸG_0Vѿ3=ab\|ҟwlo{b 0vY|̄twԦf||!sjwA2 ;YЛRwе󿾝;^@_qּ^0'_6w=dvl+uxi;|8vâ8T$.cNjI/LÁݕTgm/N,}?{rI,;sYvy$sQ_aS*[ul$FnV!@ *X0[>sE<*;p3ǥp{۰tAV>0WZViR>ZG22^MCa-]C|`2ZQƺz #TwM*DB!61b횡hS>t%{KטSՖiN4T9R znq4sҍeQeb26)}C1&M }4x#4טegjn,ݵ͆@P1cdSF)5O7̲cȩgsRjЋh.m%Fkڢť+uS+hy!g6LӚe)UZ6bG, ߽_")/KnAfUUa F>n֌g"BЯT 3q6MTFAMجC&M & hd&&!MiN }rXチ0t TׯGt%fFL/PxXo$G]';KT2H̰]{J V!X >VqhzkAHC\ 7_ !@8C{]cƚޫqor !ײ7wHp_x?$?"_ \*+ /Nd|0 7Q -OtEVIxxd<"iɛC[wDNF0(눿G3B#.lFa dn6= LzsDoj-8BZ&?v?+"gldY-7R[nm'm `қg2h+ D26w6uXbZ8xK~YߧCv$3 ].!QK4R9[KX9zV ˘7y=kpw#r-Fz3=7A3!,-B3 J*t haΑjKfvMz]qpj)V!s˸Ωp~*sDwʜLr\)nڭȡY7+.j Gߕz[AuQW=վ/{' ' y}Ȉ ȯp6~T&^jaG8gVp$zªWp-|v{3mL\zaE1Q\9^6( X:8Dy.1n[D{OAXu9t̵Xc}mI3v$eJ"a t/iSm{t ɰ47N`VMBA\Dqiz|/r 'Cc탘{LrA?2Ke0m3mྏ2etn.zsZMԛ-f\-Uw l;`s%-11x]UG6Sb- Ʀ픀 W]8 sHa'1i8̖+ܞǸ(s*g\ObJI(L)QRR`eqܵLd^i2*<{J |dlA]UTw ;'  lz+%gbQp9pB>!|_~Ga 2Bkң櫄?mo(!yP %Sh*4N<<9/mho7[D;Y{zCHc6flK۲7Ȃ4'qܯiFRCZA% vH6׵k'd(b"KurΜNyykV5VE#sF:2i~,c T"WbB 6hv xVoD~3iZ-EH-ϵ-hP)#gw8ݵWU[Tq)7#ǜ 뵻 d}{oz pN.n䷸Ӆ'W%o֝0[aCqH% IP2q-~1=5h6ӯ25<_ADA$`56` yzWab>؂ n-*BMKne5Ϥs-9*7С?s^i,"GtL^!07NY k |@\dzq6~BBb>ȢV 9i|!z@X"~ɟdGa̳y.l Dcӿ\ߢ/@7CO|r=cº~'a;|jʢc ."3@2lEjivG ;n% ➛p6DҖ֢;cvc^Q z?#<SBv_V A&!z>hܽAqQW XӘthj.v3z;`\%t &nO*Ry^0Hn$a4EaSP*YgWK.2{_HC~YTMl#i-Ȭ $ @첾E}.$Y;UVّR# B[S=vT]nl-{o,q{~yd6lRs$3Uwm+VieiYێS-SaaLM0F9궣S[CWKB,h>&fVկU;S;/,j1fv]m}7zDMu%tzTC٦Y>ovfYgqzf7EyZ{ʪm!U"fZ1edqjU-*V{엊f2g,F؎訮6;Ak~˙OOlV)E+SM-Qyo㻵8T"K_=D6|tS İW)@ kI"B aʣsUKh<ZsWp>u <9B dN7]MבJM\|)iH!M9M#ht SE<ЗtoizHMGX{;=LI T`b!o*W.d`xUOoDviӺR)R=vv6{T !R9V=NzǖǻUZ 7>@8|N|.of:Ҭ{]p\\kjkگ:ͫ4Gl6|ռ`x?/E: 6^./ ۅ}f>>3߯7(SMʒS^Y8zHN.w1wM᳏H/f؊|j̠6܆ќOV8m?/i똷#w6B?;.h[w@S'f =ӨCvCXYbr,)eX" 3X!YX1 -y\O5&vF`g6]_q;Am{no߮BN:7e>i~chېMj^_*>񼞿7r{gt蝭朗 :|RwUy 4n~~md2 ""RߕDDD0H$""R3TL"""U0H$""R3TL"""U0H$""R3TL"""U0H$""R3TL"""U0H$""R3TL"""U0H$""R3TL"""U0H$""R3TL"""U0^> }}}Pq.D4YQP'חJrdS U`b&QR)/^(|Lڳgloܸq!T 3x&u@OO"=d2ڵk:::2LcccccؠgD"ຮFyTtIT,p\gϞ`Z_uĉ9wL$.Bt:FGG}>ܽ'HUƾP(dX8^ r9NY*HPHk.Wjn߾]<{,]={++bp8< [WWhCCCCCq< ÉDBi-0Cʃa{CCM ò㱡ԝ fXK,CTo, μq3]GFmmmb`Záz& >200DcѦuLW :;;W'v9 b˵P9 ?qhf2iC\d%f_vXqyM b3A\ 3ym0XDL5E*ԑ%#Jn/]'&X,fޘIvL;YDL$cAD/(Xb&x9㴵0ǑۘbƔI"3d\.qYZTl9@@YZ%ӧYNOEuȏ2]3:+fT%:HVߢ1 nIT.+ fg|3IT0QC+[OJ_1g,hZOv>)NL/ʔ1XlT0]3B"V}򌃃"daZ!EeIT,<@~;fZV]]-*~_WWgXv%:DQlX^i$cĩ~qaoݺ%7۽{wS j6MHI M\.*[N<0y<#wlmcښsyj]8ZVG^77^s10)VQyc&Q^Z|Xg.D"!N1wO=x sɓ\.WmmmSS^v1A(L7S;Ēi bc1ßnBN/7 O'\ppbgEYc nA`Z(_h=yϸ}vi/T rNJ7QNңvj `Xwww&r ܹ@4M#F.\1d4;::"H~=W6g`` qD"9%@ww˗[얖A9Qgyx):;;9ro߾6E"+7p8`8.xSdBDDTBl'*IDD fDDD`&*IDD fDDD`&*IDD fDDD`&*IDD fDDD`&*IDD fDDD`&*IDD fDDD`&*IDD fDDD`&*IDD f.@Y,Rh d2v$,%"*'}wDD ITJ>L<}衇xDDIEL""2w7RB[ao84|6joW]ۊyTƚ|ID43`˖Rbʿ_k tD Ɗox?5iq|tDD J?ɓE+vRa|Ԡ_tu-NU_* {U_t+ }h"Z.]¦MZ䓥.TJ{7\`,? .aM_8}AOvX~O?=GNY{<Μ|:=G}uW܉hO /X[ xݛK¿aO>u122瞛iSPa~ܔ0Nz?|sݽYt^ܼyqe%zkڱ192I6F:=bM౴2gٷgT_o56ضbkŘ}ٗTm36_tNM>3R;RL2^xq'/*aưR}H^MF `MaiLGv=c8*^5'l%.Lvԣ8Ƒ%ؒv79WՠƉ)`F0r7з tᅬw[Lź:4g' /pT^&&v-6oƻ+߿_UkdqIV4:+rw Yף;-ub˯:N"+J$];-M%!r+RxYPNtΟH!Ѧ֒l jt?onÝ> 3b?=lYJK31MLbJOw2?.4MuH/L \p7p?rdCA捬~ո7P5%*u!D4ikiry(IIDDO*.`ի%DD&z1XR0b:$"<9!>$"yYu3gpEfQ<.?i ( iAQfQ3R)_w=g>LN"k7F6׈DDd!Y&Dx׈|B`xob͢Q#5'I$"(EXshLՊ۷Sީ%>;;;[ƭ[|>ѥ%ņ%jThzbB*8ݹ'NǓ===;vسgϏ?p8Ȁe9DYl6}MӅ<;z J>(]Z"v VԩSNWVV|7ξqDDDQ,-!;ccx-uGN`JKȱ)N`0TTTٳgl^^疈( `64u\A ^L2~Zxhtqqj 1,?Gl*n¦/&D'444ٳgbb@OOΝ;ŋGD =hFvBs'gmmm?ㆆJј{][QfC߆8)T1/IM&S]]]RƁ/[%qPEV`%DDJ ֆ1hoCD$gfvnUXa!c>7N*= KK~ D$z3Ǐ_wFV:UXW^[%e+х)k|؎bE|& ˭We '" z=fZ9m۶-7[!)Fd&aqͿ%Ir:Bj#""ZWW`طo___Gba~EE|`0 {Q2۩{;͘KV9܃ȑ#[lY: ]]] #"]dCp/8I>׻ZIc;"Ҙ@@WRdI7N\z ܹs}ƍon$g5$34G]P <߁N$"t+a$ub&蠋 F3I|"""3ԂDDDjL""RBP3H݌F45.B!$""ukngEס_'͵D9}y'ׂQJlu+VCZO""A'A#>Huvc4EW!3( D;fQZNtqa&i͆ ZGIIDDZ[LvY`Y@:+fR؋{WtDDQZ(D1҂$aA}$""R fQZ0p_X\UJIDDif*73(]\|h0#~$""R f3B$i ""L$n2bk#"ҘQ,-=TLp&9N?^ԩS֭c,Qf2?z1=r#͛7Ο?`0744TQQ!}g.^X[[+B""!laNtOZ\\PWW`vv@qqٝ;wpnhL&âHLZ~q͙js_DD""2rrr8,z$I4."!z)p8 &&&rssS.b#"YtE"5 OMMݾ&iǎ2x IDAT999IysN#QLtE+ɓL e/bX,wDDAvgi(C7N*)hSMSϵp>(Pn$N/~8$[~<$CMď oݺNvp "͆ %OMk|>ɤm۶='&&nܸ`hh(kDw M(UdqhNcw?lxx>_1A6<<VU)IN'?DkWLN8 epB c$n޼Y\\lZ{GN%7+++N ~vIv^+/ph pATajPӆDLa||^k`4gكWzԟ<_ !ԋ #Q2d2_^0(***//=rȖ-[xWWWCCCk zD;ڳ]nC[C(D Vi9r %Ib QJE_$I$矯Z-DD--+_Lyᨪ2 ~)~ѡxyDD#Gt[O>W_UUUֲZ###/"R/J7 LNNxWȃxVU(sDɤɺ:.btvv\+$"L}Ǐk UTT(Zšvl]G<F2f`p͢jVb;""e" o3bQɄp1nT+^l0;Z~wYYY&~;vX, $dtK D"KPN}npp077_DDi+B?{wƕHԾ4U@QF G(JlvY'U+U ;f7ڨ( Hy*%Q"*(aܼBpYn&cC STx|޹%/O1%Úّ@ 044ĞRn!B)Ef>~ppšd2y1I8gϞX,9bqQջZH PdX\.zEQMphhH|V-x&nWK0\bhrDQ̺mʖ.Wu+P_ Aziv!;^MMĄzK Z-pnz'O?ުU]&:g4jmm Uz(v}rrbX$iii̙3$oW^K(aJ>cxЮLLFLFRDQP9v;^`;=Xn:::4oOR"BGG:; ,Y7cֺ'(Խ{'dߪA~| {:;;q@r>dG֕+WT*%IRyyȲ\VV>/^`0lI ջȜ[l6[VuvVCW=]]]088x"{>|h4eY6#G04?~N@,lٳgeYN_{ >$adrbbndX,鏸pRf8_PQw#5$h4-*. )ve)N8;;F8N=kneeE3-d̻ݰywtttj,v B BE=aOeAv;aZ'㼻W 'D2]"W _>!ЮLMxu:&) ٚz˥^7+Ink-DQdSsEX,zE(7YY#(b)OW$===,C?{y2 @INB}< G{].`0 CJ4þ;49l"^3Ѩj]g(!P '=_us!ټIfN> 555pB&]mUQ<<"Hz&B!ҥK.]b/sgttwxx3H$2::Jˡ!dyJJJԓ)@r;<]VVɓFB!+DZa9GB ĥB HYWDc8fm@3x J_*SqEʊz%nJ.OO)92;;;>v)J!ԪEeeo}9BU S͛7/dz}cǎOZpӧYH+*PQQQYXFM;w` --:Zӓ*DѣGeYf3l$Ib1҂Vl'+---KnrO:555Ţ#V8z(ɓ$nc% g[BlƎfM[Sdpcx<ٓ[vj3ؓcnz|jrp8|>c0Z'jN—ʈ+6nYz Wlv~|3猵?C>b񇌵gffN5f3LJ&@@H߯(ʊ($ V,gw*J 0/^Z>/gUssz7":Rcn SV!w^ET\ 1*Pgp۷!~A(q=?ՁGM$qw e6Woqq8TVW&ΚHZ ,^} _~FꪸUM].z;>RnX5XbSl8;(,$ k<@ @#xdujjj Ǖٳgttr:v7nׯ_`0~Ç@,ۂrII ȕ$) t oݺU^^gqܕ+W:;; xE|ލȆ՗cXmmm45LZO Ӥ0ѕI.kq[ Uyw&b455uvv:t=L$w޽|f,BΦ\ .d̻QX}aB!۬ FģG>}/_WWi4BB ]; VVVBȦAEލ4Bɽ9[!doPL"aFcjԥ6win3$ *x<R)vp82pPL"Tt1x1kHqL&;&IPw1I9JNgGGG?f3 ׯ_ .>---oټ~gr-$BKX ,ZLkk+T,D"---Μ9)vz !/csfrrRNOPWWd2)1əѻyE1R>Gϟ?wŋ Jٽ aS;$BiO)d(<r P"}{}Z@ii,dJ !(ZV+$V~Z"8nf^ognĦQL"hcsl o1b0>Nk׮ ,zO/݈MD$I ּӃ]T*fX/9889FFF#&n_t {0V{{{Λŋ+ǃ[ɤXZZbqʕ+333u<OOO_Fb!DHkcB<A[nHazzqr<O$\J )LtefGz`,/p|c{{o6yw}-B)!d*+*A1Bv,^]NV(&B)4ǁB >h5'Dh4rri{`5sȑhs.p8p85Ouc1x,g j͑"B1J0-^%?ɓ'ccc088APgm6[8_7MoZ۱&z]]t^[7`{{;fdLts$(+==ev6Q0— c a; X/#˥Iv=G_6rhhH]E<}){^A4d1]:\ d{S,J$B 6ï<777 SSS ?^~S{,ى?AƗN,fR)Iuql*,[sIfnAc(& VS,yw`e뛜Ԕ2裏BPyd#(&RJK!}jaҪo/!a>$%IZ'rh8,,,U祥-ˑf ϳ- kc!]M\s)Lj~6 `hddDh4L4$)'ݎwMi,IP' H$6mkhc,cHU([ N=8l*)6Ur"*?D'aG"*4.bHº j?LX{QTydz3fgsaiivt:]{ׯM'FB]F.H&! *Cv &'axvKH1Dё>>>N7dƍivm6zWUUÇ9K|hxx~o:;v󉞢 ) )n˗~%!D"kx<>22bZEL&K/tb#G`uuhhhDbͅеmjjr\hS;3~A,$ uu04CC7gOֻknn7ijM_T*ai;wrfb'L{{z?~eYZ絾, 366v)ݞزE<nʂフH~3,2!y29 g*ϳ2l$Af`&~):I q&_%%aq6PAV"pvlPA|5 APA|5 Ad0IJ>wħ\TF`?S<w:t Y7B!j$|^/풾b@MB= ==09W9QsW^V 8HD1aHnYISqI$O I"ػ::EU*Յ bXGG<\p8,7X0̹s2< ÈD䲣n8{,˲ONld2.9F---Ԁbl6Iָoe$ 33ɓPWOJXt1ZFGGGmFKk4Ν;@8?QVBee%q_5 Ad OѣxWHL AW\aFϛIdNc9>>0 kRz}gghyO'u PD\_pvj_xr>Z166F(JrbbeنBhn"wVrIh@d2՞fh&u遚 rqK(( x_>W*:x&EJQbNgV!1@Ң{TPdۧx'*f6ӼawC= j=gb"8y2GBvMMLL0 #R>8\477>  IDAT'9TT,˒;wЍDFnF[jj=j9#a&E甽{{aN'djllLBbZInܑx QJbѣG ^v2V(u/M^&!Hロ#_sJqq^ 6EBBUj:iD:::8#d)yMaH$q5w]e"oАZɟkD!63I$f# È,˒Uxx'7==M.eYDy$)ĩeYQdbYv``P'mdp?}?L} TTyK.5^ MX,:NAyC]yy^X, */Zիs80A@aaGlrw_t/ |>\-!E]z#/""H<>|~"d/nB%[qw/EJ%$P*F1}AB$5Vy"x/bz5 :KL^h 9g{jF]va!l6 q.EEMBzQ'|B= :$J>dXIꃞm )2m|FȣuMvG[-e o'3Crr{;ll$~_ϗ4c>}n0ȡ5 UK:ܽ{v!*///'݅B!MjmODeo2:uR 0pj- o,݄:[Eʑsa7\).Wk?y֬Yյu .D@?x% 0YER">c)+W\EцǓǏ9& o,P]|$LA (B ,qӧĔHHR󤋧_)UVqFZ*g?="_!$b'|ķJÇqA xA^@KHJ%wsԉ Qy$Q( ܹs'\FCeCI l}օ6?~0LDl{a 81 a: >4oagx1'A<88+**22 ((={r=KM"h4zP(' 6:pN+D"k׮miix<>22B,VL&ϗf_6-bGIYJoof3 jw:^k>rh~]XL8\pAҸ;V|! G!EP-a>'OLLlܸaųgϦz, 066v)ڍT믹Ēɋ,H޽{="ׯ߱cGFEt+83"a&;3鴥39 0jo9ER.] qr, -\`y&!\<))s=% )zL  +?g&BYd2JPT_tDsAȵk%K\Gq3Jjqm L<]kq{d쐮a / Vo5"r$yǏg~<$% ØLwHz!jOsssz^x<p8L&˲:Vp\ϲl?'~})+WFMBL"HEEDMA,$ƲܜHr8.靌*|\dPNrj,kfRAy TxgYeYzpepMNuKדMm6/ж:*bHrvE-$ Х9+LL-PNrj,}f yr^ei!Ml077x ˲dU!\4)i˥R8 W'鬓HkB7D@" Dkff`>}@xP@I 2s)e,Od:3(0 A ?/6 Iv<}, $AU(?X,|iav~=S.=X2!AV<83k'[("E %ܻCA2p| PA2(TΜTcrj +g6= NSPz^>ټnݺħ4 D#Bp:i>eas-LmHjȊahk^"ٮ.ٜrk@ٳ)P(賮p Q:Ξz?x`RwZDHb h`0lܸ4q]җ8͐5 A0= ׯfz~;b|., Qwh4B-fkKaqaw}Yϻ׮]N*..nmm )e*bS9SAҊ5 Ad1 FY%)㪫kP(P(BYxj[E5-Rn7)h4d Pin۶-S'q˲k֬!IW0%ҔJNz"iϞ=B<>~t"u"UɬE`&\#"G73/?{wĕwQ{C3zi7DYvƨT,"`UC5 AU ^Us8tAjGi&4, 6al׳ډ;v<3wsyӲp8сz{{j3զH$rs[[ۊYމ5."ZY 'ma=}l:ݶmbethhhaiiiſƆ.^gQeOxWZ?A֛x>5rӒQ ufӵDя?fX_r,_~?{p8<;;rn:33իWm6fQϹyƈHQj9Iy8 LHf3$I16W`Z~QcbPkvV_5Zj=z'ܰa+SL,IR/'[Y:nOa?KY2}N1}va0f|: }qR:NOOjE>HˣnڵMMMDF3"[|6w4F̿+}ND"n1I|>j/I;vkֳtvu˦9uwwgXX[ZZt QÐ>Q>JŸnJ،۷o777?VSS322K/v9rrNIo1}wy,j8X,,Q ~(L\.˵W)mV[όbLJ'z3b1u Êٙ{EQo JEQHݭ( exx,'" rx׃J])Ų}-+;7_mݻ 1!@qyiuS }wbGTdIv]E:n~~ ߑ =Tk 'LP3,A]G$IH uǂAD{UMMM]]]Ħ7mjjjb{N MMMSSSF>d2ɖݳgϊ|X,(J[[FZ|Yp{{36vF;mD"NOQX,6>>^9{WWו+Wn.tD"veYαO (!Q8f*dL&AVlNՁƶgoz 4]ňHJ>mE1^f> ֋W~4 S)I/^A$kmm W^-˲m6uKss  TuuujYM}Ç74=HLOOo߾]2447}L$Qgp/?<[6ngL&VʲJ R'.I(j%ARΰwcDdIepQckkkEQRe!,0oJAzꩌ7nC"Zy۞zz=H %nmgFFF xܹ344dP::uQkgggײ2Var 9dg)vvu^լznV{رX۞J<(" caaS)9&{cׄnꜤL$ٲe˥KBP$$m5$(_Gܰaٯ#jl{(F>8pe>ΖW0R{.ƍjnUUUDim6sƶԔغu8`T:WFQƬ鱱1br^}>[%y6V>,F "<5˲ҒaqqQree\:v":q(>٨h^D<~nsfKc:۾~zwЇ P6?bziɤEq݆A`tXii4O)T<}ZENDSSSNCQX,v\L&Eٹsa}ǎ|,ˊǏgd2PA>r{ĉ:::S#GV+Q(" .ttt$I <|d0 r@dqEQ"F۷oWw޺u,x|qqQIԇ޽Rze9 Vk[[[4MRl,tgQDL&s_:qr. B/IT]]sNb{2@!'(H444n %HձA1( ?+'  " && ! '"+ $!#(%()g<r$%oOyy@iB$jܟd1\2RдBi$B$u§,(>ŒOؗBB$ @c}O;BFB$ q)x B0&KB$ׯGt%f5PB$"WbB)XB$`b!o*W9]$$$b$JCĺf^It$Gd`S pUTYTu @YT8;I.ʚ;2Nʚ;g4ZdZdn(ppp@ <4!d!d;gʚ;<4dddd;gʚ; <4dddd;ʚ;,___PPT100 ( @X             ___PPT9`@P              h___PPT2001D<4XX$___PPTMac11$@N  (namd Symbol    (namd Symbol    (namd Symbol    (namd Symbol    (namd Symbol    (namd Symbol  8X   hnamd` Arial&Monotype Typography    hnamd` Arial&Monotype Typography    hnamd` Arial&Monotype Typography    hnamd` Arial&Monotype Typography 0   hnamd` Arial&Monotype Typography    hnamd` Arial&Monotype Typography $   hnamd` Arial&Monotype Typography  0   hnamd` Arial&Monotype Typography    hnamd` Arial&Monotype Typography    hnamd` Arial&Monotype Typography     hnamd` Arial&Monotype Typography     hnamd` Arial&Monotype Typography     hnamd` Arial&Monotype Typography    hnamd` Arial&Monotype Typography    hnamd` Arial&Monotype Typography    hnamd` Arial&Monotype Typography      (namd Symbol     (namd Symbol     (namd Symbol     (namd Symbol     (namd Symbol     (namd Symbol    (namd Symbol     (namd Symbol     (namd Symbol     (namd Symbol    (namd Symbol     (namd Symbol    (namd Symbol     (namd Symbol     (namd Symbol   ( ʚ;&)ʚ;dd?L- 8Rosenblum, Zhu, Miller, HuntO =m.Machine-Learning Assisted Binary Code Analysis//  "Supporting Static Binary Analysis _Malware detection Vulnerability analysis Static and Dynamic Instrumentation Formal verificationP`#  $ 7Many Binaries are Stripped[Malicious programs Operating system distributions Commercial software packages Legacy codes8\2   #8 Stripped Binaries Exhibit GapsxIndirect (pointer-based) control ambiguity Deliberate calls/branch obfuscation Gaps in code segment may not contain codeLy+$  YTYT Stripped Binaries Exhibit Gaps Stripped Binaries Exhibit Gaps Stripped Binaries Exhibit Gaps Stripped Binaries Exhibit Gaps   Modeling Binary CodeContent: Idiom features of function entry points Based on instruction sequences Structure: Control flow & conflict features Capture relationship of candidate function entry points Requires joint assignment over all function entry point candidates1,{ UT(  UT"8B>OM/) Content-based Features ! Call Consistency & Overlap 1Experimental SetupLarge set (100 s) of binaries from department Linux servers and Windows workstations Additional binaries compiled with Intel compiler Binaries have full symbol information Model implemented as extensions to Dyninst instrumentation library ZZU0  #  $$((Pa4# Preliminary Results MPreliminary Results <Preliminary Results 0 Backup Slides  "Idiom Feature Selection & Training $ Model FormalizationJoint assignment of yi = {1,-1} for each FEP xi in binary P Unary idiom features fu Weights lu trained through logistic regression Binary features fo (overlap), fc (call consistency) Weights lo, lc large, negativeUZ/Z4ZZ   C  C $K$ ((,,0044$88<<C K   C K  $$((,,0044, /   3 4 56=Nsx,, ` e(HH(dh   ` 33` Sf3f` 33g` f` www3PP` ZXdbmo` \ғq>9y`Ӣ` 3f3ff` 3f3FKf` hk]wwwfܹ` ff>>\`Y{ff` R>&- {p_/̴>?" dd@$|?" dd@   " @ ` n?" dd@   @@``PR    @ ` ` p>>  H(    0`( p  T Click to edit Master title style! !  s *( `  RClick to edit Master text styles Second level Third level Fourth level Fifth level!     S  s *P( 0P   P*    s *(    R*    s *( "P 0___PPT106___PPT9 ___PPTMac11  (namd Symbol   ~B*ML Assisted Binary Code Analysis"" H  0޽h ? 3380___PPT10.Otv[ $Blank Presentation  E= (  05.)"MH<2d   0( p  T Click to edit Master title style! !  s *0(  `    W#Click to edit Master subtitle style$ $H  0޽h ? 3380___PPT10.wt  \T`<(  < < s *p P    P*   < s *     R*  d < c $ ?   < s *  @  RClick to edit Master text styles Second level Third level Fourth level Fifth level!     S < 0 `P   P*   < 0 `   R*  H < 0޽h ? 3380___PPT10.ht    0 ( {5 R  s *P : P   0___PPT106___PPT9 ___PPTMac11  (namd Symbol   P*  T  s *í    0___PPT106___PPT9 ___PPTMac11  (namd Symbol   R*  X  0, `P  0___PPT106___PPT9 ___PPTMac11  (namd Symbol   P*  Z  0" `  0___PPT106___PPT9 ___PPTMac11  (namd Symbol   R*  H  0޽h ? 3380___PPT10.t!H)    @>( rarboC/ySrol/cny l  C `>      s *`   h___PPT10H@___PPT9^___PPTMac1180  (namd Symbol     hnamd` Arial&Monotype Typography    hnamd` Arial&Monotype Typography    hnamd` Arial&Monotype Typography    hnamd` Arial&Monotype Typography    hnamd` Arial&Monotype Typography    hnamd` Arial&Monotype Typography   (namd Symbol   N. Rosenblum, X. Zhu, B. Miller Computer Sciences Department University of Wisconsin - Madison {nater,jerryzhu,bart}@cs.wisc.edu (2a8P2   "!CC'  s *`  P___PPT100(v___PPT9XP___PPTMac11  (namd Symbol    (namd Symbol     hnamd` Arial&Monotype Typography    hnamd` Arial&Monotype Typography   (namd Symbol   1K. Hunt National Security Agency huntkc@gmail.com^(2*8P2 C ! XB @ 0DV  8    = `B  0DV Z   s *UTjJ `   0UTjJ0 PZ   s *UTjJ Z   s *UTjJ Z   s *UTjJ  @Z  s *UTjJp  Z  s *UTjJ  Z  s *UTjJ 0 Z  s *UTjJ`  `  0UT\jJ`  0UT\jJ0PZ  s *UTjJ`  0UT\jJ`  0UT\jJ @`  0UT\jJp Z  s *UTjJ  J  <UTjJ`0___PPT106___PPT9 ___PPTMac11  (namd Symbol   >  `   0UTnjJ`0P` " 0UT\jJ 0 ` # 0UTR8jJ`  Z $ s *UTjJ` @H  0޽h ? 33___PPT10u.Otv[+D=' = @B +h  X P p   ( Jxobtvcaa  r  S `mp   r  S nO 0     6r @ H Example Uses YT5  s *x `p,$, 5Code is found through symbol information and parsing V6UT  UT  s *` l:Binary Analysis is a Foundational Technique for Many Areas; 2;I  s * p 0 ph`___PPT10@8___PPT9xpZ___PPTMac114,   hnamd` Arial&Monotype Typography  wSource code unavailable e.g., malware Source code is inaccurate Compiler transforms structure Provides most accurate representation&    YTH R  6Ў) I GWhy Analyze Binaries?YT  s *0,$, gMUCH HARDER without symbols0 YTH  0޽h ? 33___PPT10.UtW+tD' = @B D' = @BA?%,( < +O%,( < +D' =%(D' =%(D' =A@BBBB0B%(D' =1:Bvisible*o3>+B#style.visibility<* %(D' =A@BBBB0B%(D' =1:Bvisible*o3>+B#style.visibility<* %(+p+0+  ++0+  +`    *% (  r  S @Dp   R  s *UTjJ0(  s *EPP a1Stripped binaries lack symbol & debug information22  < E 0     6 E  @@  EXAMPLES:   s *@E@0`,$, )Standard Approach: Parse from entry point"* 2 YT! ! # BwC~DE(FV wxLF~uMiA.R?F @   @0,$D, " 0E,{ 8BINARY 2 # luA0jJLight downward diagonal0H $ luA0jJLight downward diagonal 0(Xr % 0V Xr & 0VHXr ' 0Vx   ( s *$E@ ;Headers(2 ) s * 0E@03 @___PPT10 V___PPT980J___PPTMac11$   hnamd` Arial&Monotype Typography  eCode Segment (functions?)0(2    * s *2Ej 0  @ Data Segment (2 H  0޽h ? 33sk___PPT10K.Ot,+@vD' = @B D' = @BA?%,( < +O%,( < +D' =%(Du' =%(D' =A@BBBB0B%(D' =1:Bvisible*o3>+B#style.visibility<* %(D' =4@BBBB%(D' =1:Bvisible*o3>+B#style.visibility<*!%(+8+0+  +g  rj(( Jxobtvcaa (x ( c $@Hp   R ( s *UTjJ0P R ( s *UTjJ P ^ ( 6GH R ( s *YTjJ pR ( s *YTjJ` PR ( s *YTjJ   R  ( s *UTjJP  Rb  ( s *G:YTp^b  ( 6GEHxOI AYT p   ( s *пH0 6 p(After static parsing, gap regions remain,) UT  ( <H 0 @   ( 0H` > Code Segment 2 H ( 0޽h ? 33___PPT10u.Ot,+D=' H= @B +2  =5`$( XTlppacasu $x $ c $p   R $ s *UTjJ0P R $ s *UTjJ P ^ $ 6GH R $ s *YTjJ pR $ s *YTjJ` PR $ s *YTjJ   R  $ s *UTjJP  ^B  $ 6DV  P^B  $ 6DV  ~F p   $   T  $ c $jJp  $ s *@  j@.__gmon_start__.libc.so.6.stpcpy.strcpy.__divdi3.printf.stdout.strerror.memmove.getopt_long.re_syntax_options.__ctype_b.getenv.__strtol_internal.getpagesize.re_search_2.memcpy.puts.feof.malloc.optarg.btowc._obstack_newchunk.re_match.__ctype_toupper.__xstat64.abort.strrchr._obstack_begin.calloc.re_set_registers.fprintf.AAC      Rb $ s *G:YTp^b $ 6GEHxOI AYT p F  0`P $ 0 `P $ s * 0`P gGap contents may vary`B $ 0DVP P0P $ 0`#p _ String data (2 ^" $ 6q}uVP  $ 0` > Code Segment 2  $ s *00 0 ,$H___PPT10( f___PPT9H@^___PPTMac1180   hnamd` Arial&Monotype Typography    hnamd` Arial&Monotype Typography  +Dialog Constants Import names Other strings<,n    H $ 0޽h ? 33___PPT10u.Ot,+D=' n= @B +   0( koڥ] x  c $`ۭp   R  s *UTjJ0P R  s *UTjJ P ^  6GH R  s *YTjJ pR  s *YTjJ` PR  s *YTjJ   R   s *UTjJP  F p      Z   s *jJp   0py@ <4___PPT10ph    ___PPT9     ___PPTMac11p h  tnamdlCourier New&Monotype Typography  tnamdlCourier New&Monotype Typography  tnamdlCourier New&Monotype Typography  tnamdlCourier New&Monotype Typography  tnamdlCourier New&Monotype Typography  tnamdlCourier New&Monotype Typography  tnamdlCourier New&Monotype Typography  tnamdlCourier New&Monotype Typography  tnamdlCourier New&Monotype Typography  tnamdlCourier New&Monotype Typography  tnamdlCourier New&Monotype Typography  ow0x8022346 0x802434b 0x80243ad 0x80403d0 0x80503d0 0x8052140 0x8053142 0x806000b 0x802321a 0x8023332 0x804132a 0x8050ca0x022 C C C C  C C C C C  $C$ (C( ,C,0C0Rb  s *G:YTp^b  6GEHxOI AYT p F  0`P  0 `P  s *P 0`P gGap contents may vary`B  0DVP P0P  0p NTables or lists of addresses(2>  s *  80P___PPT100(v___PPT9XPR___PPTMac11,$   hnamd` Arial&Monotype Typography  0Jump tables Virtual function tables Data objectsJ1n  ^B  6DV  ^B  6DV  ^"  6q}uV   0` > Code Segment 2 H  0޽h ? 33___PPT10u.Ot,+D=' = @B +$  /'&( Jxobtvcaa x  c $p   R  s *UTjJ0P R  s *UTjJ P ^  6GH R  s *YTjJ pR  s *YTjJ` PR  s *YTjJ   R   s *UTjJP  f   0jJ"  Rb  s *G:YTp^b  6GEHxOI AYT p R  s *UTjJ    s *PfYTjJ PH___PPT10( f___PPT9H@___PPTMac11  (namd Symbol     hnamd` Arial&Monotype Typography    hnamd` Arial&Monotype Typography   (namd Symbol   gap_funcA { . . . }8   $   s *`tYTjJP 0 @___PPT10 V___PPT980___PPTMac11  (namd Symbol     hnamd` Arial&Monotype Typography   (namd Symbol   gap_funcB { . . .* $   s *`YTjJ0  H___PPT10( f___PPT9H@___PPTMac11  (namd Symbol     hnamd` Arial&Monotype Typography    hnamd` Arial&Monotype Typography   (namd Symbol   gap_funcC { . . . }8   $   0` p 0Code unreachable through standard static parsing1(21,y8  0`P 0 `P  s *P 0`P gGap contents may vary`B  0DVP P0P^B ! 6DV  ^B " 6DV  ^" $ 6q}uV   % 0` > Code Segment 2 H & s *p  ,$H___PPT10( f___PPT9H@^___PPTMac1180   hnamd` Arial&Monotype Typography    hnamd` Arial&Monotype Typography  2Function pointers Virtual methods Obfuscated calls<3n  !H  0޽h ? 33___PPT10u.Ot,+D=' n= @B +  h( Jxobtvcaa x  c $p   R  s *UTjJ0P R  s *UTjJ P ^  6GH R  s *YTjJ pR  s *YTjJ` PR  s *YTjJ   R   s *UTjJP  ^B   6DV  P^B   6DV  `   s *jJ"  Rb   s *G:YTp^b  6GEHxOI AYT p   s *0 `P gGap contents may vary  s *` LBut& all of these just look like bytes'(2'XB  0DVPP 0P  s *@ T 8___PPT10F___PPT9( F___PPTMac11    hnamd` Arial&Monotype Typography  7a 01 00 fd a2 b3 74 68 69 73 20 65 78 61 6d 70 6c 65 20 69 73 20 62 6f 67 75 73 2e 2e 2e 7a 01 00 fd a2 b3 74 68 69 73 20 65 78 61 6d 70 6c 65 20 69 73 20 62 6f 67 75 73 2e 2e 2e 7a 01 00 fd a2 b3 74 68 69 73 20 65 78 61 6d 70 6c 65 20 69 73 20 62 6f 6 cxYY=9  s *c p,$, AOur approach: Use information in known code to model code in gapsNB 2! YT   UT  s **0  1Every byte in gaps may be the start of a function2(22UT,$  00` > Code Segment 2 i  s *@5\,$, aPrevious work (Vigna et al., 2007) augments parsing with simple instruction frequency informationb 2b> (  s *P<   WHow can we find code in gaps?(2YTH  0޽h ? 33___PPT10.Ot,+5~D' = @B D' = @BA?%,( < +O%,( < +D' =%(D' =%(D' =A@BBBB0B%(D' =1:Bvisible*o3>+B#style.visibility<*%(D' =A@BBBB0B%(D' =1:Bvisible*o3>+B#style.visibility<*%(+p+0+ ++0+ +     0 (  0r 0 S |p         !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuwxyz{|}~r 0 S P~&  8 0 s *pP$X___PPT1080___PPT9h`___PPTMac11   hnamd` Arial&Monotype Typography    hnamd` Arial&Monotype Typography   (namd Symbol    (namd Symbol    (namd Symbol    (namd Symbol   xProblem reduces to finding function entry points Task: Classifying every byte in a gap as entry point or non-entry point\y(2YT   UT+M+< 0 s *:0P@0___PPT106___PPT9 ___PPTMac11  (namd Symbol   JTwo types of features:(2$H 0 0޽h ? 33___PPT10u.Ztl+D=' :P= @B +    !,k( `Svי ,r , S pp    , s *p :Entry idioms are common patterns at function entry points 0; - .v2 , 0UTp  @___PPT10 V___PPT980___PPTMac11    )) *p)(    pr p S Xp   L2 p 0[UTP0p8___PPT10F___PPT9( ___PPTMac11  Candidates 2 l 0 P  (pP0  ,$@,V #p s *@;P P67xp@___PPT10 V___PPT980___PPTMac11  (namd Symbol    (namd Symbol    (namd Symbol   ty1 = 10 W $p s *0 ` FG xp@___PPT10 V___PPT980___PPTMac11  (namd Symbol    (namd Symbol    (namd Symbol   uy3 = -10 V &p s *pW xp@___PPT10 V___PPT980___PPTMac11  (namd Symbol    (namd Symbol    (namd Symbol   ty2 = 10 V 'p s *  xp@___PPT10 V___PPT980___PPTMac11  (namd Symbol    (namd Symbol    (namd Symbol   ty4 = 10 : )p  fccA +? Ԕ?#" @F g@ +$D8PH___PPT2001$D F *p  fccA -? Ԕ?#" @F @8 -$D 8H p 0޽h ??`pppppp ppp 33yq___PPT10Q.t`&4&+lKD' = @B D' = @BA?%,( < +O%,( < +DL' =%(D' =%(D' =4@BBBB%(D' =1:Bvisible*o3>+B#style.visibility<*p%(D' =4@BBBB%(D' =1:Bvisible*o3>+B#style.visibility<*p%(D' =4@BBBB%(D' =1:Bvisible*o3>+B#style.visibility<*!p%(D' =%(Dh' =%(D' =4@BBBB%(D' =1:Bvisible*o3>+B#style.visibility<*(p%(D' =4@BBBB%(D' =1:Bvisible*o3>+B#style.visibility<*)p%(D' =%(D[' =%(D' =4@BBBB%(D' =1:Bvisible*o3>+B#style.visibility<*p%(D' =4@BBBB%(D' =1:Bvisible*o3>+B#style.visibility<*p%(Da' =4@BB BB%(D' =1:B 0.5*3>%Bstyle.opacity= B PPT<*!pD' =-6B image0BIE*v3=2Bopacity: 0.5 BIE<*!pD' =4@BBBB%(D' =1:Bhidden*o3>+B#style.visibility<*)p%(D4' =%(D' =%(D' =4@BBBB%(D' =1:Bvisible*o3>+B#style.visibility<**p%(+  @ |8(  |r | S 0p   l | C p@     | s *0`H@___PPT10ph    ___PPT9     ___PPTMac11d \   (namd Symbol    (namd Symbol     hnamd` Arial&Monotype Typography    hnamd` Arial&Monotype Typography    hnamd` Arial&Monotype Typography    hnamd` Arial&Monotype Typography    hnamd` Arial&Monotype Typography    hnamd` Arial&Monotype Typography    hnamd` Arial&Monotype Typography    hnamd` Arial&Monotype Typography    hnamd` Arial&Monotype Typography    hnamd` Arial&Monotype Typography   (namd Symbol   hStrip binary copies and parse to obtain training set Select top idiom features by forward feature selection Perform logistic regression to build idiom model Evaluate model on test data from gap regions in Step 1. Unstripped copies of binaries provide reference set 24 2( UT   UTUTUT !$$ ((UT ,,400t. +08 ) h`H | 0޽h ? 33___PPT10u.tE+D=' n= @B +!     `%9# (  8r 8 S p   Nb ` 9#""1::Kp  9 T ?#" @  \70,620 nn  9 Tp ?#" @  ` 11,231,721   nn  9 T ?#" @  _ 8,020,828   nn 9 Tp ?#" @@   Y443 nn 9 T ?#" @@  [MS VS nn 8 T  ?#" @  \47,841 nn 8 Tp ?#" @  ` 13,169,487   nn 8 T  ?#" @  _ 1,364,598   nn 8 T ?#" @@   Y112 nn 8 T  ?#" @@  YICC nn I8 Tp ?#" @  \85,870 nn J8 T ?#" @  ` 22,806,449   nn K8 Tp  ?#" @  _ 8,412,711   nn L8 T  ?#" @@   Y625 nn M8 Tp  ?#" @@  YGCC nn N8 Z" ?#" @ ` x"Actual number of functions in gaps## nn; O8 Zp6 ?#" @`  Total Test Examples (pos+neg) nn? P8 Z B ?#" @ ` !Total Training Examples (pos+neg)"" nn/ Q8 ZM ?#" @@ `  Programs examined  nn R8 ZY ?#" @`@  ^Compiler   nnB S8 Tccg  ?#" @``B T8 Ncc1 ?#" @B V8 Nccg  ?#" @B X8 Ncc1 ?#" @@ `@ B Y8 Ncc1 ?#" @ ` B Z8 Ncc1 ?#" @`B [8 Ncc1 ?#" @ ` B @9 Nccg  ?#" @B W8 Tccg  ?#" @`B Q9 Nccg  ?#" @B \8 Tccg  ?#" @` 8 s *t@ 0GNU C Compiler Simple, regular function preamble8 2"  2"" k 9 s *P AIntel C Compiler Most variation in entry points; highly optimized8 21  21 k 9 s *H 8MS Visual Studio High variation in function entry points8 2(  2( kH 8 0޽h ? 33___PPT10u.\tVO+D=' = @B +8  776f7(  x  c $7p   +f @  e#"& =3f % ZP< ?#" @H   b14,143 qw nn & Z0G ?#" @h H  _725 qw nn ' Z0R ?#" @ h  ^21,491 nn ( ZT ?#" @)  ]9,044 nn ) Zg ?#" @ )  ^65,586 nn * Z@j ?#" @?   ^79,320 nn + Z} ?#" @ ?  ]MS VS nn , Z ?3"@`H`   ZFN nn - Z@ ?3"@`h` H  ZFP nn . Z ?3"@` ` h  ZFN nn / Z ?3"@`) `  ZFP nn 0 ZP ?3"@`` )  ZFN nn 1 Z ?3"@`?`   ZFP nn 2 Z ?#" @ h  ^26,970 nn 3 ZPԤ ?#" @ h  ^38,074 nn 4 Z֤ ?#" @h H  a2,337 qw nn 5 Z ?#" @h H  _403 qw nn( 6 Z` ?#" @h@`  Dyninst w/ Model  nn 7 Z@ ?#" @)  ^14,422 nn 8 Z  ?#" @)  ^14,576 nn 9 Z ?#" @) @h`  _IDA Pro nn : Z  ?#" @ )  ^40,195 nn ; Z@+ ?#" @ )  ]2,012 nn < Z6 ?#" @?   ]3,786 nn = Z@ ?#" @?   ]2,833 nn% > ZK ?#" @?@) `   Orig. Dyninst nn ? ZV ?#" @H   b16,220 qw nn @ Zpa ?#" @H   a1,860 qw nn A Z0l ?#" @ ?  [ICC nn B Zv ?#" @ ?  [GCC nn C Z ?#" @@?  `Compiler   nnB D Tccg  ?#" @@@B E Tccg  ?#" @  B F Ncc1 ?#" @?@? B G Tcc1 ?"0@NNN?N) @) B H Tcc1 ?"0@NNN?Nh@h B I Tcc1 ?"0@NNN?N  B J Ncc1 ?#" @?` ` B K Tcc1 ?"0@NNN?N`  B L Tcc1 ?"0@NNN?N ` B M Tcc1 ?"0@NNN?NH` H B N Nccg  ?#" @  B O Tccg  ?#" @@ B P Tccg  ?#" @  B Q Nccg  ?#" @  B R Tccg  ?#" @@ B S Tccg  ?#" @  2 T s *0B 0Original Dyninst Scans for common entry preambleF 2 0 P2,  k  U s *PB 8Dyninst w/ Model Model replaces entry preamble heuristicF 2(0 P2' . k% V s *ץpp`___PPT10@8___PPT9xpz___PPTMac11TL   hnamd` Arial&Monotype Typography    hnamd` Arial&Monotype Typography    hnamd` Arial&Monotype Typography  3[IDA Pro Disassembler Scans for common entry preamble List of Library Fingerprints (Windows)v 2G0 P2    , ' k< f 60˥p+0___PPT106___PPT9 ___PPTMac11  (namd Symbol   >*Comparison of three binary analysis tools:H  0޽h ? 33___PPT10u.\tVO+D=' = @B +!     + (  R  s *A ? Pl  C $p      s *'p@H@P___PPT100(v___PPT9XPb___PPTMac11<4   hnamd` Arial&Monotype Typography    hnamd` Arial&Monotype Typography  _Classifier maintains high precision with good recall Model performance highly system-dependent MS Visual Studio & Intel C Compiler FEPs are highly variableR_ 2= 25)<  >4)$kl m ]>   m ]> $@,PH___PPT2001$DFt2  6HaYT8c"]st2  6HaYT8c"m ~ - >  0  0$D,PH___PPT2001$DFt2   6HaYT8c"t2   6HaYT8c"p0e`l B G GB ,$@,n2  0HaYT8c"n2  0HaYT8c"B G H  0޽h ? 33. & ___PPT10 . t1+ D ' = @B D ' = @BA?%,( < +O%,( < +D4' =%(D' =%(D' =4@BBBB%(D' =1:Bvisible*o3>+B#style.visibility<*%(D' =%(Df' =%(D' =4@BBBB%(D' =1:Bvisible*o3>+B#style.visibility<*%(D' =4@BBBB%(D' =1:Bhidden*o3>+B#style.visibility<*%(D' =%(Df' =%(D' =4@BBBB%(D' =1:Bvisible*o3>+B#style.visibility<*%(D' =4@BBBB%(D' =1:Bhidden*o3>+B#style.visibility<*%(+  x(  xr x S  p   H x 0޽h ? 33___PPT10u.tf+D=' `= @B +T'  _&W&!%4%( fitotacinoi 4r 4 S PMp   L  * 4# : 4 # ccA0?Light downward diagonal#" @ * 4 ZccQ`?#" @  4 ZccQ`?#" @@  "  4 ZccQ`?#" @& P(  4 ZccQ`?#" @P( *L  *  4# :  4 # ccA0?Light downward diagonal#" @ *  4 ZccQ`?#" @  4 ZccQ`?#" @@  " 4 ZccQ`?#" @& P( 4 ZccQ`?#" @P( *L  * 4# :/ 4 # ccA0?Light downward diagonal#" @ * 4 ZccQ`?#" @  4 ZccQ`?#" @@  " 4 ZccQ`?#" @& P( 4 ZccQ`?#" @P( * 4 S ~ccG"Hqw8c8c?"f0e@     ( (2 4  f`MccQ`8c8c?"Z0e@     P  0___PPT106___PPT9B___PPTMac11   hnamd` Arial&Monotype Typography  `Statically reachable functions& g 4 # l0Mcc 8c8c?"f0e@     0___PPT106___PPT9___PPTMac11  0namd(Monotype Sorts   >&   2c 4 6`M`P G .1. Obtain training data from traditional parse// 4 6M0   Y'Corpus is hundreds of stripped binaries(( 4 s *M`  >2. Use Condor HTC to drive forward feature selection on idioms?? 1: 4 3 A0  F 0 `$I,  4   !4 ZccjJ?#" @0 `$, "4 Z Ncc jJ?#" @ `$QI,h___PPT10H@___PPT9___PPTMac11   hnamd` Arial&Monotype Typography    hnamd` Arial&Monotype Typography    hnamd` Arial&Monotype Typography  (namd Courier  (namd Courier  (namd Courier  (namd Courier    hnamd` Arial&Monotype Typography  &Features: Feat1 Feat2 Feat3 ... Featk'  ccc c cccc$ #4 s *pN   23. Perform logistic regression on the selected idiom features to obtain model parameters lt>\Y  %6 $4 C xccG"Hqw8c8c?"f0e@     .  %4 S ~CccG"Hqw8c8c?"f0e@      p H 4 0޽h ? 33___PPT10u.Zt +D=' = @B +   ,$0 t(  t" t BGu=JV $D,PH___PPT2001$D F"  t BGu=JV` `p,$@ ," t BGu=JVP $D,PH___PPT2001$@Fr t S ;-p    t C 0=- <$< p  t # lccA ? Ԕ?#" @p  H t 0޽h ? 33c[___PPT10;.t2q>Zz+ED' = @B D' = @BA?%,( < +O%,( < +D' =%(Du' =%(D' =A@BBBB0B%(D' =1:Bvisible*o3>+B#style.visibility<*t<%(D' =4@BBBB%(D' =1:Bvisible*o3>+B#style.visibility<*t%(D' =%(D' =%(D' =A@BBBB0B%(D' =1:Bvisible*o3>+B#style.visibility<*t<U%(D' =A@BBBB0B%(D' =1:Bvisible*o3>+B#style.visibility<*tU%(D' =4@BBBB%(D' =1:Bhidden*o3>+B#style.visibility<*t%(D' =4@BBBB%(D' =1:Bvisible*o3>+B#style.visibility<*t%(D' =%(D' =%(D' =A@BBBB0B%(D' =1:Bvisible*o3>+B#style.visibility<*t%(D' =A@BBBB0B%(D' =1:Bvisible*o3>+B#style.visibility<*t%(D' =4@BBBB%(D' =1:Bvisible*o3>+B#style.visibility<* t%(D' =4@BBBB%(D' =1:Bhidden*o3>+B#style.visibility<*t%(+8+0+t + "$ x@( _ @R @ 3 <   ~ @ C )< @    H @ 0޽h ? 3380___PPT10.ht"$ @D&(  DR D 3 <    D C < @   4 H D 0޽h ? 3380___PPT10.qtƄh"$ xPH(  hDHFresU HR H 3 <   ~ H C *< @    H H 0޽h ? 3380___PPT10.qtQ"$ xL( tp{5 LR L 3 <   ~ L C << @    H L 0޽h ? 3380___PPT10.rt<"$ xP(  PR P 3 <   ~ P C < @    H P 0޽h ? 3380___PPT10.rt"$ xpT(  TR T 3 <   ~ T C @[*< @    H T 0޽h ? 3380___PPT10.rt"$ xX( {5 XR X 3 <   ~ X C M< @    H X 0޽h ? 3380___PPT10.st "$ x\( F \R \ 3 <   ~ \ C pH< @    H \ 0޽h ? 3380___PPT10.tt!L "$ x`( "8#vdlw `R ` 3 <   ~ ` C PJ< @    H ` 0޽h ? 3380___PPT10.ut9! "$ xpd( ;Z"@Z" dR d 3 <   ~ d C < @    H d 0޽h ? 3380___PPT10.utx"$ tlPh( tp hR h 3 <   r h # 9< @    H h 0޽h ? 3380___PPT10.t"$ tll( nicahsotDH  lR l 3 <   r l # `;< @    H l 0޽h ? 3380___PPT10.tD "$ 0T(  R  3 <     C @< @   bNDon t be formal: use example subscriptsH  0޽h ? 3380___PPT10.Gtw "$ x( {5 R  3 <   ~  C p< @    H  0޽h ? 3380___PPT10.Gtw"$ xP(  &  R  3 <   ~  C )< @    H  0޽h ? 3380___PPT10.Gtw"$ tl(  R  3 <   r  # `< @    H  0޽h ? 3380___PPT10.Gtw"$ x(  R  3 <   ~  C < @    H  0޽h ? 3380___PPT10.t^c "$  (  X  C <     S &< @    H  0޽h ? 3380___PPT10.utx8xWˏEfee`=1 aqY Qz{w[fYWFA{=M9'.^@A&pz̲.5z~߳t]?ò:$`=0Eo[/n?iTAa#=_4 9'k0fLl:U>-{ߞ,|$hc| g>l; |B 㘂gg j3yG8 Aշa95gfDQJ&6ĶkIEڄ+[ )vAڅ,sH#"Ez i7H/#I}H)=i)5M!d>ˉ1 w"zl݌\[xɣ,b@J_]fl>u㐼͘&&Xx[I{ڋ8C<$D]2lY @$0ӻb*d ehf~ Kk ,pڬA)Kع_a% } j.aip<̊k2 L/MQ7^W!U4W^W]8ǦUWR.a:j~[mD>re|Uax]b[&Ut4Cv32 \:Z~mNJVp5aVTqcOG"?FxGHW@;!M~>olFnoQs\/uTg|'e٨刞::BG$jbPM>88c34#[6#T펍БXPV8rVb<2+ECM: :ɦF COws8-R^MxNgrVɤ\J=^gJh:ǁP'HS(),ƅb'4$z(W,vF _ͥ>++Aۣv;0t]t:*ɨSIxƤꊛ`E۽ֈF F''K>Aa˜ˈ :L˜a&4meo?ޘ|R7Sx}xvIlV`#vxLtH>Nm00w]8$YЀ|r~EQ됋>Z.i9EҢeOZiEerQ\tu9{l Hkˡ" d3M6Ϡ(:AOQcU_eْWlmv{o2v_ﱨǼ,"xKpEug $U"ZDم@滳[ PrC̑*$63dHA-ONśrԃzQd$Y_gw6HB)֛ K>MH @c|l&xx3 f-1o?sc3ƖwŊIl~OC}2-{ůjߐd3mq805cg _Zsy3x!} Ϭ?V4_mg݊ m{a;WI<gCx"~ ABaA#qC$"HrL$y:'yMʮ9N\}˱m:~ ^R $K_Xnl|h y ],XWCRN%\u'7O|1_s!*`^7C,Z6B$97qڱQ3؈zV]|[=8 &oA1^}̄S-r=%zE͆mp(@<뺆U* b4n[f pxq'GrB|C$# CS2hɼ6@2`[qr;=(3 еG+dBZU"F?Y"9 jɯ(?xxV"Yys s[ka'9Zs *Cf .1^qO,|T )XeMQ8LfGD:*f'mL"M*E֙IŔ1_ ^Y&}Wp-<;ڕ㱅f: +j \KUFU+խ\<9w;ȍAͮivղS첎v?$fc>AJykٓ3eֈJU1[׫ؕiƞN:r︍yۙ8H*;+={pcϺ"L,dM\ji\JK6 cX()m7 YԊ-B*ycΌn;C; [Ӹ$*b zM =N .v휬*yl+RBQ#(KFR!&DOC=EƤVHh1=Z{E+JDQnp$H-gTx%HVj'7&HJ"Du5T\Cˆ8};[@R܏z[?== lʼnrnוdEiEjtK5Km郮+:7J/a =xM'H`n04 66`4phPAU4@4J h!/~ݻV6D}U!ݼ#'̂>Xl7ٙ髜a5k }Ա^xzmco U+$ "xY]h\>sWbٛCD[nHԥ?UWOPv+],@Ch_Z%/@m)PL MZh v)D9wd[67;̽;߿נ`oc8"1۞ ^O>{𢚏^k?^*JmOv;њ+&Er[o?y@J| gCFK@iI!:xMG?%ߐuې6wgc1؍PNx;ݬunW^3 toGJ NJ͕Dﱭsk?lgs L-pƔOa>?vͥ*(WgAyVƱ>;I`/ Jkmr8+|H-ᤴ'Fn,)b)9$S(CA+7n+k+em&21Ȳbq.Eu[5([/8l O-o KMx>Ixv-Ʌq`dr58|آ9(xYapXr CoCtAH d&;gw!EgPȖAY' v"8 캘)MF1̬ja.UF +' Lc["( ("anFP0R}S&ЎEU֊lD qϬ!t k1̫S(|=)nxc,׆,espŀ+݆Hk"ٌY*h͑QA2Lc=)y:Z0 +hKFevDPNe5̊g #V6Ce:2{VlbC|ySNa :ȼ&LvA 9d[OtGzCԈu Y#_lÊwVwLHkK]^ݨUjVʛ *K:F@TWOq  $b^"X8I*}Ɩ5*d;mHWl-3b^ NGfzVZ<[A(Y,/WxP\jrmG@5<6JI ˰dQLƑpM]XH))[< ɃnTCd ǚie>:wt;-&-Sύ=k)̠AK0,N6U1' 5Or' 70\KfV$<5<:mUBtV 0-/"暛 S 48rA A4w&8t/"~hR55Zjzlb䶛ZDZf`72V)p'SII$eJz{Nf/fyf {$rvU7'cz&FΗQ@73;Ұ`kreUȨ bfvHF5˜H ьtÈI;_췶[wjJO9aly D1T miRmϱmDQ >Be i1p+<1b#1ч!M-)WjsusFAF&eL:j H,e@&)2II-K;缡!!Su2&ٓه$8DaʹNjѮU!} ;'fz 6У,W*-JO:vdQr ]q,hw@o㷠><i^b5/@ RZEGn0I:4t^:W$\>TM!/Ҏ+Aw'>%wqۣۓ =Ovۧ FWxMoEtf6Mmƻ^BPQ? !T nnXRݪPqlAAܠ'@zPzDcήqNB}ym=?eUԃ}hc !"f&w^Mǹ>&w m|K8n>Wgs_MgGߏn[Oc C*1fgg [S)DPu?kb?/}[D7 m+mG,DANx`7 < <@^ `?/HH  < @@5C ؝fl !xAAPwp>FIs5`G븝¾JhŮ&zF${Us\ϪzA%hfLRV}h7)Zp7J.4h6hMDq%Y5lXd/y !3 käU1< %k C;u"bqKI< d҃j 2#WL\ d!u,32,c G둎c)ȔQi)^r`ռ/C %ar<\(F>a_^z^eWs)|bO_sO|P/ z/Y+E'ʨk䏀S(F&b͠Q2Li}:e:,S)7;Em,h7E+}.kG07k{ĖUk-\<T:R*N.qvٲclv*-y*ԲK|K%eB yԝj]H'ՈU![+•i O'?n;n=0rvl gxzͣwC_[`K2Yl4au&GAyTVe#̒#h(D#*!|`03|Z0ۑ 6ýi Λvj&~ eKL-3TA46v\5{b&:|0+WCbT/ԇ:^8" D6!wmLctGSNE(]Hؠඑf4|Ҙ& 4\Ҙ# +_rcܸ}cT}u'E4G|MvF`)xOt[+c8_U:2Vm-xWKoU>3q&MH(ۀHb *JREJV`2I3ر*U? a+` b͹<)J9ֱ9q=w};ý@:I0Fn#E!{ct{wD,ݝ84}@Ff|)_\JB_Ny R"dYPD-Lʏ 7DNL5)wG GN:{\kdM2Z*x6q5%t,"tU%f.s3ZKD3\˴n?RUDkAYifJlRt<;aumb3=1u45JS6Z2îgrF ZgfZYu]\,2N7 ovfCs6ZJ{VUsvӧKOQ/ u{NI0߬;UuH̖Uۍ:{X|Gߝr]z{~tyRLe N~EHd71!Q;ExWoUݸMt& $-P^^H׎CPQҊRqHڻڱ*Ur@*q\ 3ͼoI Nf7o7gg~]*A=G:I0[vnE!{dB;?xb:} '3=noK}T)o@ǎ?UO4C {ށ^S#Ʋ  !z QioqK~OMCǑa^0t N_ӧFgF> !E~|A%$5ݽOĢk~;^3"6/\zrZgS:_J:[W,a'TNafa`Dnv Q]D Ѩ8N߆J8r N?<{~ԬdBn`k?y!զrU&=GlVV2mqHK?nۄ7 _a@1kA`{QwHaRdJ1S؜cG݊1HaiD`"rnB2Y4j4C/I ĥ'$-<8.LfB;i~|1I?YR'%S |Ԝ4\wCI}9uvH.C,׌Ȋz]Gtr^#_.B<{5; Ef: 0ט:41 /,MfsDLYU?$\ABG<Z|mu|l7 Jw /AvzN-*=V5Q`KXost&}}=Eo:Maj`@.7!{.''{y㿖v4MOr{mcxp^RЀ3ÿ lHbP  @AL G@;b `B&V .͉͉͉O͉.fA.AAf͉O͉.͉A.uU\ȑȱOO7..\ȱOOOAȑA\tT\\\yAO.\pyAf.\..f..f\\yAO.\pA.\.́AAuUtT\\\uU..tT\y\y@uUtT@uUtT@uUtT@UT.IOUuUTtTOUuUTtTOUuUTtTOUuUTtTXUuUTtTOUuUTtTOUuUTtTOUuUTtTO:@uUtT@uUtT@uUtT@uUtTʁuUtT* uU tT uUtTUT@FLUUTTLUUTT߁UUTTUUTTӁUUTTUUTTLUUTTLUUTTxفuUtTFuUtT@uUtTuUtTuUtT uU tT ^uUtT@UT.*.UT.UT.UT.UT.UT.UT.UT.UT.  ՜.+,0     'On-screen ShowNathan Rosenblumg ArialMS PゴシックCourier Courier New Wingdings 2Lucida Calligraphy HelveticaTimes New RomanSymbolMonotype CorsivaBlank PresentationMicrosoft Equation/Machine-Learning Assisted Binary Code Analysis#Supporting Static Binary Analysis Many Binaries are StrippedStripped Binaries Exhibit GapsStripped Binaries Exhibit GapsStripped Binaries Exhibit GapsStripped Binaries Exhibit GapsStripped Binaries Exhibit GapsModeling Binary CodeContent-based FeaturesCall Consistency & OverlapExperimental SetupPreliminary ResultsPreliminary ResultsPreliminary ResultsBackup Slides#Idiom Feature Selection & TrainingModel Formalization  Fonts Used Design TemplateEmbedded OLE Servers Slide Titles(_㽡"DNathan RosenblumNathan RosenblumRdO)2#/QPictures>PowerPoint Document(fSummaryInformation(3      !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuwxyz{|}~  !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdeghijklmnopqrstuwxyz{|}~DocumentSummaryInformation8Current UserP sultsBackup Slides#Idiom Feature Selection & TrainingModel Formalization  Fonts Used Design TemplateEmbedded OLE Servers Slide Titles(_㽡Nathan RosenblumNathan Rosenblum