Cross-architecture bug search in binary executables

By Jannik Pewny, Behrad Garmany, Robert Gawlik, Christian Rossow, Thorsten Holz. IEEE Symposium on Security and Privacy, 2015

358 citations recorded by the source corpus.

Abstract With the general availability of closed-source software for various CPU architectures, there is a need to identify security-critical vulnerabilities at the binary level. Unfortunately, existing bug finding methods fall short in that they i) require source code, ii) only work on a single architecture (typically x86), or iii) rely on dynamic analysis, which is difficult for embedded devices. In this paper, we propose a system to derive bug signatures for known bugs. First, we compute semantic hashes for the basic blocks of the binary. When can then use these semantics to find code parts in the binary that behave similarly to the bug signature, effectively revealing code parts that contain the bug. As a result, we can find vulnerabilities, e.g., the famous Heartbleed vulnerabilities, in buggy binary code for any of the supported architectures (currently, ARM, MIPS and x86).

Subfields: Artificial Intelligence, Software, Signal Processing

View Paper: https://www.semanticscholar.org/paper/083e479096f018b075f79cbd43caaab93d01f8bf

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Software

In Signal Processing

Citations in the corpus

Asm2Vec: Boosting Static Representation Robustness for Binary Clone Search against Code Obfuscation and Compiler Optimization (2019, methodology): “[38], Blex [10], MultiMH [11], and BinGo [12] use randomly-sampled values to compare I/O values.”
Neural Network-based Graph Embedding for Cross-Platform Binary Code Similarity Detection (2017, methodology): “There have been several previous works addressing the bug-search problem: discovRE [16], Multi-HM andMulti-k-HM [31], a centroid-based search [10], and Genius [18].”
Graph Matching Networks for Learning the Similarity of Graph Structured Objects (2019, methodology): “In the past the binary function similarity search problem has been tackled with classical graph theoretical matching algorithms (Eschweiler et al., 2016; Pewny et al., 2015 binaries and be invariant to compiler type and optimization levels.”
Following Devil's Footprints: Cross-Platform Analysis of Potentially Harmful Libraries on Android and iOS (2016, background): “…the variations of the same program (e.g., one obfuscated while the other is not) [19] or those on different platforms but compiled from the same source code [20], never before has any effort been made to correlate two independently developed programs with the same functionalities across platforms.”
SOK: (State of) The Art of War: Offensive Techniques in Binary Analysis (2016, methodology): “Initially applied to source code [60], [61], related techniques have since been extended to binaries [45].”
Scalable Graph-based Bug Search for Firmware Images (2016, methodology): “These settings have been used in existing studies as well [45].”
discovRE: Efficient Cross-Architecture Identification of Bugs in Binary Code (2016, methodology): “In this section we describe discovRE in details, focusing on the techniques that it uses to find similarities between binary functions.”