AUSPICE: Automatic Safety Property Verification for Unmodified Executables

Abstract

Verification of machine-code programs using program logic has focused on functional correctness, and proofs have required manuallyprovided program specifications. Fortunately, the verification of shallow safety properties such as memory isolation and control-flow safety can be easier to automate, but past techniques for automatically verifying machine-code safety have required post-compilation transformations, which can change program behavior. In this work, we automatically verify safety properties for unmodified machine-code programs without requiring user-supplied specifications. Our novel logic framework, AUS-PICE, for automatic safety property verification for unmodified executables, extends an existing trustworthy Hoare logic for local reasoning, and provides a novel proof tactic for selective composition. We demonstrate our automated proof technique on synthetic and realistic programs. Our verification completes in 6 hours for a realistic 533-instruction string search algorithm, demonstrating the feasibility of our approach.

Highly Automated Formal Proofs over Memory Usage of Assembly Code

“…Fully automated approaches to formal verification, however, do not scale either. The recent automated approach AUSPICE takes about 6 hours for a 533-instruction string search algorithm [56]. To the best of our knowledge, our methodology is the first that is able to deal with optimized x86-64 binaries produced by production code, with a "manual effort vs. instruction count ratio" of roughly 1 to 11.…”

“…As example of interactive theorem proving, Boyer and Yu verified machine-code implementations of various standard sort-and string functions, requiring over 19,000 lines of manually written proof code for the verification of roughly 900 instructions [8]. As example of automated theorem proving, Tan et al presented an approach which takes about 6 hours for a 533-instruction string search algorithm [56]. In constrast, this paper involves a degree of user interaction of ≈85 lines of proof code per 1,000 lines of assembly.…”

Automatic Derivation of Platform Noninterference Properties

“…Balliu et al [3] does this for noninterference, Tan et al [22] for safety-properties. Despite the seeming similarities, ISA analysis and binary code analysis dier in many respects.…”

“…As discussed above, we choose an instruction-wide context from the beginning. Both [3] and [22] employ a more local reasoning. In [22] a Hoare-style logic is used and context is provided by selective synchronisation of pre-and postconditions between neighbouring code blocks.…”

“…Both [3] and [22] employ a more local reasoning. In [22] a Hoare-style logic is used and context is provided by selective synchronisation of pre-and postconditions between neighbouring code blocks. In [3] a forward symbolic analysis carries the context in a path condition when advancing from instruction to instruction.…”