BIRD: Binary Interpretation using Runtime Disassembly

Abstract

The majority of security vulnerabilities published in the literature are due to software bugs. Many researchers have developed program transformation and analysis techniques to automatically detect or eliminate such vulnerabilities. So far, most of them cannot be applied to commercially distributed applications on the Windows/x86 platform, because it is almost impossible to disassemble a binary file with 100% accuracy and coverage on that platform. This paper presents the design, implementation, and evaluation of a binary analysis and instrumentation infrastructure for the Windows/x86 platform called BIRD (Binary Interpretation using Runtime Disassembly), which provides two services to developers of security-enhancing program transformation tools: converting binary code into assembly language instructions for further analysis, and inserting instrumentation code at specific places of a given binary without affecting its execution semantics. Instead of requiring a high-fidelity instruction set architectural emulator, BIRD combines static disassembly with an on-demand dynamic disassembly approach to guarantee that each instruction in a binary file is analyzed or transformed before it is executed. It takes 12 student months to develop the first BIRD prototype, which can successfully work for all applications in Microsoft Office suite as well as Internet Explorer and IIS web server, including all DLLs that they use. Moreover, the additional throughput penalty of the BIRD prototype on production server applications such as Apache, IIS, and BIND is uniformly below 4%.

Alternating Control Flow Reconstruction

“…In the context of dynamic instrumentation, Nanda et al proposed to resolve indirect branches at runtime, when the concrete jump target has already been computed [16]. In this paper, we generalize this idea to combining over-approximate static analysis with under-approximation and alternating between the two for resolving jump targets.…”

“…Nanda et al introduced hybrid disassembly in their tool BIRD [16]. They first use a heuristic disassembly algorithm to identify likely code regions in an executable.…”

Protean Code: Achieving Near-Free Online Code Transformations for Warehouse Scale Computers

“…Having direct access to the IR yields two significant advantages. First, it allows the runtime to avoid disassembling the binary, which can be difficult or impossible without access to fine-grain information about the executing code paths [47,48]. Second, the alternative of hoisting the binary to IR, as is done in prior work, loses important semantic information and limits the flexibility of the compiler [46].…”

EA-CRT: An Error Analysis Method with Embedded Code Reverse Technology

“…Disassembly research concentrates on algorithm improvements at home and abroad, such as static disassembly combined with machine learning [3] , error detection via control flow [4] , mixed disassembly method [5] , disassembly based on speculation [6] , etc. For the research of the reliability of the software for the smart meter, Zhejiang Electric Power Research Institute [7] utilize cross test strategy to test the software.…”

“…CppCheck has very good expansibility, using the open regular expression library PCRE. PCRE implements the detection of defects in lexical analysis phase, and then according to the value of the linener object Token to achieve the scalability of the defect mode [6] . The rest of the paper is organized as follows.…”