Cross-Architecture Bug Search in Binary Executables

Abstract

With the general availability of closed-source software for various CPU architectures, there is a need to identify security-critical vulnerabilities at the binary level to perform a vulnerability assessment. Unfortunately, existing bug finding methods fall short in that they i) require source code, ii) only work on a single architecture (typically x86), or iii) rely on dynamic analysis, which is inherently difficult for embedded devices.In this paper, we propose a system to derive bug signatures for known bugs. We then use these signatures to find bugs in binaries that have been deployed on different CPU architectures (e.g., x86 vs. MIPS). The variety of CPU architectures imposes many challenges, such as the incomparability of instruction set architectures between the CPU models. We solve this by first translating the binary code to an intermediate representation, resulting in assignment formulas with input and output variables. We then sample concrete inputs to observe the I/O behavior of basic blocks, which grasps their semantics. Finally, we use the I/O behavior to find code parts that behave similarly to the bug signature, effectively revealing code parts that contain the bug.We have designed and implemented a tool for crossarchitecture bug search in executables. Our prototype currently supports three instruction set architectures (x86, ARM, and MIPS) and can find vulnerabilities in buggy binary code for any of these architectures. We show that we can find Heartbleed vulnerabilities, regardless of the underlying software instruction set. Similarly, we apply our method to find backdoors in closedsource firmware images of MIPS-and ARM-based routers.

A Cross-Architecture Instruction Embedding Model for Natural Language Processing-Inspired Binary Code Analysis

“…First, static plagiarism detection or clone detection includes string-based [2], [5], [15], AST-based [32], [57], [63], [36], token-based [33], [55], [54], and PDGbased [22], [40], [11], [39]. Source code-based approaches are Recent works have applied traditional approaches to addressing the cross-architecture scenario [53], [19], [8], [20], [13], [14], [12]. Multi-MH and Multi-k-MH [53] are the first two methods for comparing functions of different ISAs.…”

“…Source code-based approaches are Recent works have applied traditional approaches to addressing the cross-architecture scenario [53], [19], [8], [20], [13], [14], [12]. Multi-MH and Multi-k-MH [53] are the first two methods for comparing functions of different ISAs. But their fuzzing-based basic-block similarity comparison and graph (i.e., CFG) matching-based algorithms are very expensive.…”

“…When the source code of programs is not available, binary code analysis becomes indispensable for a variety of important tasks, such as plagiarism detection [41], [31], malware classification [66], [30], and vulnerability discovery [53], [62]. Increasingly, software is cross-compiled for various architectures.…”

“…For example, hardware vendors often use the same code base to compile firmware for different devices that operate on varying architectures (e.g., x86 and ARM): this could cause a single vulnerability at source-code level to spread across binaries across diverse devices. As a result, cross-architecture binary code analysis has become an emerging problem that draws great attention [53], [19], [21], [62], [67]. Analysis of binaries across instruction set architectures (ISAs), however, is non-trivial: binaries of varying ISAs differ greatly in instruction sets; calling conventions; general-and special-purpose CPU register usages; and memory addressing modes.…”

“…Given a function in x86 that contains, for instance, the Heartbleed function, by searching for functions similar to it from a large database of functions of varying architectures, more vulnerability instances may be found. This question has gained intense research interest [53], [19], [21], [62]. A core subtask involved is the comparison of basic blocks across architectures.…”