ELISA: ELiciting ISA of Raw Binaries for Fine-Grained Code and Data Separation

Nicolao, Pietro De; Pogliani, Marcello; Polino, Mario; Carminati, Michele; Quarta, Davide; Zanero, Stefano

doi:10.1007/978-3-319-93411-2_16

Cited by 9 publications

(45 citation statements)

References 16 publications

(32 reference statements)

Supporting

Mentioning

Contrasting

Order By: Relevance

“…At the same time, the sample-sets used in our experiments have some significant differences compared to the state of the art. First, the total number of 66685 samples in our experiments is several times larger than those used by both Clemens [8] (16785 samples) and De Nicolao et al [12] (15290 samples). Second, compared to existing works, our sample-set size per architecture is both larger and more balanced.…”

Section: Datasets and Experimental Setup 21 Datasetsmentioning

confidence: 90%

“…• First and foremost contribution is that we implement and release as open source the code and toolset necessary to reconstruct and re-run the experiments from this paper as well as from the state of the art works of Clemens [8] and De Nicolao et al [12]. To our knowledge, it is the first such toolset to be publicly released.…”

Section: Contributionsmentioning

confidence: 99%

“…The next 4 features map to "4 endianness signatures" (used by Clemens [8]). The following 31 features are mapped to function epilog and function prolog signatures for amd64, arm, armel, mips32, powerpc, powerpc64, s390x, x86 (developed by angr framework [36] and also used by De Nicolao et al [12]). The final 2 features map to "powerpcspe signatures" that were developed specifically for this paper.…”

Section: Machine Learningmentioning

confidence: 99%

“…Even worse, more often than not the object code for such peripheral firmware is stored using less traditional or nonstandard file formats and headers (if any), or embedded inside the device drivers themselves resulting in mixed architectures code streams. Currently, several state of the art works try to address the challenge of accurately identifying the CPU ISA for executable object code sequences [8,12]. Their approaches look promising as the results demonstrate effectiveness and high-performance.…”

Section: Introductionmentioning

confidence: 99%

“…To this end, we release a comprehensive collection of open data, open source, and open API web-services. We attempt experiment reconstruction and cross-validation of effectiveness, efficiency, and results of the state of the art methods [8,12], as well as propose and experimentally validate new approaches to the main classification challenge where we obtain consistently comparable, and in some scenarios better, results. The results we obtain in our extensive set of experiments are consistent and comparable with prior art, hence supports the general validity and soundness of both existing and newly proposed algorithms, features, and approaches.…”

Section: Introductionmentioning

confidence: 99%

See 4 more Smart Citations

ISAdetect

Kairajärvi

Costin

Hämäläinen

2020

Proceedings of the Tenth ACM Conference on Data and Application Security and Privacy

View full text Add to dashboard Cite

Static and dynamic binary analysis techniques are actively used to reverse engineer software's behavior and to detect its vulnerabilities, even when only the binary code is available for analysis. To avoid analysis errors due to misreading op-codes for a wrong CPU architecture, these analysis tools must precisely identify the Instruction Set Architecture (ISA) of the object code under analysis. The variety of CPU architectures that modern security and reverse engineering tools must support is ever increasing due to massive proliferation of IoT devices and the diversity of firmware and malware targeting those devices. Recent studies concluded that falsely identifying the binary code's ISA caused alone about 10% of failures of IoT firmware analysis. The state of the art approaches detecting ISA for executable object code look promising, and their results demonstrate effectiveness and high-performance. However, they lack the support of publicly available datasets and toolsets, which makes the evaluation, comparison, and improvement of those techniques, datasets, and machine learning models quite challenging (if not impossible). This paper bridges multiple gaps in the field of automated and precise identification of architecture and endianness of binary files and object code. We develop from scratch the toolset and datasets that are lacking in this research space. As such, we contribute a comprehensive collection of open data, open source, and open API web-services. We also attempt experiment reconstruction and cross-validation of effectiveness, efficiency, and results of the state of the art methods. When training and testing classifiers using solely code-sections from executable binary files, all our classifiers performed equally well achieving over 98% accuracy. The results are consistent and comparable with the current state of the art, hence supports the general validity of the algorithms, features, and approaches suggested in those works. CCS CONCEPTS• Security and privacy → Software reverse engineering; • Computing methodologies → Machine learning; • Computer systems organization → Embedded and cyber-physical systems. * This paper is based on: author's MSc thesis [21] and extended pre-print version [22].

show abstract

Section: Datasets and Experimental Setup 21 Datasetsmentioning

confidence: 90%

Section: Contributionsmentioning

confidence: 99%

Section: Machine Learningmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations

ISAdetect

Kairajärvi

Costin

Hämäläinen

2020

Proceedings of the Tenth ACM Conference on Data and Application Security and Privacy

View full text Add to dashboard Cite

show abstract

The Good, the Bad, and the Binary: An LSTM-Based Method for Section Boundary Detection in Firmware Analysis

Remigio,

Bertani,

Polino

et al. 2023

Lecture Notes in Computer Science

Self Cite

View full text Add to dashboard Cite

Static analysis tools need information about the ISA and the boundaries of the code and data sections of the binary they analyze. This information is often not readily available in embedded systems firmware, often provided only in a non-standard format or as a raw memory dump. This paper proposes a novel methodology for ISA identification and code and data separation, that extends and improves the state of the art. We identify the main shortcoming of state-of-the-art approaches and add a capability to classify packed binaries' architecture employing an entropy-based method. Then, we implement an LSTM-based model with heuristics to recognize the section boundaries inside a binary, showing that it outperforms state-of-the-art methods. Finally, we evaluate our approach on a dataset of binaries extracted from real-world firmware.

show abstract