Finding Substitutable Binary Code for Reverse Engineering by Synthesizing Adapters

Sharma, Vaibhav; Hietala, Kesha; McCamant, Stephen

doi:10.1109/icst.2018.00024

Cited by 6 publications

(5 citation statements)

References 30 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The goal of our technique is to translate 2 loops such as the one in Figure 1 into calls to standard string functions. Our technique uses a counterexample-guided inductive synthesis (CEGIS) algorithm [44] inspired by Sharma et al 's work on synthesizing adaptors between C functions with overlapping functionality but different interfaces [42]. This CEGIS approach is based on dynamic symbolic execution, a program analysis technique that can automatically explore multiple paths through a program by using a constraint solver [8].…”

Section: Techniquementioning

confidence: 99%

“…Our synthesis approach is inspired by Sharma et al 's work on synthesizing adapters between different C library implementations [42]. Their vocabulary gadgets are able to translate the interface of one library into that of another.…”

Section: Counterexample-guided Synthesismentioning

confidence: 99%

“…More generally, program synthesis has seen renewed interest in recent years [1, 13, 20-22, 31, 43, 47]. Our synthesis approach is based on CEGIS [44], with the synthesizer and verifier both based on dynamic symbolic execution [42].…”

Section: Programmentioning

confidence: 99%

See 2 more Smart Citations

Computing summaries of string loops in C for better testing and refactoring

Kapus

Ish-Shalom

Itzhaky

et al. 2019

Proceedings of the 40th ACM SIGPLAN Conference on Programming Language Design and Implementation

View full text Add to dashboard Cite

Analysing and comprehending C programs that use strings is hard: Using standard library functions for manipulating strings is not enforced and programs often use complex loops for the same purpose. We introduce the notion of memoryless loops that capture some of these string loops and present a counterexample-guided inductive synthesis approach to summarise memoryless string loops using C standard library functions, which has applications to testing, optimization and refactoring.We prove our summarization is correct for arbitrary input strings and evaluate it on a database of loops we gathered from a set of 13 open-source programs. Our approach can summarize over two thirds of memoryless loops in less than 5 minutes of computation time per loop. We then show that these summaries can be used to (1) enhance symbolic execution testing, where we observed median speedups of 79x when employing a string constraint solver, (2) optimize native code, where certain summarizations led to significant performance gains, and (3) refactor code, where we had several patches accepted in the codebases of popular applications such as patch and wget.

show abstract

Section: Techniquementioning

confidence: 99%

Section: Counterexample-guided Synthesismentioning

confidence: 99%

See 1 more Smart Citation

Computing summaries of string loops in C for better testing and refactoring

Kapus

Ish-Shalom

Itzhaky

et al. 2019

Proceedings of the 40th ACM SIGPLAN Conference on Programming Language Design and Implementation

View full text Add to dashboard Cite

show abstract

“…An example from previous work of an application of binary symbolic execution for reasoning about component behavior is Sharma et al's adaptor synthesis [9]. Adaptor synthesis reasons about the behavior of two components using a counter-example guided synthesis loop to determine if one can be wrapped to serve as a replacement for the other.…”

Section: Adaptor Synthesismentioning

confidence: 99%

Contract discovery from black-box components

Sharma¹,

Byun²,

McCamant³

et al. 2018

Proceedings of the 1st ACM SIGSOFT International Workshop on Automated Specification Inference

Self Cite

View full text Add to dashboard Cite

Complex computer-controlled systems are commonly constructed in a middle-out fashion where existing subsystems and available components have a significant influence on system architecture and drive design decisions. During system design, the architect must verify that the components, put together as specified in the architecture, will achieve the desired system behavior. This typically leads to further design modifications or adjustments to requirements triggering another iteration of the design-verify cycle. For software components that are acquired from third-parties, often the only definitive source of information about the component's system-relevant behavior -its contract -is its object code. We posit that existing static and dynamic analysis techniques can be used to discover contracts that can help the system designer and specifically discuss how symbolic execution of object code may be particularly well-suited for this purpose. CCS CONCEPTS• Software and its engineering → Formal software verification; Software reverse engineering;

show abstract

“…Originally developed in the 1970s [19], [10], symbolic execution is a convenient building block for program analysis, since arbitrary query predicates can be combined with the logical program representation, and solutions to these constraints are program inputs illustrating the queried behavior. Some of the applications of symbolic execution include test generation [15,26], equivalence checking [25,28], vulnerability finding [31,32], program repair [22], invariant discovery [1], and protocol correctness checking [33]. Symbolic execution tools are available for many languages, including CREST [7] for C source code, KLEE [8] for C/C++ via LLVM, JDart [21] and Symbolic PathFinder (SPF) [24] for Java, and S2E [9], FuzzBALL [4], and angr [31] for binary code.…”

Section: Introductionmentioning

confidence: 99%

Java Ranger: statically summarizing regions for efficient symbolic execution of Java

Sharma

Hussein

Whalen

et al. 2020

Proceedings of the 28th ACM Joint Meeting on European Software Engineering Conference and Symposium on the Foundations of Softw

Self Cite

View full text Add to dashboard Cite

Merging execution paths is a powerful technique for reducing path explosion in symbolic execution. One approach, introduced and dubbed łveritestingž by Avgerinos et al., works by translating a bounded control flow region into a single constraint. This approach is a convenient way to achieve path merging as a modification to a pre-existing single-path symbolic execution engine. Previous work evaluated this approach for symbolic execution of binary code, but different design considerations apply when building tools for other languages. In this paper, we extend the previous approach for symbolic execution of Java. Because Java code typically contains many small dynamically dispatched methods, it is important to include them in multi-path regions; we introduce dynamic inlining of method-regions to do so modularly. Java's typed memory structure is very different from the binary representation, but we show how the idea of static single assignment (SSA) form can be applied to object references to statically account for aliasing. We have implemented our algorithms in Java Ranger, an extension to the widely used Symbolic Pathfinder tool. In a set of nine benchmarks, Java Ranger reduces the running time and number of execution paths by a total of 38% and 71% respectively as compared to SPF. Our results are a significant improvement over the performance of JBMC, a recently released verification tool for Java bytecode. We also participated in a static verification competition at a top theory conference where other participants included stateof-the-art Java verifiers. JR won first place in the competition's Java verification track.

show abstract

Finding Substitutable Binary Code for Reverse Engineering by Synthesizing Adapters

Cited by 6 publications

References 30 publications

Computing summaries of string loops in C for better testing and refactoring

Computing summaries of string loops in C for better testing and refactoring

Contract discovery from black-box components

Java Ranger: statically summarizing regions for efficient symbolic execution of Java

Contact Info

Product

Resources

About