Frankencode: Creating Diverse Programs Using Code Clones

Finding Substitutable Binary Code By Synthesizing Adapters

“…Algorithm 1 will terminate with either an adapter that produces equivalence between the target and inner functions for all side-effects, or an indication that the functions cannot be made equivalent using the adapter family we specify. Algorithm 1 first initializes the current adapter to a default Input : Pointers to the target function T and inner function I Output: (argument adapter A, return value adapter R) or null [1] A ← default-function-args-adapter; [2] R ← default-return-value-adapter; [3] test-list ←empty-list; [4] while true do [5] counterexample ← CheckAdapter (A, R, T, I); [6] if counterexample == null then [7] return (A, R); [8] else [9] test-list.append(counterexample); [10] end [11] (A, R) ← SynthesizeAdapter (test-list, T, I); [12] if A == null then [13] return null; [14] end [15] end Algorithm 1: Counterexample-guided adapter synthesis Input : Concrete adapter A for function arguments and R for return value, target function pointer T, inner function pointer I Output: Counterexample to the given adapter or null [1] args ← symbolic; [2] while execution path available do [3] T-return-value, T-side-effects ← T(args); [4] I-return-value, I-side-effects ← I(adapt(A, args)); [5] if ! (equivalent(T-side-effects, I-side-effects) and equivalent(T-return-value, adapt(R, I-return-value))) then [6] return concretize(args); [7] end [8] end [9] return null; Algorithm 2: CheckAdapter used by Algorithm 1 adapter.…”

“…Algorithm 2 is successful if it finds inequivalence between (1) side-effects of the target and inner functions, or (2) the target function's return value and adapted return value of the inner function created by calling the adapt method with the input return value adapter. On Input : List of previously generated counterexamples test-list, target function pointer T, inner function pointer I Output: (argument adapter A, return value adapter R) or null [1] A ← symbolic function args adapter; [2] R ← symbolic return value adapter; [3] while execution path available do [4] eq-counter ← 0; [5] while eq-counter < length(test-list) do [6] T-return-value, T-side-effects ← T(test); [7] I-return-value, I-side-effects ← I(adapt(A, test)); [8] if equivalent(T-side-effects, I-side-effects) and equivalent(T-return-value, adapt(R, I-return-value)) then [9] eq-counter ← eq-counter + 1; [10] else [11] break; [12] end [13] end [14] if eq-counter == length(test-list) then [15] return (concretize(A), concretize(R)); [16] end [17] end [18] return null;…”

“…In this paper we present a technique that automates the process of finding functions that match the behavior specified by an existing function, while also discovering the necessary wrapper needed to handle interface differences between the original and discovered functions. Other use cases for our technique include replacing insecure dependencies of off-the-shelf libraries with bug-free variants, deobfuscating binary-level functions by comparing their behavior to known implementations, and locating multiple versions of a function to be run in parallel to provide security through diversity [4], and reverse engineering a fragment of code to its intended semantic functionality.…”