Incremental CFG patching for binary rewriting

Meng, Xiaozhu; Liu, Weijie

doi:10.1145/3445814.3446765

Cited by 4 publications

(2 citation statements)

References 25 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…This undecidable problem is also what we try to circumvent in our paper. Currently, no tools can guarantee a successful binary rewriting in practice [6,30,55,80,81,83]. Therefore, our future work is to explore binary rewriting to achieve the goal of code size reduction.…”

Section: Discussion and Future Workmentioning

confidence: 99%

“…Our strategy is to simply overwrite these extra basic blocks using a single-byte illegal instruction ł0xFF.ž The benefit of doing so is that any attempt to run the erased code will trigger an exception, and we are immediately aware of implementation errors. Recent binary rewriting works [6,30,55,80,81,83] offer an option to decrease the program size as well by deleting unused binary code. Unfortunately, they bear several limitations and trade-offs that can compromise soundness, such as updating code/data references, ignoring computed code pointers, requiring a custom loader to perform runtime address resolution, and non-negligible runtime overhead.…”

Section: Icfg Constructionmentioning

confidence: 99%

See 1 more Smart Citation

One size does not fit all: security hardening of MIPS embedded systems via static binary debloating for shared libraries

Zhang

Ren

Lei

et al. 2022

Proceedings of the 27th ACM International Conference on Architectural Support for Programming Languages and Operating Systems

View full text Add to dashboard Cite

Embedded systems have become prominent targets for cyberattacks. To exploit firmware's memory corruption vulnerabilities, cybercriminals harvest reusable code gadgets from the large shared library codebase (e.g., uClibc). Unfortunately, unlike their desktop counterparts, embedded systems lack essential computing resources to enforce security hardening techniques. Recently, we have witnessed a surge of software debloating as a new defense mechanism against code-reuse attacks; it erases unused code to significantly diminish the possibilities of constructing reusable gadgets. Because of the single firmware image update style, static library debloating shows promise to fortify embedded systems without compromising performance and forward compatibility. However, static library debloating on stripped binaries (e.g., firmware's shared libraries) is still an enormous challenge.In this paper, we show that this challenge is not insurmountable for MIPS firmware. We develop a novel system, named 𝜇Trimmer, to identify and wipe out unused basic blocks from shared libraries' binary code, without causing additional runtime overhead or memory consumption. We propose a new method to identify addresstaken blocks/functions, which further help us maintain an interprocedural control flow graph to conservatively include library code that could be potentially used by firmware. By capturing address access patterns for position-independent code, we circumvent the challenge of determining code-pointer targets and safely eliminate unused code. We run 𝜇Trimmer to debloat shared libraries for SPEC CPU2017 benchmarks, popular firmware applications (e.g., Apache, BusyBox, and OpenSSL), and a real-world wireless router firmware image. Our experiments show that not only does 𝜇Trimmer deliver functional programs, but also it can cut the exposed code surface and eliminate various reusable code gadgets remarkably. 𝜇Trimmer's debloating capability can compete with the static linking results.

show abstract

Section: Discussion and Future Workmentioning

confidence: 99%

Section: Icfg Constructionmentioning

confidence: 99%