Labeling library functions in stripped binaries

Abstract

Binary code presents unique analysis challenges, particularly when debugging information has been stripped from the executable. Among the valuable information lost in stripping are the identities of standard library functions linked into the executable; knowing the identities of such functions can help to optimize automated analysis and is instrumental in understanding program behavior. Library fingerprinting attempts to restore the names of library functions in stripped binaries, using signatures extracted from reference libraries. Existing methods are brittle in the face of variations in the toolchain that produced the reference libraries and do not generalize well to new library versions. We introduce semantic descriptors, high-level representations of library functions that avoid the brittleness of existing approaches. We have extended a tool, unstrip, to apply this technique to fingerprint wrapper functions in the GNU C library. unstrip discovers functions in a stripped binary and outputs a new binary, with meaningful names added to the symbol table. Other tools can leverage these symbols to perform further analysis. We demonstrate that our semantic descriptors generalize well and substantially outperform existing library fingerprinting techniques.

When Coding Style Survives Compilation: De-anonymizing Programmers from Executable Binaries

“…Previous work has shown that with only 20 executable binary samples per compiler as training data, it is possible to use a linear Conditional Random Field (CRF) to determine the compiler used with accuracy of 93% on average [41], [27]. Other work has shown that by using pattern matching, library functions can be identified with precision and recall between 0.98 and 1.00 based on each one of three criteria; compiler version, library version, and linux distribution [23].…”

Obfuscating Windows DLLs

“…IDA Pro uses a technique called FLIRT, which uses pattern matching to detect and identify the presence of compiler-generated patterns and certain library functions, and can be extended with user-provided databases [8]. On Linux, system library functions can be identified by the system call numbers they embed to interface with the kernel, and then one can iteratively try to identify the callers of the already identified functions [9]. Machine learning can be used to automatically learn patterns required to identify library functions [10].…”

Recovery of Class Hierarchies and Composition Relationships from Machine Code

“…(Recovering aggregation relationships is possible future work -see §6.) Jacobson et al describe the idea of using semantic descriptors to fingerprint system-call wrapper functions and label them meaningfully in stripped binaries [15]. Bardin et al use Value Analysis with Precision Requirements (VAPR) for recovering a Control Flow Graph (CFG) from an unstructured program [3].…”