Leveraging semantic signatures for bug search in binary programs

Pewny, Jannik; Schuster, Félix; Bernhard, Lukas; Holz, Thorsten; Rossow, Christian

doi:10.1145/2664243.2664269

Cited by 120 publications

(73 citation statements)

References 24 publications

(27 reference statements)

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…Modern approaches for binaries follow strategies to compare the semantics of code. Examples are TEDEM [23], Exposé [22], BinHunt [8], its follow-up project, iBinHunt [21], and BinJuice [17], which uses syntactic equations similar to our formulas and hashes those to measure similarity. BinHash [14] inspired our sampling, which is also used by Blanket Execution (Blex) [6]).…”

Section: Related Workmentioning

confidence: 99%

Cross-architecture bug search in binary executables

Pewny

Garmany

Gawlik

et al. 2017

It - Information Technology

Self Cite

177

View full text Add to dashboard Cite

Abstract:With the general availability of closed-source software for various CPU architectures, there is a need to identify security-critical vulnerabilities at the binary level. Unfortunately, existing bug finding methods fall short in that they i) require source code, ii) only work on a single architecture (typically x86), or iii) rely on dynamic analysis, which is difficult for embedded devices. In this paper, we propose a system to derive bug signatures for known bugs. First, we compute semantic hashes for the basic blocks of the binary. When can then use these semantics to find code parts in the binary that behave similarly to the bug signature, effectively revealing code parts that contain the bug. As a result, we can find vulnerabilities, e.g., the famous Heartbleed vulnerabilities, in buggy binary code for any of the supported architectures (currently, ARM, MIPS and x86).

show abstract

Section: Related Workmentioning

confidence: 99%

Cross-architecture bug search in binary executables

Pewny

Garmany

Gawlik

et al. 2017

It - Information Technology

Self Cite

177

View full text Add to dashboard Cite

show abstract

“…Bernardi et al introduced an approach to detect design patterns in object oriented systems by graph matching, while the detection range is limited to the patterns specifications repository. 16 They also designed tree-based edit distances to measure code similarity. 10 Jonischkeit and Kirsch enhanced graph-based similar function identification by leveraging instruction level information of basic blocks.…”

Section: Related Workmentioning

confidence: 99%

“…Before the experiments, 16 pairs of active open-source programs are collected from their homepages. Also, the instruction sequences and FCGs are extracted from binary codes through the usage of Python APIs provided by IDA Pro (Interactive Disassembler Professional).…”

Section: Applications Of Fcg Matchingmentioning

confidence: 99%

See 1 more Smart Citation

Toward efficient and accurate function‐call graph matching of binary codes

Huang

Tang

Wang

et al. 2018

Concurrency and Computation

View full text Add to dashboard Cite

Reverse engineering, software plagiarism detection, and malware analysis have always been important issues in software and security fields. For a binary code, the function-call graph (FCG) reflects its capability, structure, and intrinsic relations, which motivates us to study FCG matching and its applications in those problems systematically. In this work, we propose an FCG matching algorithm based on Hungarian algorithm that solves the maximum weight matching problem in polynomial time and makes matching between graphs of large scale possible. Also, optimizations including node pairs pruning and forward matching are proposed to improve the efficiency and accuracy of FCG matching algorithm. Finally, a series of experiments are conducted to show that FCG matching is an effective method and has huge application potentiality in software and security analysis. KEYWORDSfunction-call graph, graph matching, Hungarian algorithm, reverse engineering, software security INTRODUCTIONGraph matching aims at finding a bijective mapping that matches nodes from different graphs. Graph matching has been widely used in various fields such as pattern recognition, computer vision, and bioinformatics. For the binary code of a program, function-call graph (FCG) is a graph that depicts the invocation of functions. It reflects the structure and some internal features of the program. FCG is less susceptible to instruction-level obfuscation employed in malicious codes to evade detection. 1 Because common obfuscation of binary codes such as instruction reordering, equivalent instruction sequence substitution and branch inversion will not cause significant changes to FCG. For this reason, FCG matching of binary codes is a promising method for some important issues in software and security fields, like reverse engineering, software plagiarism detection, malware homology analysis, and malware classification and clustering, which are illustrated in Figure 1, respectively. a) Reverse engineering: Supposing we have analyzed program P by reverse engineering, the reverse analysis of its successor or close-related program P ′ could be easier by leveraging of the result of program P. Graph matching maps the functions in program P ′ to the similar reversed-functions in program P automatically, and therefore, it reduces the overall workloads of reverse engineering significantly. b) Software plagiarism detection: By the use of FCG matching from protected software to suspicious software, pairs of functions with high similarity could be revealed as the plagiarized parts.c) Malware homology analysis: Discovering the isomorphic subgraphs through FCG matching helps determine the homologous malware samples that are developed by same author or share same code fragments. d) Malware classification and clustering: Distance between malware samples can be well defined according to the results of FCG matching. Such distance can be used by typical classification or clustering algorithms to classify or cluster a set of unknown malware samples.So far, most of fast alg...

show abstract

“…In contrast to both Merlin and Chucky, sources, sanitizers, and sinks are expressed as regular expressions as part of traversals, making it easy for the analyst to adapt them to further improve the specification. Finally, several authors employ similarity measures to determine vulnerabilities similar to a known vulnerability [17,24,42,61].…”

Section: Related Workmentioning

confidence: 99%

Automatic Inference of Search Patterns for Taint-Style Vulnerabilities

Yamaguchi

Maier

Gascón

et al. 2015

2015 IEEE Symposium on Security and Privacy

153

View full text Add to dashboard Cite

Taint-style vulnerabilities are a persistent problem in software development, as the recently discovered "Heartbleed" vulnerability strikingly illustrates. In this class of vulnerabilities, attacker-controlled data is passed unsanitized from an input source to a sensitive sink. While simple instances of this vulnerability class can be detected automatically, more subtle defects involving data flow across several functions or projectspecific APIs are mainly discovered by manual auditing. Different techniques have been proposed to accelerate this process by searching for typical patterns of vulnerable code. However, all of these approaches require a security expert to manually model and specify appropriate patterns in practice.In this paper, we propose a method for automatically inferring search patterns for taint-style vulnerabilities in C code. Given a security-sensitive sink, such as a memory function, our method automatically identifies corresponding source-sink systems and constructs patterns that model the data flow and sanitization in these systems. The inferred patterns are expressed as traversals in a code property graph and enable efficiently searching for unsanitized data flows-across several functions as well as with project-specific APIs. We demonstrate the efficacy of this approach in different experiments with 5 open-source projects. The inferred search patterns reduce the amount of code to inspect for finding known vulnerabilities by 94.9% and also enable us to uncover 8 previously unknown vulnerabilities.

show abstract

Leveraging semantic signatures for bug search in binary programs

Cited by 120 publications

References 24 publications

Cross-architecture bug search in binary executables

Cross-architecture bug search in binary executables

Toward efficient and accurate function‐call graph matching of binary codes

Automatic Inference of Search Patterns for Taint-Style Vulnerabilities

Contact Info

Product

Resources

About