OFFDTAN: A New Approach of Offline Dynamic Taint Analysis for Binaries

Abstract

Dynamic taint analysis is a powerful technique for tracking the flow of sensitive information. Different approaches have been proposed to accelerate this process in an online or offline manner. Unfortunately, most of these approaches still have performance bottlenecks and thus reduce analytical efficiency. To address this limitation, we present OFFDTAN, a new approach of offline dynamic taint analysis for binaries. OFFDTAN can be described in terms of four stages: dynamic information acquisition, vulnerability modeling, offline analysis, and backtrace analysis. It first records program runtime information and models the stack buffer overflow vulnerabilities and controlled jump vulnerabilities. Then it performs offline analysis and backtrace analysis to locate vulnerabilities. We implement OFFDTAN on the basis of QEMU virtual machine and apply it to off-the-shelf applications. In order to illustrate how our approach works, we first employ a case study. Furthermore, six applications have been verified so as to evaluate our approach. Experimental results demonstrate that our approach is correct and effective. Compared with other offline analysis tools, OFFDTAN has much lower application runtime overhead.

BAHK: Flexible Automated Binary Analysis Method with the Assistance of Hardware and System Kernel

“…On the basis of decoupling techniques, it constructs the straight-line instructions by the lightweight instrumentation and accelerates the symbolic analysis by multiple worker threads. After that, the similar offline scheme StraightTaint is also proposed [26], and Wang et al also proposed another offline analysis method [27]. Recently, Banerjee et al proposed the new analysis tool Iodine [28], which can avoid the frequent rollbacks in the optimistic dynamic analysis.…”

“…(11) Check and mark the loops in the traversed nodes. (12) end (13) else (14) Disassemble and parse block (15) while Get instruction ins from block successfully do (16) if ins is a system call instruction or has memory operations then (17) Mark block as abort (18) break (19) else if ins is a direct unconditional jump instruction then (20) Construct the node of target block, and push it to stack_dfs (21) break (22) else if ins is a conditional branch instruction then (23) Construct all successor nodes of block, and push them to stack_dfs (24) break (25) else if ins is an indirect branch instruction or other transfers then (26) Mark block as pending, and save the traversed nodes and execution paths (27) break (28) else if ins is the end_ins then (29) Mark block as the end (30) break (31) else (32) Save the parse result to block en we still need to reexecute part of the instructions in the paths to obtain the real execution path. For two possible…”