Superset Disassembly: Statically Rewriting x86 Binaries Without Heuristics

Abstract

Static binary rewriting is a core technology for many systems and security applications, including profiling, optimization, and software fault isolation. While many static binary rewriters have been developed over the past few decades, most make various assumptions about the binary, such as requiring correct disassembly, cooperation from compilers, or access to debugging symbols or relocation entries. This paper presents MUL-TIVERSE, a new binary rewriter that is able to rewrite Intel CISC binaries without these assumptions. Two fundamental techniques are developed to achieve this: (1) a superset disassembly that completely disassembles the binary code into a superset of instructions in which all legal instructions fall, and (2) an instruction rewriter that is able to relocate all instructions to any other location by mediating all indirect control flow transfers and redirecting them to the correct new addresses. A prototype implementation of MUL-TIVERSE and evaluation on SPECint 2006 benchmarks shows that MULTIVERSE is able to rewrite all of the testing binaries with a reasonable runtime overhead for the new rewritten binaries. Simple static instrumentation using MULTIVERSE and its comparison with dynamic instrumentation shows that the approach achieves better average performance. Finally, the security applications of MUL-TIVERSE are exhibited by using it to implement a shadow stack.

Binary Mutation Analysis of Tests Using Reassembleable Disassembly

“…Another approach to making disassembly reliable is the superset disassembly approach of Multiverse [6]. In this technique, avoiding any assumption about the usage of memory addresses or immediates, disassembly is performed at every byte offset of the text section.…”

POSTER: Mitigating Memory Sharing-based Side-channel Attack by Embedding Random Values in Binary for Cloud Environment

“…Static binary instrumentation (SBI) is a technique that manipulates an executable binary of application to reinforce its security against control-flow hijacking attacks [3,10]. Since SBI directly manipulates the application at the binary level, it has to consider adjustment of relocating information to preserve the program semantics.…”

“…Since SBI directly manipulates the application at the binary level, it has to consider adjustment of relocating information to preserve the program semantics. MULTIVERSE [3] is one of SBI frameworks which is applicable to x86 COTS executable binaries. We re-purpose it to embed secure random values in every executable page of target applications.…”

On the Impact of Exception Handling Compatibility on Binary Instrumentation

“…Another alternative is exhaustive disassembly that treats every possible offset as an instruction. Multiverse [4] develops such an approach, and has been further improved by Miller et al [23]. However, there is significant overhead in terms of code size as well as runtime overhead, about 60% on SPEC CPU 2 .…”