OSPREY: Recovery of Variable and Data Structure via Probabilistic Analysis for Stripped Binary
OSPREY: Recovery of Variable and Data Structure via Probabilistic Analysis for Stripped Binary
复制标题
DOI：
10.1109/sp40001.2021.00051
复制
发表时间：
2021-05
期刊：
影响因子：
--
通讯作者：
Zhuo Zhang;Yapeng Ye;Wei You;Guanhong Tao;Wen-Chuan Lee;Yonghwi Kwon;Yousra Aafer;X. Zhang
中科院分区：
文献类型：
--
作者：
Zhuo Zhang;Yapeng Ye;Wei You;Guanhong Tao;Wen-Chuan Lee;Yonghwi Kwon;Yousra Aafer;X. Zhang
从剥离的二进制程序中恢复变量和数据结构信息是二进制程序分析中的一个突出挑战。虽然各种最先进的技术在特定环境下是有效的，但这种有效性可能并不普遍。这主要是因为这个问题本身就是不确定的，因为在汇编过程中会丢失信息。大多数现有的技术都是确定性的，缺乏处理这种不确定性的系统方法。我们提出了一种新的用于变量和结构恢复的概率技术。引入随机变量来表示具有各种类型和结构属性的抽象存储位置的可能性，例如作为某个数据结构的字段。这些随机变量通过程序分析得出的概率约束联系在一起。求解这些约束产生随机变量的后验概率，它本质上表示恢复结果。我们的实验表明，我们的技术大大超过了许多最先进的系统，包括IDA、Ghidra、Angr和Howard。我们的案例研究表明，恢复的信息改进了二进制代码硬化和二进制反编译。
Recovering variables and data structure information from stripped binary is a prominent challenge in binary program analysis. While various state-of-the-art techniques are effective in specific settings, such effectiveness may not generalize. This is mainly because the problem is inherently uncertain due to the information loss in compilation. Most existing techniques are deterministic and lack a systematic way of handling such uncertainty. We propose a novel probabilistic technique for variable and structure recovery. Random variables are introduced to denote the likelihood of an abstract memory location having various types and structural properties such as being a field of some data structure. These random variables are connected through probabilistic constraints derived through program analysis. Solving these constraints produces the posterior probabilities of the random variables, which essentially denote the recovery results. Our experiments show that our technique substantially outperforms a number of state-of-the-art systems, including IDA, Ghidra, Angr, and Howard. Our case studies demonstrate the recovered information improves binary code hardening and binary decompilation.