Speculative disassembly of binary code
Speculative disassembly of binary code
复制标题
DOI：
10.1145/2968455.2968505
复制
发表时间：
2016-10
期刊：
影响因子：
--
通讯作者：
M. Ammar;Benguettache Khadra;D. Stoffel;W. Kunz
中科院分区：
文献类型：
--
作者：
M. Ammar;Benguettache Khadra;D. Stoffel;W. Kunz
嵌入式软件的复杂性正在迅速增加。为了应对这种情况，开发人员依赖第三方IP来加快产品交付。然而，IP源代码可能不可用，这限制了可验证性。这带来了特别的挑战，尤其是在安全关键型应用中，例如汽车。静态二进制分析(SBA)是一种很有前途的技术，它为工程师提供了对所有可能的输入执行的实际指令进行推理的能力，从而解决了这种挑战。对于任何从二进制代码恢复汇编指令的SBA来说，反汇编都是基本的第一步。然而，正确的反汇编是具有挑战性的，因为二进制文件中的数据与代码混合在一起。此外，可变大小的ISA，例如Thumb和TriCore，允许单字节序列具有多个有效解释。我们介绍了Spedi，一个开源的针对Thumb ISA的投机式反汇编程序。SPEDI基于一种原则性的反汇编方法，其中所有可能的基本块都被推测地恢复。然后，使用冲突分析来精化基本块以识别汇编指令。使用多种基准测试的实验表明，SPEDI算法既快速又有效。在反汇编正确性方面，它超过了事实上的行业标准反汇编程序IDA Pro。Spedi还可以恢复大部分调用图和切换表目标。它对混淆具有弹性，不使用任何符号信息，这使得它适合于包括安全分析在内的各种SBA应用程序的前端。
Embedded software is rapidly increasing in complexity. To cope with this, developers rely on third-party IPs to accelerate product delivery. However, IP source code might not be available which limits verifiability. This creates a particular challenge especially in safety-critical applications, e.g., automotive. Static Binary Analysis (SBA) is a promising technique to address such a challenge by providing engineers with the ability to reason about the actual instructions executed for all possible inputs. Disassembly is the fundamental first step for any SBA where assembly instructions are recovered from binary code. Correct disassembly, however, is challenging since data is mixed with code in binaries. Moreover, variable-size ISA, e.g., Thumb and TriCore, allow a single byte sequence to have multiple valid interpretations. We introduce Spedi, an open source SPEculative DIsassembler for Thumb ISA. Spedi is based on a principled approach to disassembly where all possible basic blocks are speculatively recovered. Then, basic blocks are refined using conflict analyses to identify assembly instructions. Experiments using a wide range of benchmarks demonstrate that Spedi is both fast and effective. It outperforms IDA Pro, the de-facto industry standard disassembler, in terms of disassembly correctness. Spedi can also recover the majority of the call graph and switch table targets. It is resilient to obfuscation and doesn't use any symbol information which makes it a suitable front-end for a wide variety of SBA applications including security analysis.