SemDiff: Finding Semtic Differences in Binary Programs based on Angr
SemDiff: Finding Semtic Differences in Binary Programs based on Angr
复制标题
SemDiff：基于 Angr 查找二进制程序中的语义差异
DOI：
--
复制
发表时间：
2017
期刊：
影响因子：
--
通讯作者：
Weiyang Xu
中科院分区：
文献类型：
--
作者：
Shi;Chu;Yao;Weiyang Xu
我们介绍了Semdiff，这是一种新型技术，用于在两个二进制文件之间找到语义差异。现在，供应商将发布信息以修补具有漏洞的先前版本。然后，我们可以比较两个版本之间的差异和相似之处，以获取1天漏洞的未发表细节。但是，bindiff，binhunt和ibinhunt等工具在此之前曾在该项目上进行过一些弱点。就像Bindiff一样，基于结构的比较方法也不能有效判断语义差异。尽管其他两个工具（Bindhunt和ibinhunt）可以识别我们关注的差异，但由于使用基于图基的同构算法，它们无法有效地验证功能上的内置并花费很长时间来完成该过程。在本文中，我们首先提出了使用现有工具（ANGR）生成中间语言（VEX）的Semdiff。然后，由于程序的性质，数据从读取并写入记忆的数据，我们记录了这些信息以实施比较。最后，改进的绑定算法用于匹配基本块。在本文中，我们将一些真正的漏洞作为示例，例如CVE-2010-3974-Microsoft Windows来测试我们的工具，达到一个好的目标，匹配比Bindiff更多的障碍，并且花费比Binhunt和Ibinhunt更少的时间。
We introduce SemDiff, a novel technology for finding semantic differences between two binary files. Now, the vendor will release the information to patch the previous version which has vulnerability. Then, we can compare the differences and similarities between the two versions to get the unpublished details of the 1day vulnerabilities. Tools, such as BinDiff, BinHunt and iBinHunt, have worked on this project before, however, there are some weaknesses on them. Just like BinDiff, a comparison method based on structure, can not be effective for judging the semantic differences. Though the other two tools(BindHunt and iBinHunt) can recognize the differences we focus on, they can not effectively verify the functional inlining and spend a pretty long time to finish the process because the use of graph-based isomorphism algorithm. In the paper, we first propose SemDiff, which uses the existing tool(angr) to generate the intermediate language(VEX). Then, because of the nature of program, the data read from and written to the memories, we record these information to implement the comparison. Last, an improved BinDiff algorithm is used to match the basic blocks. In this paper, we take some real vulnerabilities as examples, such as CVE-2010-3974-Microsoft Windows to test our tool, reaching a good goal, matching more blocks than BinDiff and taking less time than BinHunt and iBinHunt.