Finding Substitutable Binary Code By Synthesizing Adapters
Finding Substitutable Binary Code By Synthesizing Adapters
复制标题
通过合成适配器查找可替代的二进制代码
DOI：
--
复制
发表时间：
2017
影响因子：
7.4
通讯作者：
Stephen McCamant
中科院分区：
文献类型：
--
作者：
Vaibhav Sharma;Kesha Hietala;Stephen McCamant
独立开发的代码库通常包含许多执行相同或密切相关操作的代码段（语义克隆）。找到功能上等效的段可以实现应用程序，例如用更有效或更安全的替代方案替换段。这些相关的段通常有不同的接口，因此需要一些粘合代码（适配器）来替换其中一个。在以前的工作中，我们提出了一个算法，搜索可替换的代码段，试图合成一个适配器之间的适配器从一些有限的家庭适配器;它终止，如果它没有找到可能的适配器。在这项工作中，我们比较了基于二进制符号执行的适配器搜索与具体的适配器枚举的基础上英特尔的引脚框架，并探讨适配器搜索空间的大小和总的搜索时间之间的关系。我们提出了应用适配器合成的例子，以提高二进制函数的安全性和RC 4的二进制实现之间的切换。我们提出了两个大规模的评估：（1）我们运行适配器合成超过13,000对功能从Linux C库，（2）我们通过运行超过一百万适配器合成任务的ARM二进制代码的片段进行逆向工程。我们的研究结果证实，在现实世界的代码中存在几个实例的自适应等价的二进制函数，并建议适配器合成可以应用于自动替换二进制代码与其自适应等价的变体。
Independently developed codebases typically contain many segments of code that perform same or closely related operations (semantic clones). Finding functionally equivalent segments enables applications like replacing a segment by a more efficient or more secure alternative. Such related segments often have different interfaces, so some glue code (an adapter) is needed to replace one with the other. In previous work, we presented an algorithm that searches for replaceable code segments by attempting to synthesize an adapter between them from some finite family of adapters; it terminates if it finds no possible adapter. In this work, we compare binary symbolic execution-based adapter search with concrete adapter enumeration based on Intel’s Pin framework, and explore the relation between size of adapter search space and total search time. We present examples of applying adapter synthesis for improving security of binary functions and switching between binary implementations of RC4. We present two large-scale evaluations: (1) we run adapter synthesis on more than 13,000 function pairs from the Linux C library, and (2) we reverse engineer fragments of ARM binary code by running more than a million adapter synthesis tasks. Our results confirm that several instances of adaptably equivalent binary functions exist in real-world code, and suggest that adapter synthesis can be applied for automatically replacing binary code with its adaptably equivalent variants.