Probabilistic Disassembly
Probabilistic Disassembly
复制标题
DOI：
10.1109/icse.2019.00121
复制
发表时间：
2019-05
期刊：
影响因子：
--
通讯作者：
Kenneth A. Miller;Yonghwi Kwon;Yi Sun;Zhuo Zhang;X. Zhang;Zhiqiang Lin
中科院分区：
文献类型：
--
作者：
Kenneth A. Miller;Yonghwi Kwon;Yi Sun;Zhuo Zhang;X. Zhang;Zhiqiang Lin
由于代码段和数据的交织以及解决间接呼叫和跳跃的控制控制转移目标的困难，拆卸剥离的二进制文件是二进制分析的巨大挑战。结果，大多数现有的拆卸器都具有误报（FP）和假否定性（FN）。我们观察到，由于编译和代码生成过程中的信息损失，不确定性是不可避免的。因此，我们建议使用概率对这种不确定性进行建模，并提出一种新颖的拆卸技术，该技术计算代码空间中每个地址的概率，表明它是真正的积极指导的可能性。该概率是从可到达地址的一组功能中计算得出的，包括控制流量和数据流量功能。我们对超过两千种二进制的实验表明，我们的技术没有任何FN，只有3.7％的FP。相比之下，最先进的超集拆卸技术具有85％的FP。建立在我们的拆卸基础上的重写器可以产生二进制文件，而二进制文件仅是超级拆卸的二进制文件的一半，并且快速运行3％。尽管许多广泛使用的拆卸器（例如IDA和BAP）缺少功能条目，但我们的实验也表明，即使没有任何功能输入信息，我们的拆卸器仍然可以达到0 FN和6.8％的FP。
Disassembling stripped binaries is a prominent challenge for binary analysis, due to the interleaving of code segments and data, and the difficulties of resolving control transfer targets of indirect calls and jumps. As a result, most existing disassemblers have both false positives (FP) and false negatives (FN). We observe that uncertainty is inevitable in disassembly due to the information loss during compilation and code generation. Therefore, we propose to model such uncertainty using probabilities and propose a novel disassembly technique, which computes a probability for each address in the code space, indicating its likelihood of being a true positive instruction. The probability is computed from a set of features that are reachable to an address, including control flow and data flow features. Our experiments with more than two thousands binaries show that our technique does not have any FN and has only 3.7% FP. In comparison, a state-of-the-art superset disassembly technique has 85% FP. A rewriter built on our disassembly can generate binaries that are only half of the size of those by superset disassembly and run 3% faster. While many widely-used disassemblers such as IDA and BAP suffer from missing function entries, our experiment also shows that even without any function entry information, our disassembler can still achieve 0 FN and 6.8% FP.