TWC: Medium: Collaborative: Automated Reverse Engineering of Commodity Software

软件，包括商业应用程序或嵌入式设备固件等常见示例，通常以闭源二进制文件的形式交付。虽然以前的学术工作已经研究了如何自动发现二进制软件中的漏洞，甚至如何自动编写针对这些漏洞的攻击，但回答有关闭源软件的基本安全相关问题的能力仍然难以实现。本项目旨在提供算法和工具来回答这些问题。利用先前在基于模拟器的动态分析方面的工作，我们提出了扩展这种高保真度分析的技术，以捕获和提取嵌入式设备固件和闭源应用程序背景下的整个系统行为。结合从该分析平台收集的动态执行轨迹和二进制代码分析技术，我们提出了二进制程序工件的自动结构分析技术，通过推断高级语义行为将系统和用户级程序分解为逻辑模块。这种分解以子程序粒度提供了每个模块之间的接口和信息流的自动学习描述。具体活动包括：(a)开发软件引导的全系统仿真器，以支持真实嵌入式系统的复杂动态分析；(b)开发先进的自动化技术，从结构上将闭源软件分解为其组成模块；(c)发展自动化技术，编制整个系统执行和软件组件的高级摘要；(d)开发自动化逆向工程和模糊测试加密网络协议的技术。本文提出的研究将对安全研究社区以外的领域产生重大影响。我们将把我们项目的研究成果纳入我们的本科和研究生教学课程，以及课外教育工作，如在大波士顿和亚特兰大大都会地区广泛推广的夺旗计划。集体pi拥有的与行业的密切联系将有助于将研究转化为可部署到现实世界系统和网络中的实用防御工具。

Software, including common examples such as commercial applications or embedded device firmware, is often delivered as closed-source binaries. While prior academic work has examined how to automatically discover vulnerabilities in binary software, and even how to automatically craft exploits for these vulnerabilities, the ability to answer basic security-relevant questions about closed-source software remains elusive.This project aims to provide algorithms and tools for answering these questions. Leveraging prior work on emulator-based dynamic analyses, we propose techniques for scaling this high-fidelity analysis to capture and extract whole-system behavior in the context of embedded device firmware and closed-source applications. Using a combination of dynamic execution traces collected from this analysis platform and binary code analysis techniques, we propose techniques for automated structural analysis of binary program artifacts, decomposing system and user-level programs into logical modules through inference of high-level semantic behavior. This decomposition provides as output an automatically learned description of the interfaces and information flows between each module at a sub-program granularity. Specific activities include: (a) developing software-guided whole-system emulator for supporting sophisticated dynamic analyses for real embedded systems; (b) developing advanced, automated techniques for structurally decomposing closed-source software into its constituent modules; (c) developing automated techniques for producing high-level summaries of whole system executions and software components; and (d) developing techniques for automating the reverse engineering and fuzz testing of encrypted network protocols. The research proposed herein will have a significant impact outside of the security research community. We will incorporate the research findings of our program into our undergraduate and graduate teaching curricula, as well as in extracurricular educational efforts such as Capture-the-Flag that have broad outreach in the greater Boston and Atlanta metropolitan areas.The close ties to industry that the collective PIs possess will facilitate transitioning the research into practical defensive tools that can be deployed into real-world systems and networks.