TWC: Small: A platform for enhancing security of binary code

网络攻击是由允许攻击者植入软件漏洞的软件漏洞实现的。随着旧漏洞的发现和修复，攻击者会继续寻找新的漏洞。因此，软件供应商、系统管理员和安全专业人员越来越依赖于在软件中插入额外代码的技术，以检测和/或阻止正在进行的网络攻击。这个过程称为软件检测，如果它在二进制格式上运行，而不是在源代码上运行，那么它可以应用于最广泛的软件。大多数软件都是以二进制格式分发的。此外，基于二进制的技术更加通用：与基于源代码的技术不同，它们不局限于特定的编程语言。现代指令集的复杂性是二进制检测的主要挑战之一。准确的检测需要捕获所有指令的语义，因为仪器执行的所有分析和转换都是基于该语义的。显然，即使对于单一架构来说，这也是一项艰巨的任务：描述x86指令集的Intel手册长达1500多页，描述了1100多条指令。当这项任务在不同的体系结构（如ARM、PowerPC、SPARC、MIPS等）上成倍增加时，所涉及的工作量就变得不切实际了。该项目将开发一种新颖的方法，通过利用嵌入在当前编译器（如GCC）中的可重目标代码生成器中的知识，避免对指令集建模的需要。这种方法不仅简化了插装的开发，而且使其适用于所有可用代码生成器的体系结构。使用这种方法，该项目将开发一个平台来支持商业现货（COTS）二进制文件的高效、与体系结构无关的静态仪器。基于这个平台，该项目将开发几个有效的工具来加固软件以对抗常见的漏洞。

Cyberattacks are enabled by software vulnerabilities that allow attackers to plant software exploits. As old vulnerabilities are found and fixed, attackers continue to find new ones. As a result, software vendors, system administrators and security professionals have come to rely increasingly on techniques that insert additional code into software for detecting and/or blocking cyber attacks in progress. This process, called software instrumentation, can be applied to the broadest range of software if it operates on binary format in which most software is distributed, rather than on source code. Moreover, binary based techniques are more general: unlike source-codebased techniques, they are not limited to a particular programming language.One of the major challenges in binary instrumentation is the complexity of modern instruction sets. Accurate instrumentation requires the semantics of all instructions to be captured, since all of the analyses and transformations performed by the instrumentor are based on this semantics. Clearly, this is a daunting task even for a single architecture: the Intel manual describing the x86 instruction set runs to over 1500 pages describing over 1100 instructions. When this task is multiplied across different architectures such as ARM, PowerPC, SPARC, MIPS, etc, the effort involved becomes impractically large. This project will develop a novel approach that avoids the need for modeling instruction sets by leveraging knowledge embedded in retargetable code generators in today's compilers such as GCC. This approach not only simplifies the development of instrumentation, but also makes it applicable to all architectures for which a code generator is available. Using this approach, this project will develop a platform to support efficient, architecture-neutral static instrumentation of commercial off-the-shelf (COTS) binaries. Based on this platform, this project will develop several effective instrumentations for hardening software against common vulnerabilities.