CAREER: Binary-Level Security via ABI-Centric Semantic Inference

了解软件的内部工作原理对于保护台式电脑和移动电脑至关重要。大多数商业软件缺乏源代码，因此有必要分析和保护软件二进制文件。然而，与源代码不同，二进制文件缺乏对安全性至关重要的丰富语义信息。传统的二进制分析和逆向工程方法受到混淆、编译器和编译标志的选择、调试信息的可用性和底层指令集体系结构等因素的限制。这个项目通过利用二进制和它的环境之间的接口，弥合了二进制分析中的语义鸿沟。这种交互是由应用程序二进制接口（ABI）规范强制要求的。该项目基于ABI依从性赋予二进制的某些属性，这些属性为逆向工程提供了强大的基础。由于遵守ABI是互操作性所必需的，因此依赖ABI线索进行逆向工程提供了前所未有的健壮性，不受混淆和编译环境（例如，优化）的影响。该项目利用两种独立但互补的机制，利用语言abi极大地提高了二进制分析和代码重用攻击检测的技术水平。它采用静态和动态二进制分析方法的组合，以便从二进制文件中派生高级设计信息（例如，面向对象语言类图）。这些信息对于解决反编译、软件专门化、软件相似性检测等问题至关重要。虽然该项目评估遵循Itanium和微软MSVC abi的二进制文件，但发现的技术将适用于更现代的语言，如Rust。此外，该项目利用System V ABI（最流行的C语言ABI）为运行在UN*X（类似unix）操作系统上的二进制文件派生完整性策略，并解决在静态恢复控制流图范围内操作的现代代码重用攻击。该奖项反映了美国国家科学基金会的法定使命，并通过使用基金会的知识价值和更广泛的影响审查标准进行评估，被认为值得支持。

Understanding the inner workings of software is essential to protect desktop and mobile computers. Lack of source code for most commercial software makes it necessary to analyze and defend software binaries. However, unlike source code, binaries are devoid of rich semantic information that is crucial for security. Traditional binary analysis and reverse engineering approaches are limited by factors such as obfuscation, choice of compiler and compilation flags, availability of debug information, and underlying instruction set architecture. This project bridges the semantic gap in binary analysis by leveraging the interface between a binary and its environment. Such interactions are mandated by the Application Binary Interface (ABI) specification. The project is based on the insight that ABI adherence confers certain properties to a binary that form a strong basis for reverse engineering. Because ABI adherence is necessary for interoperability, relying on ABI cues for reverse engineering offers an unprecedented level of robustness that is impervious to obfuscation and compilation environment (e.g., optimization). This project utilizes two independent yet complementary mechanisms that leverage language ABIs to vastly improve the state of the art in binary analysis and code-reuse attack detection. It employs a combination of static and dynamic binary analysis approaches in order to derive high-level design information (e.g., object-oriented language class diagrams) from binaries. Such information is central to solving problems in decompilation, software specialization, software similarity detection, etc. While the project evaluates binaries that adhere to Itanium and Microsoft’s MSVC ABIs, the discovered techniques will be applicable to more modern languages such as Rust. Additionally, this project leverages System V ABI, the most popular C language ABI to derive integrity policies for binaries that run on UN*X (unix like) operating systems, and addresses modern code-reuse attacks that operate within the confines of a statically recovered control-flow graph.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.