Intermission Binary parsing in ma foo k loc

Intermission

Binary parsing in ma foo k_ loc _ dynamic instrumentation, debugger, static binary analysis tools, malware analysis, binary editor/rewriter, … The Deconstruction of Dyninst 2

Familiar territory Richard L. Sites, Anton Chernoff, Matthew B. Kirk, Maurice P. Marks, and Scott G. Robinson. Binary translation. 1993. Amitabh Srivastava and Alan Eustace. ATOM: a system for building customized program analysis tools. 1994. Barton Miller, Jeffrey Hollingsworth, and Mark Callaghan. Dynamic Program Instrumentation for Scalable Performance Tools. 1994. Cristina Cifuentes and K. John Gough. Decompilation of binary programs. 1995 Henrik. Theiling. Extracting safe and precise control flow from binaries. 2000. Benjamin Schwarz, Saumya Debray, and Gregory R. Andrews. Disassembly of executable code revisited. 2002 J. Troger and C. Cifuentes. Analysis of virtual method invocation for binary translation. Christopher 2002. Kruegel, William Robertson, Fredrik Valeur, and Giovanni Vigna. Static disassembly of obfuscated binaries. 2004. Laune C. Harris and Barton P. Miller. Practical analysis of stripped binary code. 2005. Ramkumar Chinchani and Eric van den Berg. A fast static analysis approach to detect exploit code inside network flows. 2005. Nathan Rosenblum, Xiaojin Zhu, Barton P. Miller, and Karen Hunt. Learning to analyze binary computer code. 2008. 3

We’ve been down this road… the DYNINST binary parser recursive traversal parsing “gap” parsing heuristics non-contiguous functions Ø code sharing Ø non-returning functions Ø Ø Ø preamble scanning handles stripped binaries The Deconstruction of Dyninst probabilistic code models learn to recognize function entry points Ø very accurate gap parsing Ø 4

What makes a parsing component? 2 1 abstraction 101 11 0 1 01010 0 1 010 100101 0 0 0 1 10 10001 1 1 0 1 10 01101 1 1 0 0 1 10 1010 1 1 0 0 1 101 0 1 010 1 001 Binary code source 1100 functions Parsing API Instruction. API 0101 simple, intuitive representation edges blocks Symtab. API 1011 0 3 platform independence supported by previous Dyninst components The Deconstruction of Dyninst 5

Flexible code sources Parser code source requirements: code location access to code bytes unsigned char * buf a few (optional) facts pointer width function hints & names 41 56 49 89 fe 41 55 … PLT code main external linkage data foo bar ba z The Deconstruction of Dyninst a binary code object 6

Code source contract bool is. Valid. Address bool is. Executable. Address void * get. Ptr. To. Instruction void * get. Ptr. To. Data unsigned get. Address. Width bool is. Code bool is. Data Address code. Offset Address code. Length Nine mandatory methods Symtab. API implementation in 232 lines (including optional hints, function names) Any binary code object that can be memory mapped can be parsed The Deconstruction of Dyninst 7

Simple control flow interface Functions Blocks contain Edges joined by in edges start addr. type src targ extents end addr. out edges The Deconstruction of Dyninst 8

Views of control flow Walking a control flow graph while(!work. empty()) { Block *b = work. pop(); /* do something with b */ g startin here edgeiter eit = b->out(). begin(); while(eit != b->out(). end()) { work. push(*eit++); } What if we only want intraprocedural edges? } The Deconstruction of Dyninst 9

Edge predicates Walking a control flow graph while(!work. empty()) { Block *b = work. pop(); /* do something with b */ Intra. Proc pred; edgeiter eit = b->out(). begin(&pred); while(eit != b->out(). end()) { work. push(*eit++); } } The Deconstruction of Dyninst Edge Predicates Tell iterator whether Edge argument should be returned Composable (and, or) Examples: Intraprocedural Ø Single function context Ø Direct branches only Ø 10

Extensible CFG objects Parse. API Function Simple, only need to represent control flow graph Dyninst image_func Complex, handles instrumentation, liveness, relocation, etc. Function Special callback points during parsing Factory interface for CFG objects custo m factory parse unres. Branch. Notify(insn) mkfunc() image_func [derived class does stuff] parse The Deconstruction of Dyninst (Function*) image_func parse r 11

What’s in the box? * box to be released soon Binary Parser Ø recursive descent parsing Ø speculative gap parsing Ø cross platform: x 86, x 86 -64, PPC, IA 64, SPARC Control Flow Graph Representation Ø graph interface Ø extensible objects for easy tool integration Ø exports Dyninst Instruction. API interface The Deconstruction of Dyninst Symtab. API-based Code Source Ø cross-platform Ø supports ELF, PE, XCOFF formats 12

Status conception code refactoring interface design Dyninst re-integration (major test case) other major test case: compiler provenance (come tomorrow!) The Deconstruction of Dyninst 13