Function argument number identification in stripped binary under PPC and MIPS instruction set

Xiaokang YIN; Liu LIU; Long LIU; Shengli LIU

doi:10.11959/j.issn.2096-109x.2020047

您当前的位置：

首页 >

文章列表页 >

Function argument number identification in stripped binary under PPC and MIPS instruction set

Papers | 更新时间：2024-06-03

- Function argument number identification in stripped binary under PPC and MIPS instruction set
- Chinese Journal of Network and Information Security Vol. 6, Issue 4, Pages: 95-103(2020)
- 作者机构：
- 作者简介：
- 基金信息：
- DOI：10.11959/j.issn.2096-109x.2020047
  CLC： TP309
- Online First：2020-08，
  
  Published：15 August 2020
- 稿件说明：
移动端阅览
Xiaokang YIN, Liu LIU, Long LIU, et al. Function argument number identification in stripped binary under PPC and MIPS instruction set[J]. Chinese Journal of Network and Information Security, 2020, 6(4): 95-103.
DOI：

Xiaokang YIN, Liu LIU, Long LIU, et al. Function argument number identification in stripped binary under PPC and MIPS instruction set[J]. Chinese Journal of Network and Information Security, 2020, 6(4): 95-103. DOI： 10.11959/j.issn.2096-109x.2020047.

摘要

函数参数个数的识别有助于函数原型的恢复，是进行数据流分析以及其他安全分析的基础。为了提高对函数参数个数识别的准确率，提出一种依据函数调用关系的投票机制来确定函数参数个数的算法——Findargs。Findargs从PPC和MIPS指令集的函数调用特点出发，利用函数调用关系和参数传递分析，识别函数参数的个数，为函数原型的恢复提供帮助。为了评估Findargs的识别效果，选取大型的二进制文件进行了测试，并与radare2进行了对比。实验结果表明，Findargs具有更高的准确率。对于PPC指令集，其准确率达到90.3%；对于MIPS指令集，其准确率为86%。

Abstract

The identification of the number of function argument contributes to the recovery of the function prototype and is the basis for data flow analysis and other security analysis.In order to improve the accuracy of the recognition of the number of function parameters

an algorithm (Findargs) which determines the number of parameters of the function according to the voting mechanism of the function call relationship was proposed.Findargs starts from the function call characteristics of PPC and MIPS instruction set

and uses function call relationship combined with argument pass analysis to identify the number of function arguments

which can help to recover function prototype.In order to evaluate the recognition effect of Findargs

a large binary file was selected and tested it with radare2.The experiments results show that Findargs has higher accuracy

and the accuracy rate for PPC instruction set reaches 90.3%.For MIPS instruction set

the accuracy rate is 86%.

关键词

Keywords

references

DURDEN T . Automated vulnerability auditing in machine code [J ] . Phrack Magazine , 2007 ,64.

ABADI M , BUDIU M , ERLINGSSON Ú , et al . Control-flow integrity principles,implementations,and applications [J ] . ACM Transactions on Information and System Security (TISSEC) , 2009 , 13 ( 1 ):4.

CLAUSE J , LI W , ORSO A . Dytan:a generic dynamic taint analysis framework [C ] // International Symposium on Software Testing and Analysis . 2007 : 196 - 206 .

NEWSOME J , SONG D X . Dynamic taint analysis for automatic detection,analysis,and signature generation of exploits on commodity software [C ] // NDSS . 2005 : 3 - 4 .

STAATS M , PASAREANU C . Parallel symbolic execution for structural test generation [C ] // The 19th International Symposium on Software Testing and Analysis . 2010 : 183 - 194 .

LI H , KIM T , BAT-ERDENE M , et al . Software vulnerability detection using backward trace analysis and symbolic execution [C ] // 2013 International Conference on Availability,Reliability and Security . 2013 : 446 - 454 .

PERKINS J H , KIM S , LARSEN S , et al . Automatically patching errors in deployed software [C ] // The ACM SIGOPS 22nd Symposium on Operating Systems Principles . 2009 : 87 - 102 .

SHACHAM H , . The geometry of innocent flesh on the bone:return-into-libc without function calls (on the x86) [C ] // ACM Conference on Computer and Communications Security . 2007 : 552 - 561 .

SONG D , BRUMLEY D , YIN H , et al . BitBlaze:a new approach to computer security via binary analysis [C ] // International Conference on Information Systems Security . 2008 : 1 - 25 .

SHOSHITAISHVILI Y , WANG R , SALLS C , et al . Sok:(state of) the art of war:offensive techniques in binary analysis [C ] // 2016 IEEE Symposium on Security and Privacy (SP) . 2016 : 138 - 157 .

李珍 , 邹德清 , 王泽丽 , 等 . 面向源代码的软件漏洞静态检测综述 [J ] . 网络与信息安全学报 , 2019 , 5 ( 1 ): 1 - 14 .

LI Z , ZOU D Q , WANG Z L , et al . Survey on static software vul-nerability detection for source code [J ] . Chinese Journal of Network and Information Security , 2019 , 5 ( 1 ): 1 - 14 .

MENG X , MILLER B P . Binary code is not easy [C ] // The 25th International Symposium on Software Testing and Analysis . 2016 : 24 - 35 .

CABALLERO J , JOHNSON N M , MCCAMANT S , et al . Binary code extraction and interface identification for security applications [R ] . California Univ Berkeley Dept of Electrical Engineering and Computer Science , 2009 .

Radare . The official radare2 book (1st edition) [EB ] .

BAO T , BURKET J , WOO M , et al . BYTEWEIGHT:learning to recognize functions in binary code [C ] // The 23rd USENIX Security Symposium . 2014 : 845 - 860 .

段钢 . 加密与解密 (第四版) [M ] . 北京 : 电子工业出版社 , 2018 ： 104 - 105 .

DUAN G . Encryption and decryption (4th edition) [M ] . Beijing : Publishing House of Electronics IndustryPress , 2018 : 104 - 105 .

YIN X , LIU S , LIU L , et al . Function recognition in stripped binary of embedded devices [J ] . IEEE Access , 2018 , 6 : 75682 - 75694 .

HU X , CHIUEH T , SHIN K G . Large-scale malware indexing using function-call graphs [C ] // The 16th ACM Conference on Computer and communications security . 2009 : 611 - 620 .

HASSEN M , CHAN P K . Scalable function call graph-based malware classification [C ] // The Seventh ACM on Conference on Data and Application Security and Privacy . 2017 : 239 - 248 .

HUANG D X , TANG Y , WANG Y , et al . Toward efficient and accurate function‐call graph matching of binary codes [J ] . Con-currency and Computation:Practice and Experience , 2018 , 31 ( 21 ).

KONG D , YAN G . Discriminant malware distance learning on structural information for automated malware classification [C ] // The 19th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining . 2013 : 1357 - 1365 .

Views

502

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

Automatic generation of AppArmor security policies based on large language models

Automated vulnerability discovery method for 5G core network protocol

Multi-feature fusion malware detection method based on attention and gating mechanisms

Classified risk assessment method of Android application based on multi-factor clustering selection

Analysis of DoS attacks on Docker inter-component stdio copy

Related Author

LIU Xing

CHEN Peng

WU Yue

QIAN Xin

LIU Shaojun

SHA Yitian

Peixiang WU

Zhilong ZHANG

Related Institution

State Grid Nanjing Power Supply Company

Nanjing Nanrui Information and Communication Technology Limited Company

Zhejiang University NGICS Platform

School of Cyber Science and Technology, Zhejiang University

School of Cyber Engineering, Xidian University

⁰