Sound Control Flow Graph Extraction from Incomplete Java Bytecode Programs

Many data-driven software engineering tasks such as discovering programming patterns, mining API specifications, etc., perform source code analysis over control flow graphs (CFGs) at scale. Analyzing millions of CFGs can be expensive and performance of the analysis heavily depends on the underlying CFG traversal strategy. State-of-the-art analysis frameworks use a fixed traversal strategy. We argue that a single traversal strategy does not fit all kinds of analyses and CFGs and propose bespoke control flow analysis (BCFA). Given a control flow analysis (CFA) and a large number of CFGs, BCFA selects the most efficient traversal strategy for each CFG. BCFA extracts a set of properties of the CFA by analyzing the code of the CFA and combines it with properties of the CFG, such as branching factor and cyclicity, for selecting the optimal traversal strategy. We have implemented BCFA in Boa, and evaluated BCFA using a set of representative static analyses that mainly involve traversing CFGs and two large datasets containing 287 thousand and 162 million CFGs. Our results show that BCFA can speedup the large scale analyses by 1%-28%. Further, BCFA has low overheads; less than 0.2%, and low misprediction rate; less than 0.01%.

Graph models have been useful abstraction for examining the programmer's perspective of the static structure of imperative programs. A number of Graph models referring to control flow and data dependencies have appeared in the literature. The primary objective of this research is to develop a more general graph-theoretic model for describing programs written in arbitrary imperative languages and to compute a structural measure based on this abstraction. The proposed model is a synthesis of the control flow graph and the data dependency graph. This new unified abstraction, called the Generalized Program Graph (GPG), is structurally equivalent to the string from of a program. However, because of its graph structure, the new model is better suited for structural analysis of a program than original string form.

Low-level languages like C/C++ are widely used in various applications for their performance and flexibility. Unfortunately, these languages are prone to memory corruption vulnerabilities, leading to control-flow hijacking attacks. Control flow integrity (CFI) is a general principle to enforce run-time control flow of a program to a pre-computed control-flow graph (CFG). While the traditional context-insensitive CFI falls short in protecting critical control transfers, recent context-sensitive CFI research shows promising improvements but has various limitations. We present Control Flow Integrity with Look Back (CFI-LB), a call-site sensitive CFI in which a conventional source-target control transfer is strengthened by a look back into its call-sites (return addresses). CFI-LB features the adaptive call-site sensitivity in which each indirect call has its own level of sensitivity and the multi-scope CFG to improve the security even if a precise context-sensitive static CFG is not available, especially for large programs such as GCC and NGINX. One of the CFGs is constructed by our localized concolic execution, which significantly extends the dynamic CFG with very low false positives. In addition, CFI-LB is the first CFI system explicitly designed to protect its reference monitors from race conditions. We have built a prototype of CFI-LB. The evaluation with SPEC CPU2006 benchmarks and NGINX indicates that CFI-LB has a low-performance overhead (less than 5% on average for the full protection) while increasing the security.

The software development process often requires the use of tools that the developers did not write themselves, such as a compiler. Additionally, when security researchers perform tasks such as binary analysis and reverse engineering disassembly and decompiler tools may be used which the researchers did not develop themselves. Yet in all of these cases, there is inherent trust placed in the tools that are being used for these tasks without thought to whether or not that trust is valid. In this work, we provide an overview of what has already been done in the realms of verification and establishment of this trust as well as show our contribution to this area. Our approach is taken through an algorithm that allows us to validate or invalidate that trust by comparing the control flow graphs (CFGs) for a piece of source code to the corresponding CFG for the disassembled binary. This is done by putting the source CFG through a series of program functionality preserving transforms that implement different control structure compiler optimizations. Then we are able to make use of a graph isomorphism algorithm to determine whether or not the two CFGs are isomorphic and determine if the trust is valid. We evaluate the effectiveness of this algorithm against the XINU codebase and report our results.

Control-Flow Integrity (CFI) enforces a control-flow graph (CFG) to limit attackers' ability to manipulate runtime control flow. CFI variations, enforcing different CFGs, achieve different degrees of attack surface reduction. To compare the security strength of different CFI policies, measuring the remaining attack surface is critical but challenging. Therefore, we propose MazeRunner, a framework that quantitatively estimates the attack surface of a CFI-hardened program. Methodology-wise, it takes a program's CFG, an attack model, and a security-violation policy as input to discover risky program points by an attack-aware data dependency tracking algorithm. Risky program points and the CFG are used to compute a metric for the remaining attack surface. We evaluate MazeRunner with 3 CFG types, 3 attack models, and 4 security-violation policies against 13 realistic benchmarks, and demonstrate that the new metric achieves higher precision than traditional metrics while maintaining completeness.

Assessing the understandability of source code remains an elusive yet highly desirable goal for software developers and their managers. While many metrics have been suggested and investigated empirically, the McCabe cyclomatic complexity metric (CC) - which is based on control flow complexity - seems to hold enduring fascination within both industry and the research community despite its known limitations. In this work, we introduce the ideas of Control Flow Patterns (CFPs) and Compressed Control Flow Patterns (CCFPs), which eliminate some repetitive structure from control flow graphs in order to emphasize high-entropy graphs. We examine eight well-known open source Java systems by grouping the CFPs of the methods into equivalence classes, and exploring the results. We observed several surprising outcomes: first, the number of unique CFPs is relatively low, second, CC often does not accurately reflect the intricacies of Java control flow, and third, methods with high CC often have very low entropy, suggesting that they may be relatively easy to understand. These findings challenge the widely-held belief that there is a clear-cut causal relationship between CC and understandability, and suggest that CC and similar measures need to be reconsidered as metrics for code understandability.

Elements form a linear queue where head points to the front, next to the subsequent element, and tail to the back of the queue Figure 1: Type graph for CPM’s configurations as class diagram with constraints, where we assume disjoint finite sets of variable names (p1, . . . ,x1 . . . ), and reference names (r1, . . . ); let Meth be a finite set of method names, and Z be the set of integer numbers, B of Booleans; the cardinality of association edges is if not noted otherwise; the different regions highlight the different modules of the model each local processor advances as far as possible. Note that the walking of the control-flow graph and the scheduler are generic, i.e. represented by a set of GTS rules independent of the SCOOP program. We refer to [26] for the full formal model directly represented as GTS (that can be browsed and simulated with GROOVE). Modularity of CPM Configurations of CPM, i.e. global states of the system, can be partitioned into four main parts, which are also visible in Figure 1: (i) a representation of the underlying SCOOP program in the form of a control-flow graph; (ii) a system of concurrently running processors, each one possibly handling a request; these processors represent the system state; (iii) a waiting queue for each processor that stores pending requests; (iv) local memory state for each processor. The control flow component can be derived directly from the original CoreSCOOP program’s control flow graph (at a pre-compilation step) and its structure does not dynamically change, contrary to the state of the run-time environment (processors, queues, data). This partitioning is also mirrored by the GTS’s underlying rules that treat the walking of the control flow graph separately from the queue’s policies, the management of the memory, and global scheduling. The fixed simple interfaces (in form of the model components’ loose coupling due to the typed associations queue, handler, currentState, and requestType) between these modules allow us to plug in different behaviours for each module, e.g. different queueing semantics. Thus we can either adapt different existing SCOOP semantics (e.g. FIFO queues versus queues of queues [29]) or directly apply abstraction mechanisms in the context of verification (e.g. a counting abstraction of the queue’s content, or predicate abstraction for the data) by small modular changes to the underlying rules. Furthermore, the global abstract scheduling rules can be parameterised in this way, e.g. to include different kinds of garbage collection in the global scheduler or different rule prioritisations that keep the state space small, such as always preferring to terminate processors that are currently in a final state. i : ti l i it t i t , i j i t it t i l , . . . , . . . , , . . . ; l t t it t t , t t i t , l ; t i lit i ti i i t t t i ; t i t i i li t t i t l t l 38 Towards Practical Graph-Based Verification for an Object-Oriented Concurrency Model 4 Simulating CPM in GROOVE We realised CPM—our run-time model for CoreSCOOP—in GROOVE, an established tool for simulating and analysing GTS-based semantics. This section describes how we approached and achieved this task. First, we justify our choice of GROOVE, and then show (by example) how CPM configurations, rules, and rule applications are represented in the tool. Finally, we discuss the issue of CPM’s soundness. The GTS Tool GROOVE We chose GRaphs for Object-Oriented VErification (GROOVE) [14, 13] as our platform to implement and analyse the CPM models. Most existing GTS tools are in theory expressive enough to cover CPM. GROOVE however was already applied for the analysis of (non-concurrent) object-oriented programs in Java [24]. Furthermore, GROOVE contains a (finite-state) model checker that has proven sufficient for the analysis and verification of dynamic state systems [7, 18]. As reported in [31], GROOVE can typically handle systems with up to 4 million states, which should leave enough room for our first experiments. Finally, GROOVE convinced us with a gentle learning curve, its ease of adaption and extension to our needs, as well as its active development community. Representing CPM Configurations in GROOVE CPM configurations are represented in GROOVE quite straightforwardly, with control-flow, system state, waiting queue(s), and memory state (as in the type graph of Figure 1) all encoded in the same graph. 8 Towards Practical Graph-Based Verification for an Object-Oriented Concurrency Model A. Heusner, C.M. Poskitt, C. Corrodi, and B. Morandi 9 Data_Var name = v_3 value = 1 State Ref_Var name = r_1 Action assign var = v_1 State Data_Var name = v_1 value = 1

Programmable Logic Controller (PLC) programs are vulnerable to tampering attacks with addition of malware, which can substantially cause severe physical destructions. In order to solve the problems, We propose a static analysis method of Binary PLC programs for the detection of PLC malwares. Firstly, disassemble the binary program into STL program. Secondly, constructed the control flow graph of STL program according to the characteristics of STL language. Thirdly, generate the program execution paths according to traverse the control flow graph and analysis loop paths. Finally the PLC program output and input mapping relations are obtained based on the program execution paths. The experiment shows that the proposed method has achieved the analysis of PLC programs and get each path predicate and the mapping relation between output and input.

Side-channels in software are an increasingly significant threat to the confidentiality of private user information, and the static detection of such vulnerabilities is a key challenge in secure software development. In this paper, we introduce a new technique for scalable detection of side- channels in software. Given a program and a cost model for a side-channel (such as time or memory usage), we decompose the control flow graph of the program into nested branch and loop components, and compositionally assign a symbolic cost expression to each component. Symbolic cost expressions provide an over-approximation of all possible observable cost values that components can generate. Queries to a satisfiability solver on the difference between possible cost values of a component allow us to detect the presence of imbalanced paths (with respect to observable cost) through the control flow graph. When combined with taint analysis that identifies conditional statements that depend on secret information, our technique answers the following question: Does there exist a pair of paths in the program's control flow graph, differing only on branch conditions influenced by the secret, that differ in observable side-channel value by more than some given threshold? Additional optimization queries allow us to identify the minimal number of loop iterations necessary for the above to hold or the maximal cost difference between paths in the graph. We perform symbolic execution based feasibility analyses to eliminate control flow paths that are infeasible. We implemented our techniques in a prototype, and we demonstrate its favourable performance against state-of-the-art tools as well as its effectiveness and scalability on a set of sizable, realistic Java server-client and peer-to-peer applications.

Piracy is a persistent headache for software companies that try to protect their assets by investing both time and money. Program code obfuscation as a sub-field of software protection is a mechanism widely used toward this direction. However, effectively protecting a program against reverse-engineering and tampering turned out to be a highly non-trivial task that still is subject to ongoing research. Recently, a novel obfuscation technique called Control Flow Linearization (CFL) is gaining ground. While existing approaches try to complicate analysis by artificially increasing the control flow of a protected program, CFL takes the exact opposite direction: instead of increasing the complexity of the corresponding Control Flow Graph (CFG), the discussed obfuscation technique decreases the amount of nodes and edges in the CFG. In an extreme case, this means that the obfuscated program degenerates to one singular basic block, while still preserving its original semantics. In this paper, we present the DeMovfuscator, a system that is able to accurately break CFL obfuscation. DeMovfuscator can reconstruct the control flow, making only marginal assumptions about the execution environment of the obfuscated code. We evaluate both the performance and size overhead of CFL as well as the feasibility of our approach to deobfuscation. Overall, we show that even though CFL sounds like an ideal solution that can evade the state of the art deobfuscation approaches, it comes with its own limitations.

This paper explores the problem of identifying malicious code sections in applications for the Android. A method for analyzing Android applications is proposed, based on applying of static analysis using control flow graphs and data flow graphs. The paper formally describes the dependency relationships that are used to construct graphs, and also describes an algorithm that allows to identify malicious sections of code using the received graphs. The results of an experimental evaluation of the effectiveness of the proposed method are presented, demonstrated a high probability of detecting malicious portions of the code of Android applications.

Vulnerabilities may exist in large amount of binary executables. In order to provide memory access protection, stack layout randomization was proposed to disable exploits and protect binary executables without changing the semantic of original programs. With IDA Pro, control flow graph and stack frame graph were established, with Virtual Debug, targets of indirect call and indirect jump in one single trace were fixed, with Critical Data Extractor, critical data was extracted from IDA Pro, with Binary File Rewrite Engine, binary file was rewritten without changing original semantic. The result indicates that the method named stack layout randomization could make binary executables immune from majority of buffer overflow attacks and should get further investigation and improvement.

Droid-MCFG: Android malware detection system using manifest and control flow traces with multi-head temporal convolutional network

To reason about programs, dynamic optimizers and analysis tools use sampling to collect a dynamic call graph (DCG). However, sampling has not achieved high accuracy with low runtime overhead. As object-oriented programmers compose increasingly complex programs, inaccurate call graphs will inhibit analysis and optimizations. This paper demonstrates how to use static and dynamic control flow graph (CFG) constraints to improve the accuracy of the DCG. We introduce the frequency dominator (FDOM), a novel CFG relation that extends the dominator relation to expose static relative execution frequencies of basic blocks. We combine conservation of flow and dynamic CFG basic block profiles to further improve the accuracy of the DCG. Together these approaches add minimal overhead (1%) and achieve 85% accuracy compared to a perfect call graph for SPEC JVM98 and DaCapo benchmarks. Compared to sampling alone, accuracy improves by 12 to 36%. These results demonstrate that static and dynamic control-flow information offer accurate information for efficiently improving the DCG.KeywordsBasic BlockCorrection AlgorithmControl Flow GraphCall GraphCall SiteThese keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.

Managing communication is a difficult problem in distributed memory compilation. When the exact data to be communicated cannot be determined at compile time, communication optimizations can be performed by runtime routines which generate schedule for communication. This leads to two optimization problems: placing communication so that data once communicated can be reused if possible and placing schedule calls so that the result of runtime preprocessing can be reused for communicating as many times as possible. In large application codes, computation and communication is spread across multiple subroutines, so acceptable performance cannot be achieved without performing these optimizations across subroutine boundaries. In this paper, we present an Interprocedural Analysis Framework for these two optimization problems. Our optimizations are based on a program abstraction we call Control & Call Flow Graph. This extends the call graph abstraction by storing the control flow relations between various call sites within a subroutine. We show how communication placement and schedule call placement problems can be solved by data-flow analysis on Control & Call Flow Graph structure.