Stack layout transformation: Towards diversity for securing binary programs

MagBox: Keep the risk functions running safely in a magic box

We present a novel approach to automatically recover information about the address space layout of remote processes in the presence of Address Space Layout Randomization (ASLR). Our system, dubbed Sleak, performs static analysis and symbolic execution of binary executable programs, and identifies program paths and input parameters leading to partial (i.e., only a few bits) or complete (i.e., the whole address) information disclosure vulnerabilities, revealing addresses of known objects of the target service or application. Sleak takes, as input, the binary executable program, and generates a symbolic expression for each program output that leaks information about the addresses of objects, such as stack variables, heap structures, or function pointers. By comparing these expressions with the concrete output of a remote process executing the same binary program image, our system is able to recover from a few bits to whole addresses of objects of the target application or service. Discovering the address of a single object in the target application is often enough to guess the layout of entire sections of the address space, which can be leveraged by attackers to bypass ASLR.

In software security and malware analysis, researchers often need to directly manipulate binary program – benign or malicious – without source code. A useful pair of binary manipulation primitives are binary functional component extraction and embedding, for extracting a functional component from a binary program and for embedding a functional component in a binary program, respectively. Such primitives are applicable to a wide range of security scenarios such as legacy program hardening, binary semantic patching, and malware function analysis. Unfortunately, existing binary rewriting techniques are inadequate to support binary function carving and embedding. In this paper, we present bistro, a system that supports these primitives without symbolic information, relocation information, or compiler support. Bistro preserves functional correctness of both the extracted functional component and the stretched binary program (with the component embedded) by patching them in a systematic fashion. We have implemented an IDA Pro-based prototype of Bistro and evaluated it using real-world Windows software. Our results show the effectiveness of Bistro, with each stretched binary incurring low time and space overhead. Furthermore, we demonstrate Bistro’s capabilities in various security applications.

International audience

Since modern software systems are large and complex, appropriate abstractions of their structure are needed to make them more understandable and, thus, easier to maintain. Software clustering techniques are useful to support the creation of these abstractions by producing architectural-level views of a system's structure directly from its source code. This paper examines the Bunch clustering system which, unlike other software clustering tools, uses search techniques to perform clustering. Bunch produces a subsystem decomposition by partitioning a graph of the entities (e.g., classes) and relations (e.g., function calls) in the source code. Bunch uses a fitness function to evaluate the quality of graph partitions and uses search algorithms to find a satisfactory solution. This paper presents a case study to demonstrate how Bunch can be used to create views of the structure of significant software systems. This paper also outlines research to evaluate the software clustering results produced by Bunch.

As modern software system is growing in size and complexity, the customer expectations for software quality have become higher. In the past, many software reliability growth models (SRGMs) were proposed and they are helped to evaluate the quality of developed software. It is worth noting that some of SRGMs can be used to model the fault detection process (FDP) and the fault correction process (FCP) through an infinite server queueing (ISQ) system or a finite server queueing (FSQ) system. However, it can also be found that most ISQ and FSQ models were developed on a first come first served basis. In this paper, we propose to use the queueing-based simulations to describe the behavior of FCP and assess the software reliability instead of using model-based approaches. Our proposed queueing-based simulation techniques and simulation procedures will be able to thoroughly investigate the FCP and easily provide system performance information estimated based on the staffing level, the average response time, and the average waiting time. Numerical examples based on three real failure data are given and discussed. Our experiments show that the proposed simulation procedures obtain a good prediction capability for software reliability. We expect that the proposed methods can provide effective information for software developing management and help decision makers in resource allocation and cost control.

In this paper, CAEG (Crash-based Automatic Exploit Generation) is proposed to automatically generate binary program exploits based on known crash inputs. In CAEG we analyze the input causing a program crash and address two main challenges: how to reproduce the crash state and how to automatically generate control flow hijacking exploits. Firstly, a path-oriented algorithm is proposed to find the crash path using symbolic execution techniques by treating the crash input as a symbolic value. Secondly, we summarize the principle of multiple control flow hijacking vulnerability exploits. In addition, consider bypassing the vulnerability mitigation mechanism by using springboard instructions to bypass Address Space Layout Randomization (ASLR) and return-to-libc to bypass Non-executable bit (NX). We tested 11 open source software with vulnerabilities (8 from the test sets of AEG and MAYHEM, and 3 from the CVE and EDB vulnerability repositories). The experimental results show that our scheme is more efficient than AEG and MAYHEM.

The ubiquity of Web applications has led to an increased focus on the development of attacks targeting these applications. One particular type of attack that has recently become prominent is the SQL injection attack. SQL injection attacks can potentially result in unauthorized access to confidential information stored in a backend database. In this paper we describe an anomaly based approach which utilizes the character distribution of certain sections of HTTP requests to detect previously unseen SQL injection attacks. Our approach requires no user interaction, and no modification of or access to, either the backend database or the source code of the web application itself. Our practical results suggest that the model proposed in this paper is superior to existing models at detecting SQL injection attacks. We also evaluate the effectiveness of our model at detecting different types of SQL injection attacks.

A binary program is a set of binary data and operations on the data. In binary translation, operations on the source machine will be transplanted to the target machine. Also, the data which the operations depend on should be migrated to the target machine, so as to ensure the complete consistency of the data accessed by the transplanted target codes and the data accessed by the source codes. Firstly, the method is presented in this paper to convert the access to the data on the source machine to the access to the corresponding data on the target machine for the user-defined procedure, and to ensure the correctness of the accessed data on the target machine in the meanwhile. Then, for the binary translation from x64 architecture to RISC architecture, the data recovery method based on semantic mapping and balanced stack frame is proposed. Also, problems in data recovery for the user-defined procedure are solved by the proposed method.

The use of Software of Unknown Provenance (SOUP) in the development of modern information systems has become widespread and is difficult to avoid. Unfortunately, important properties of the software, such as critical security properties, cannot be assured with SOUP making the use of SOUP problematic. In this paper we summarize Kevlar, a comprehensive approach to enhancing the security of SOUP. Kevlar operates with access only to the binary program, i.e., no source code or other development documentation is required, and the current implementation supports Intel X86 software running on Ubuntu platforms.

This paper describes a novel technique to defend binaries against intra-frame stack-based attacks, including overflows into local variables, when source code is unavailable. The technique infers a specification of a function’s stack layout, i.e., variable locations and boundaries, and then seeks to apply a combination of transformations, including variable reordering, random-sized padding between variables, and placement of canaries. To overcome the imprecision of static binary analysis, yet be as aggressive as possible in the transformations applied to the stack layout, the technique is speculative. A stack frame is aggressively transformed based on static analysis, and the validity of inferred stack layout is assessed through regression testing. If a transformation changes a program’s semantics because of imprecision in the inference of the stack layout, a less aggressive layout is inferred until the transformed program passes the supplied regression tests. We present an overview of the technique and preliminary results of its feasibility and security effectiveness.

Modern software systems are increasingly configurable. Conditional compilation based on C preprocessor directives (i. e., #ifdefs) is a popular variability mechanism to implement this configurability in source code. Although C preprocessor usage has been subject to repeated criticism, with regard to variability implementation, there is no thorough understanding of which patterns are particularly harmful. Specifically, we lack empirical evidence of how frequently reputedly bad patterns occur in practice and which negative effect they have. For object-oriented software, in contrast, code smells are commonly used to describe source code that exhibits known design flaws, which negatively affect understandability or changeability. Established code smells, however, have no notion of variability. Consequently, they cannot characterize flawed patterns of variability implementation. The goal of my research is therefore to create a catalog of variability-aware code smells. I will collect empirical proof of how frequently these smells occur and what their negative impact is on understandability, changeability, and fault-proneness of affected code. Moreover, I will develop techniques to detect variability-aware code smells automatically and reliably.

Text steganography helps protect citizens' freedom of speech and privacy in cyberspace by constructing innocent-looking texts to evade censorship and surveillance. Existing methods, especially generative ones, rely on delicate character-level manipulations, making them vulnerable to failure even under minor alterations. This paper introduces a novel framework that shifts from character-level to semantic space-based information hiding, which greatly improves improving robustness and reliability. The framework comprises three phases: preparation, where a stable semantic space is designed for hiding information; embedding, where a reversible codebook maps binary messages to semantemes via semantic encoding and source coding; and synthesis, where large language models act as multi-agent systems to produce stegotexts that preserve semantic consistency. Extensive experiments show that our method matches state-of-the-art techniques in hiding capacity and text quality, while significantly surpassing them in robustness-achieving at least an 81.2% higher correct message rate under three types of attacks. These findings highlight the strong potential of semantic-based text steganography.

Implementation of an effective dynamic concolic execution framework for analyzing binary programs

The problem of consistency between software requirements and their implementation in source code becomes critically important as the scale and complexity of modern software systems increase, since the absence of reliable traceability links often leads to incomplete requirement implementation, complicates code maintenance, and hinders the verification of system correctness. Manual generation of traceability matrices is a labour-intensive and error-prone process, especially in large projects. The use of large language models opens up new opportunities for automating this process, as such models are capable of reflecting deep semantic relationships between text requirements and software code fragments. The article proposes a method for identifying traceability links between requirements and software code using transformer models of large language systems. The proposed approach is based on converting text artefacts into vector representations using CodeBERT, SBERT, and TF-IDF models, followed by calculating semantic similarity to automatically identify potential connections. The method covers such stages as data preparation, embedding generation, search for relevant fragments, and evaluation of the results obtained. The experiments were conducted on the MSR-2021 dataset, which contains real traceability links for several projects. The obtained results demonstrated the advantage of CodeBERT over traditional approaches (TF-IDF, SBERT): the method achieves accuracy of up to 0.85 and an F1-score of up to 0.50, depending on the search depth, which represents strong performance for automated information retrieval and ranking tasks. The study additionally confirmed the importance of considering the structural context of the code and showed the influence of the Top-K parameter on the balance between recall and precision. The results indicate that integrating LLM-based models significantly improves the level of automation, consistency, and quality of requirements traceability in modern software development environments.