一句话：提出首个基于行为相似性的统计方法，从剥离二进制中重建类层次。
本文研究面向对象二进制逆向工程中的类层次重建问题：在符号被剥离的二进制中恢复继承关系。现有方法依赖父构造函数调用等结构信息，但这类信息未必可用，常导致层次缺失或重建失败。作者提出首个基于行为相似性的静态统计方法，用统计语言模型（SLM）刻画每个类型的行为，并以 SLM 间的 Kullback-Leibler 散度度量类型两两相似度，再将相似度提升为最可能的类层次。该方法在工具 ROCK 中实现，用于自动重建多个真实 stripped C++ 二进制程序的类层次。结果表明，ROCK 得到的层次显著比仅用结构分析更准确。
We address a fundamental problem in reverse engineering of object-oriented code: the reconstruction of a program's class hierarchy from its stripped binary. Existing approaches rely heavily on structural information that is not always available, e.g., calls to parent constructors. As a result, these approaches often leave gaps in the hierarchies they construct, or fail to construct them altogether. Our main insight is that behavioral information can be used to infer subclass/superclass relations, supplementing any missing structural information. Thus, we propose the first statistical approach for static reconstruction of class hierarchies based on behavioral similarity. We capture the behavior of each type using a statistical language model (SLM), define a metric for pairwise similarity between types based on the Kullback-Leibler divergence between their SLMs, and lift it to determine the most likely class hierarchy. We implemented our approach in a tool called ROCK and used it to automatically reconstruct the class hierarchies of several real-world stripped C++ binaries. Our results demonstrate that ROCK obtained significantly more accurate class hierarchies than those obtained using structural analysis alone.
DOI 原文 ·
@inproceedings{paperbot4281,
title = {Statistical Reconstruction of Class Hierarchies in Binaries},
author = {Omer Katz and Noam Rinetzky and Eran Yahav},
booktitle = {ASPLOS},
year = {2018},
doi = {10.1145/3173162.3173202}
}