一句话：通过恢复细粒度内存布局并比较通过/失败执行，定位二进制漏洞。
二进制代码在编译后丢失数组边界等程序语义，导致难以判断内存访问是否越界，给漏洞定位带来挑战。本文提出基于内存布局恢复的漏洞定位方法。首先收集若干通过执行和一次失败执行；然后依据内存寻址模型，为这些执行恢复细粒度的内存布局，以重建程序语义。以通过执行中恢复的内存布局为参照，在失败执行中进行内存布局识别与比较，从而定位漏洞。实验表明，该方法能在25个DARPA CGC程序中定位24个（96%），并可将5个Linux程序中的453次崩溃按其根因有效分为19组。
Locating vulnerabilities is an important task for security auditing, exploit writing, and code hardening. However, it is challenging to locate vulnerabilities in binary code, because most program semantics (e.g., boundaries of an array) is missing after compilation. Without program semantics, it is difficult to determine whether a memory access exceeds its valid boundaries in binary code. In this work, we propose an approach to locate vulnerabilities based on memory layout recovery. First, we collect a set of passed executions and one failed execution. Then, for passed and failed executions, we restore their program semantics by recovering fine-grained memory layouts based on the memory addressing model. With the memory layouts recovered in passed executions as reference, we can locate vulnerabilities in failed execution by memory layout identification and comparison. Our experiments show that the proposed approach is effective to locate vulnerabilities on 24 out of 25 DARPA’s CGC programs (96%), and can effectively classifies 453 program crashes (in 5 Linux programs) into 19 groups based on their root causes.
@inproceedings{paperbot5154,
title = {Locating vulnerabilities in binaries via memory layout recovering},
author = {Haijun Wang and Xiaofei Xie and Shang-Wei Lin and Yun Lin and Yuekang Li and Shengchao Qin and Yang Liu and Ting Liu},
booktitle = {FSE},
year = {2019},
doi = {10.1145/3338906.3338966}
}