一句话：Egalito 利用 stripped x86_64/ARM64 二进制元数据实现完整反汇编与无布局约束的二进制重编译。
全面分析可执行代码并快速进行变换，往往需要直接在二进制上操作，以支持性能剖析、安全加固和体系结构适配；但反汇编困难，已有工作依赖进程虚拟机动态翻译或低效的二进制补丁。Egalito 重编译器利用当前 stripped x86_64 与 ARM64 二进制中已有的元数据生成完整反汇编，并允许任意修改，不受原二进制布局约束。它采用布局无关的中间表示，低层到足以可预测地重新生成代码，同时支持双层高层表示以进行复杂分析。作者实现了九种二进制工具，包括 Egalito 自变换的连续代码随机化，以及用软件模拟未来硬件中的控制流完整性。评估在大量 Debian 包上进行，对 867 个可执行文件和库中的 99.9% 完成完整分析，149 个适用 Debian 包多数通过全部测试；在 SPEC CPU 2006 上，二进制优化还带来 1.7% 的性能加速。
For comprehensive analysis of all executable code, and fast turn-around time for transformations, it is essential to operate directly on binaries to enable profiling, security hardening, and architectural adaptation. Disassembling binaries is difficult, and prior work relies on a process virtual machine to translate references on the fly or inefficient binary code patching. Our Egalito recompiler leverages metadata present in current stripped x86_64 and ARM64 binaries to generate a complete disassembly, and allows arbitrary modifications that may affect program layout without any constraints from the original binary. We utilize our own layout-agnostic intermediate representation, which is low-level enough to make the regeneration of output code predictable, yet supports a dual high-level representation for sophisticated analysis. We demonstrate nine binary tools including a novel continuous code randomization technique where Egalito transforms itself, and software emulation of the control-flow integrity in upcoming hardware. We evaluated Egalito on a large set of Debian packages, completely analyzing 99.9% of a selection of 867 executables and libraries; a majority of 149 applicable Debian packages pass all tests under Egalito. On SPEC CPU 2006, thanks to our binary optimizations, Egalito actually observes a 1.7% performance speedup.
@inproceedings{paperbot5428,
title = {Egalito},
author = {David Williams-King and Hidenori Kobayashi and Kent Williams-King and Graham Patterson and Frank Spano and Yu Jian Wu and Junfeng Yang and Vasileios P. Kemerlis},
booktitle = {ASPLOS},
year = {2020},
doi = {10.1145/3373376.3378470}
}