一句话：提出首个 IR 级补丁存在性检测方法 React，通过符号执行提取特征并用 SMT 判定语义等价。
二进制补丁存在性检测用于确认二进制文件是否已修复已知漏洞，但源码与二进制之间存在语义鸿沟，且补丁往往微小隐蔽，检测困难。本文提出 React，首个在 IR 层进行的补丁存在性检测方法。它分别利用源码编译得到的 IR 与从二进制提升得到的 IR，通过符号执行提取返回值、条件、函数调用和内存存储四类特征；随后对源码特征进行精炼与排序，并最终匹配这些特征，借助 SMT 求解器在语义层检查特征等价性，从而判定补丁是否存在。摘要未给出具体实验数据与评估指标。
Patch presence test is critical in software security to ensure that binary files have been patched for known vulnerabilities. It is challenging due to the semantic gap between the source code and the binary, and the small and subtle nature of patches. In this paper, we propose React, the first patch presence test approach on IR-level. Based on the IR code compiled from the source code and the IR code lifted from the binary, we first extract four types of feature (return value, condition, function call, and memory store) by executing the program symbolically. Then, we refine the features from the source code and rank them. Finally, we match the features to determine the presence of a patch with an SMT solver to check the equivalence of features at the semantic level.
DOI 原文 ·
@inproceedings{paperbot8431,
title = {REACT: IR-Level Patch Presence Test for Binary},
author = {Qi Zhan and Xing Hu and Xin Xia and Shanping Li},
booktitle = {ASE},
year = {2024},
doi = {10.1145/3691620.3695012}
}