一句话：提出 SJA，用抽象域跟踪代码指针结构并结合边界分析，实现健全可扩展的二进制跳转表分析，显著降低漏报与错误率。
二进制代码中的间接跳转常来自跳转表，解析这些跳转对构建完整控制流图至关重要，也是二进制加固、插桩、漏洞发现、恶意代码分析等任务的基础。已有跳转表分析多优先性能而牺牲健全性，可能导致插桩程序出现不可预测的运行时失败。本文提出 SJA：利用新的抽象域系统化追踪计算所得代码指针的“结构”，避免以往依赖语法模式匹配的方法；同时给出高效的边界分析，无损推理跳转表场景中的等式与不等式关系，从而在保持健全性的同时实现可扩展性。实验表明，SJA 相比次优技术将漏报率降低 35 倍；按 F1 分数衡量的错误率上，性能优于最佳先前技术 3 倍。
Jump tables are a common source of indirect jumps in binary code. Resolving these indirect jumps is critical for constructing a complete control-flow graph, which is an essential first step for most applications involving binaries, including binary hardening and instrumentation, binary analysis and fuzzing for vulnerability discovery, malware analysis and reverse engineering. Existing techniques for jump table analysis generally prioritize performance over soundness. While lack of soundness may be acceptable for applications such as decompilation, it can cause unpredictable runtime failures in binary instrumentation applications. We therefore present SJA, a new jump table analysis technique in this paper that is sound and scalable. Our analysis uses a novel abstract domain to systematically track the "structure" of computed code pointers without relying on syntactic pattern-matching that is common in previous works. In addition, we present a bounds analysis that efficiently and losslessly reasons about equality and inequality relations that arise in the context of jump tables. As a result, our system reduces miss rate by 35× over the next best technique. When evaluated on error rate based on F1-score, our technique outperforms the best previous techniques by 3×.
DOI 原文 ·
@inproceedings{paperbot8545,
title = {Scalable, Sound, and Accurate Jump Table Analysis},
author = {Huan Nguyen and Soumyakant Priyadarshan and R. Sekar},
booktitle = {ISSTA},
year = {2024},
doi = {10.1145/3650212.3680301}
}