Enhancing Control Flow Graph Based Binary Function Identification - - PowerPoint PPT Presentation

▶
enhancing control flow graph based binary function
SMART_READER_LITE
LIVE PREVIEW

Enhancing Control Flow Graph Based Binary Function Identification - - PowerPoint PPT Presentation

Sep 19, 2023 247 likes •541 views

Enhancing Control Flow Graph Based Binary Function Identification Clemens Jonischkeit Chair for IT Security 23. November 2017 C. Jonischkeit 1 / 13 Motivation Technische Universitt Mnchen I just wasted 3 hours of my life. . . . .

slide-1
SLIDE 1

Enhancing Control Flow Graph Based Binary Function Identification Clemens Jonischkeit

Chair for IT Security

  • 23. November 2017
  • C. Jonischkeit

1 / 13

slide-2
SLIDE 2

Motivation

Technische Universität München

”I just wasted 3 hours of my life. . . . . . because I reversed $foo once again”

  • C. Jonischkeit

2 / 13

slide-3
SLIDE 3

Motivation

Technische Universität München

Problem:

▸ Recover function labels

Existing Technology:

▸ Pattern Matching (F.L.I.R.T) ▸ BinDiff ▸ Diaphora

  • C. Jonischkeit

3 / 13

slide-4
SLIDE 4

Problems of CFGs

Technische Universität München

1 10 100 500 1,000 1,500 Basic Blocks (#) Functions (#)

  • C. Jonischkeit

4 / 13

slide-5
SLIDE 5

Problems of CFGs

Technische Universität München

⋮ ⋮ ⋮

1 mov rax, rdx 2 ret

⋮ ⋮ ⋮

1 mov rax, rdx 2 ret 1 mov rax, rdx 2 ret 1 mov rax, rdx 2 ret

  • C. Jonischkeit

5 / 13

slide-6
SLIDE 6

Problems of CFGs

Technische Universität München

Goal:

▸ Differentiate similar CFGs ▸ Resistence against changes

  • C. Jonischkeit

6 / 13

slide-7
SLIDE 7

Problems of CFGs

Technische Universität München

Problem:

▸ Small Functions: Many functions share the same CFG ▸ Large Functions: Many different CFGs possible per function

Idea:

▸ Checking basic block level information ▸ Normalize CFGs

  • C. Jonischkeit

7 / 13

slide-8
SLIDE 8

Normalization

Technische Universität München

instr: 5 instr: 3 instr: 9 Leaf Inlining:

▸ Detect Leafs ▸ Duplicate per parent

Combining Nodes:

▸ Detect Nodes with one parent ▸ Filter parents to only have one

child

▸ Combine attributes

  • C. Jonischkeit

8 / 13

slide-9
SLIDE 9

Normalization

Technische Universität München

instr: 5 instr: 3 instr: 9 Leaf Inlining:

▸ Detect Leafs ▸ Duplicate per parent

Combining Nodes:

▸ Detect Nodes with one parent ▸ Filter parents to only have one

child

▸ Combine attributes

  • C. Jonischkeit

8 / 13

slide-10
SLIDE 10

Normalization

Technische Universität München

instr: 5 instr: 3 instr: 9 Leaf Inlining:

▸ Detect Leafs ▸ Duplicate per parent

Combining Nodes:

▸ Detect Nodes with one parent ▸ Filter parents to only have one

child

▸ Combine attributes

  • C. Jonischkeit

8 / 13

slide-11
SLIDE 11

Normalization

Technische Universität München

instr: 5 instr: 3 instr: 9 Leaf Inlining:

▸ Detect Leafs ▸ Duplicate per parent

Combining Nodes:

▸ Detect Nodes with one parent ▸ Filter parents to only have one

child

▸ Combine attributes

  • C. Jonischkeit

8 / 13

slide-12
SLIDE 12

Normalization

Technische Universität München

instr: 5 instr: 3 instr: 9 Leaf Inlining:

▸ Detect Leafs ▸ Duplicate per parent

Combining Nodes:

▸ Detect Nodes with one parent ▸ Filter parents to only have one

child

▸ Combine attributes

  • C. Jonischkeit

8 / 13

slide-13
SLIDE 13

Normalization

Technische Universität München

instr: 5 instr: 3 instr: 9 Leaf Inlining:

▸ Detect Leafs ▸ Duplicate per parent

Combining Nodes:

▸ Detect Nodes with one parent ▸ Filter parents to only have one

child

▸ Combine attributes

  • C. Jonischkeit

8 / 13

slide-14
SLIDE 14

Normalization

Technische Universität München

instr: 5 instr: 3 instr: 12 Leaf Inlining:

▸ Detect Leafs ▸ Duplicate per parent

Combining Nodes:

▸ Detect Nodes with one parent ▸ Filter parents to only have one

child

▸ Combine attributes

  • C. Jonischkeit

8 / 13

slide-15
SLIDE 15

Graph Comparison

Technische Universität München

A B C D E

  • C. Jonischkeit

9 / 13

slide-16
SLIDE 16

Graph Comparison

Technische Universität München

A B C D E A

  • C. Jonischkeit

9 / 13

slide-17
SLIDE 17

Graph Comparison

Technische Universität München

A B C D E A B

  • C. Jonischkeit

9 / 13

slide-18
SLIDE 18

Graph Comparison

Technische Universität München

A B C D E A B

  • C. Jonischkeit

9 / 13

slide-19
SLIDE 19

Graph Comparison

Technische Universität München

A B C D E A B

  • C. Jonischkeit

9 / 13

slide-20
SLIDE 20

Graph Comparison

Technische Universität München

A B C D E A C B

  • C. Jonischkeit

9 / 13

slide-21
SLIDE 21

Graph Comparison

Technische Universität München

A B C D E A C D B

  • C. Jonischkeit

9 / 13

slide-22
SLIDE 22

Graph Comparison

Technische Universität München

A B C D E A C D B

  • C. Jonischkeit

9 / 13

slide-23
SLIDE 23

Graph Comparison

Technische Universität München

A B C D E A C D B

  • C. Jonischkeit

9 / 13

slide-24
SLIDE 24

Graph Comparison

Technische Universität München

A B C D E A C D E B

  • C. Jonischkeit

9 / 13

slide-25
SLIDE 25

Graph Comparison

Technische Universität München

A B C D E A C D E B

  • C. Jonischkeit

9 / 13

slide-26
SLIDE 26

Results

Technische Universität München

20 40 60 80 100 python python (n.) python (Dia.) libc libc (n.)

16.8 17.6 15.4 15.2 45.3 44.7 80.9 33 28.7 1.4 1.4 21.1 0.9 0.8

Average Matched functions (%) false positive correct (unique) correct

  • C. Jonischkeit

10 / 13

slide-27
SLIDE 27

Results

Technische Universität München

5 10 15 20

  • O2, -O3 (n.)
  • O2, -O3
  • O1, -O2
  • O1, -O2 (n.)

clang, gcc clang, gcc (n.) gcc7, gcc6 gcc7, gcc6 (n.) Average Matched functions (%) false positive correct (unique) correct

  • C. Jonischkeit

11 / 13

slide-28
SLIDE 28

Results

Technische Universität München

10 20 30 40 50 60 70 80 90

  • O2, -O3 (Dia.)
  • O2, -O3 (n.)
  • O2, -O3
  • O1, -O2
  • O1, -O2 (Dia.)
  • O1, -O2 (n.)

Average Matched functions (%) false positive correct (unique) correct

  • C. Jonischkeit

12 / 13

slide-29
SLIDE 29

Thanks

Technische Universität München

jonischk [at] sec.in.tum.de https://github.com/leetonidas/signatures

  • C. Jonischkeit

13 / 13