UnderTracker: Generating Robust Binaries Using Execution Flow Traces

Abstract

Programs are developed in a manner so that they execute and fulfill their intended purpose. In doing so, programmers trust the language to help them achieve their goals. Binary hardening is one such concept that prevents program behavior deviation and conveys the programmer’s intention. Therefore, to maintain the integrity of the program, measures need to be taken to avoid code-tampering. The proposed approach enforces code verification from instruction-to-instruction by using the programmer’s intended control flow. UnderTracker implements execution flow at the instruction cache by utilizing the read-only data-cache available in the program. The key idea is to place a control transfer code in data-cache and call it from instruction cache via labels. UnderTracker injects labels into the binary without affecting the semantics of the program. After the code execution starts, it verifies every control point’s legality before passing the control to the next instruction, by passively monitoring the execution flow. We proposed a cache-based monitoring method to verify code integrity. In this, we used side-channel information to monitor the program’s execution state. This monitoring system uses a sliding window scheme to detect the violation of code integrity with high reliability. This paper proposes an efficient technique, called UnderTracker to strengthen the binary integrity of an I/O intensive running program, with the nominal overhead of only 5-6% on top of the normal execution.