Static Binary Instrumentation Research Articles

MinSIB: Minimized static instrumentation for fuzzing binaries

Code instrumentation is widely used in software analysis. The coverage-guided fuzzers collect path information by instrumenting additional code into the executable to guide the mutator. Existing instrumentation tools try to instrument all basic blocks to achieve high code coverage. This causes additional run-time overhead to the target and slows down the fuzzing. Also, too many paths may lead to a hash collision, or distract the attention of the fuzzer to less important code. To pay more attention to the instrumented code and place the instrumentation points into the functional areas of interest or security-related basic blocks, this paper presents MinSIB (Minimized static instrumentation for fuzzing binaries), a static binary instrumentation toolkit for Windows binaries. It instruments additional code into the executable by inline mode to reduce the additional overhead caused by instrumentation. Meanwhile, three optimization approaches are adopted to minimize the number of instrumentation points. Based on this, MinSIB reduces the number of instrumentation points by 90% on average, and the run-time overhead is 79% less than that of full instrumentation. Also, MinSIB improves the efficiency of fuzzing by reproducing known vulnerabilities 4 to 24 times faster than the existing tools, and 14 unknown bugs are found from 6 real-world programs. The results indicate that MinSIB outperforms the state-of-the-art static binary instrumentation tool (PE-AFL) and dynamic instrumentation tool (DynamoRIO) for Windows PE files.

NemesisGuard: Mitigating interrupt latency side channel attacks with static binary rewriting

Internet of Things (IoT) is becoming integrated into nearly every aspect of our modern life. Indeed, exploitation of such devices can directly lead to physical consequences in the real world. Previous work has shown that IoT devices can be compromised by exploits in lower software layers such as the Operating System (OS). Embedded Trusted Execution Environments (TEEs) provide a small Trusted Computing Base (TCB) to protect sensitive codes and data in such devices. TEEs assume a strong threat model where even a privileged attacker (e.g. OS) cannot compromise the confidentiality and integrity of the execution. Nevertheless, it has been shown that side channel attacks make it challenging to keep secrets during application execution.Interrupt latency side channel attacks (a.k.a. Nemesis) are a novel type of timing attacks that target embedded TEEs and extract application secrets from them. Nemesis attacks exploit the CPU’s interrupt mechanism to reveal microarchitectural instruction timings from embedded TEEs. Specifically, the attacker measures the latency of a precisely timed interrupt to differentiate between secret-dependent branches. In this paper, we present NemesisGuard, the first mitigation mechanism against such side channel attacks that does not require a modified compiler or hardware and can protect COTS binaries without access to source code. NemesisGuard applies a novel static binary instrumentation technique to balance secret-dependent branches in IoT application binaries. Evaluation of NemesisGuard shows that it mitigates Nemesis side channel attacks effectively and efficiently.

REPICA: Rewriting Position Independent Code of ARM

Binary rewriting techniques are widely used in program vulnerability fixing, obfuscation, security-oriented transforming, and otherpurposes, such as binary profiling and optimization. Over the past decade, most binary instrumentation techniques have been studied on $\times 86$ architecture, specifically focusing onthe challenges of instrumenting non-PIC. In contrast, ARM architecture has received little attention, and statically instrumenting PIC has not been studied in depth. In ARM, owing to its fixed-length instructions, addresses are frequently computed via multiple stages, making it difficult to handle all relative addresses, especially the relative address of base-plus-offset and base-plus-index addressing . In this paper, we present REPICA , a static binary instrumentation technique which can rewrite ARM binaries compiled in a position-independent fashion. REPICA can instrument at anywhere without symbolic information. With the aim of identifying andprocessing relative-addresses accurately, we designed a value-set analysis specialized for PIC of which the domain is in symbolic format. We also identified a new challenge for situations all relative addresses cannot be corrected in an optimized way and solvedthis problem efficiently by the stepwise correction of each relative address. We implemented a prototype of REPICA and experimented with approximately 1200 COTS binaries and SPECint2006 benchmarks. The experiment showed that all binaries rewritten by REPICA maintain relative addresses correctly with negligible execution and space overhead. Finally, we exhibit the effectiveness of REPICA by using it to implement a shadow stack.

A platform for secure static binary instrumentation

Program instrumentation techniques form the basis of many recent software security defenses, including defenses against common exploits and security policy enforcement. As compared to source-code instrumentation, binary instrumentation is easier to use and more broadly applicable due to the ready availability of binary code. Two key features needed for security instrumentations are (a) it should be applied to all application code, including code contained in various system and application libraries, and (b) it should be non-bypassable. So far, dynamic binary instrumentation (DBI) techniques have provided these features, whereas static binary instrumentation (SBI) techniques have lacked them. These features, combined with ease of use, have made DBI the de facto choice for security instrumentations. However, DBI techniques can incur high overheads in several common usage scenarios, such as application startups, system-calls, and many real-world applications. We therefore develop a new platform for secure static binary instrumentation (PSI) that overcomes these drawbacks of DBI techniques, while retaining the security, robustness and ease-of-use features. We illustrate the versatility of PSI by developing several instrumentation applications: basic block counting, shadow stack defense against control-flow hijack and return-oriented programming attacks, and system call and library policy enforcement. While being competitive with the best DBI tools on CPU-intensive SPEC 2006 benchmark, PSI provides an order of magnitude reduction in overheads on a collection of real-world applications.