Type
Text
Type
Dissertation
Advisor
Polychronakis, Michalis | Sekar, R. | Nikiforakis, Nick | Prakash, Aravind.
Date
2017-05-01
Keywords
Computer science
Department
Department of Computer Science
Language
en_US
Source
This work is sponsored by the Stony Brook University Graduate School in compliance with the requirements for completion of degree.
Identifier
http://hdl.handle.net/11401/77248
Publisher
The Graduate School, Stony Brook University: Stony Brook, NY.
Format
application/pdf
Abstract
Binary analysis and instrumentation play a central role in COTS software security. They can be used to detect and prevent vulnerabilities, mitigate exploits, enforce security policies, and so on. Many security instrumentations work at the granularity of functions. However, unlike high-level languages, functions in binaries are not clearly demarcated. To complicate matters further, functions in binaries may have multiple entry points and/or exit points. Some of these entries or exits may not be determined simply by instruction syntax or code patterns. Moreover, many functions are reachable only through indirect control transfers, while some may be altogether unreachable. In this dissertation, we present an approach that overcomes these challenges to accurately identify function boundaries, as well as calls and returns. Our approach is based on fine-grained static analysis, relying on precise models of instruction set semantics derived in part from our previous work. In the later part of the work, we expand our investigation to recover the next crucial piece of information that is lost in high-level language to binary translation: the types and numbers of function parameters. We propose an approach that uses fine-grained binary analysis to address this problem. We evaluate this technique by applying it to enforce fine-grained control-flow integrity policies. While our approach is widely applicable to all binaries, when combined with recovered C++ semantics, it provides significantly improved protection. | 110 pages
Recommended Citation
Qiao, Rui, "Accurate Recovery of Functions in COTS Binaries" (2017). Stony Brook Theses and Dissertations Collection, 2006-2020 (closed to submissions). 3073.
https://commons.library.stonybrook.edu/stony-brook-theses-and-dissertations-collection/3073