Lightweight heuristics to retrieve parameter associations from binaries

Franck de Goër (1) , Roland Groz (2) , Laurent Mounier (3)

1 LIG - Laboratoire d'Informatique de Grenoble
2 VASCO - Validation de Systèmes, Composants et Objets logiciels
3 VERIMAG - IMAG - VERIMAG

We present an approach to recover information on function signatures and data-flow relations from stripped binary code. Contrary to most approaches based either on static analysis or fine-grained dynamic instrumentation, we propose lightweight instrumentation and heuristics. Our goal is to get a fast and scalable pre-processing that could serve as a front-end to focus more detailed analysis of particular functions. We infer arity and parameter types, as well as a coupling relation (which we define). We are interested in particular in couples of functions with a data-flow relation, such as memory allocators. We trade-off accuracy for scalability and performance, but our experiments show that the results of the proposed heuristics can be quite accurate, even on a single random execution.

Domaines: Informatique et langage [cs.CL]

Franck de Goër, Roland Groz, Laurent Mounier. Lightweight heuristics to retrieve parameter associations from binaries. 5th Program Protection and Reverse Engineering Workshop, PPREW-5, Dec 2015, Los Angeles, CA, United States. pp.1-12, ⟨10.1145/2843859.2843861⟩. ⟨hal-01657527⟩