通过综合适配器寻找可替换的二进制代码
Finding Substitutable Binary Code By Synthesizing Adapters
摘要：
独立开发的代码库通常包含许多执行相同或密切相关操作的代码段（语义克隆）。找到功能上等效的段可以实现应用程序，例如用更有效或更安全的替代方案替换段。这些相关的段通常有不同的接口，因此需要一些粘合代码（适配器）来替换其中一个。我们提出了一个算法，可替换的代码段在功能级别上搜索，试图合成它们之间的适配器从一些家庭的适配器，它终止，如果它没有找到可能的适配器。我们使用（1）基于Intel的Pin框架的具体适配器枚举（2）二进制符号执行来实现我们的技术，并探索适配器搜索空间大小与总搜索时间之间的关系。我们提出了应用适配器合成来提高二进制函数的安全性和效率，去混淆二进制函数，以及在RC4的二进制实现之间切换的示例。我们提出了两个大规模的评估，（1）我们运行适配器合成超过13，000功能对从Linux C库，（2）使用超过61，000片段的二进制代码提取的ARM图像构建的iPod Nano 2g设备和VLC媒体播放器的已知功能，我们评估我们的适配器合成实现超过一百万合成任务。我们的研究结果证实，在现实世界的代码中存在几个实例的自适应等价的二进制函数，并建议适配器合成可以应用于逆向工程和构建更干净，更少的错误，更有效的程序。
英文摘要：
Independently developed codebases typically contain many segments of code that perform same or closely related operations (semantic clones). Finding functionally equivalent segments enables applications like replacing a segment by a more efficient or more secure alternative. Such related segments often have different interfaces, so some glue code (an adapter) is needed to replace one with the other. We present an algorithm that searches for replaceable code segments at the function level by attempting to synthesize an adapter between them from some family of adapters; it terminates if it finds no possible adapter. We implement our technique using (1) concrete adapter enumeration based on Intel's Pin framework (2) binary symbolic execution, and explore the relation between size of adapter search space and total search time. We present examples of applying adapter synthesis for improving security and efficiency of binary functions, deobfuscating binary functions, and switching between binary implementations of RC4. We present two large-scale evaluations, (1) we run adapter synthesis on more than 13,000 function pairs from the Linux C library, (2) using more than 61,000 fragments of binary code extracted from a ARM image built for the iPod Nano 2g device and known functions from the VLC media player, we evaluate our adapter synthesis implementation on more than a million synthesis tasks . Our results confirm that several instances of adaptably equivalent binary functions exist in real-world code, and suggest that adapter synthesis can be applied for reverse engineering and for constructing cleaner, less buggy, more efficient programs.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
