二进制码差优化的隐藏力量：一项实证研究
Unleashing the Hidden Power of Compiler Optimization on Binary Code Difference: An Empirical Study
摘要：
由于编译器优化是导致二进制代码语法差异的最常见原因，因此测试针对由不同编译器优化设置引起的更改的弹性已成为大多数二进制差异方法的标准评估步骤。例如，过去12年中的47篇顶级论文比较了默认优化级别编译的不同程序版本（例如，- GCC和LLVM中的Ox）。尽管他们中的许多人声称他们对编译器转换免疫，但还不清楚他们对非默认优化设置的抵抗力。特别是，我们已经观察到，对手探索非默认编译器设置，以放大恶意软件的差异。本文首先系统地研究了编译器优化对二进制代码差异的有效性。我们量身定制基于搜索的迭代编译的二进制代码差异的自动调整。我们开发BinTuner来搜索接近最优的优化序列，可以最大限度地提高二进制代码差异的数量。我们使用GCC 10.2和LLVM 11.0在SPEC基准测试（CPU 2006和CPU 2017），Coreutils和OpenSSL上运行BinTuner。我们的实验表明，以279到1,881次编译迭代为代价，BinTuner可以找到比一般-Ox设置更好的自定义优化序列。BinTuner的输出严重破坏了突出的二进制差分工具的比较。此外，由BinTuner调整的物联网恶意软件变体的检测率下降了50%以上。我们的研究结果为安全分析师描绘了一个警示故事，即攻击者有一种新的方法可以经济有效地变异恶意软件代码，研究界需要退后一步重新评估优化阻力评估。
英文摘要：
Since compiler optimization is the most common source contributing to binary code differences in syntax, testing the resilience against the changes caused by different compiler optimization settings has become a standard evaluation step for most binary diffing approaches. For example, 47 top-venue papers in the last 12 years compared different program versions compiled by default optimization levels (e.g., -Ox in GCC and LLVM). Although many of them claim they are immune to compiler transformations, it is yet unclear about their resistance to non-default optimization settings. Especially, we have observed that adversaries explored non-default compiler settings to amplify malware differences. This paper takes the first step to systematically studying the effectiveness of compiler optimization on binary code differences. We tailor search-based iterative compilation for the auto-tuning of binary code differences. We develop BinTuner to search near-optimal optimization sequences that can maximize the amount of binary code differences. We run BinTuner with GCC 10.2 and LLVM 11.0 on SPEC benchmarks (CPU2006 & CPU2017), Coreutils, and OpenSSL. Our experiments show that at the cost of 279 to 1,881 compilation iterations, BinTuner can find custom optimization sequences that are substantially better than the general -Ox settings. BinTuner's outputs seriously undermine prominent binary diffing tools' comparisons. In addition, the detection rate of the IoT malware variants tuned by BinTuner falls by more than 50%. Our findings paint a cautionary tale for security analysts that attackers have a new way to mutate malware code cost-effectively, and the research community needs to step back to reassess optimization-resistance evaluations.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
