通过部分可重编译反编译自动缓解二进制程序中的漏洞
Automatically Mitigating Vulnerabilities in Binary Programs via Partially Recompilable Decompilation
AI总结：
针对无源码二进制程序漏洞修复难题，提出部分可重编译反编译（PRD）方法，仅针对可疑函数实现反编译重编译，结合自动/人工修复，在CGC等基准上达到与全源码工具相当的漏洞缓解效果。
摘要：
漏洞的定位与修复极具挑战性，尤其是在无法获取源代码且需要进行二进制补丁修复的场景下。人工方法耗时久、对专业能力要求高，且无法匹配新漏洞被发现的速率。自动化方法是颇具吸引力的替代方案，为此我们提出了部分可重编译反编译（Partially Recompilable Decompilation，PRD）方法。PRD将可疑的二进制函数提升为源代码，以供分析、修改或审查，并结合源代码层面与二进制层面的技术生成打补丁后的二进制程序。尽管反编译与重编译通常无法在完整二进制程序上生效，但我们的方法能够成功，因为它仅局限于少数函数，例如由我们的二进制故障定位工具识别出的函数。我们对这些假设进行了评估，结果发现，在无任何语法或编译限制的前提下，70%-89%的单个函数可在充分的类型恢复下被成功反编译并重编译。相比之下，完整C语言二进制程序的成功率仅为1.7%。当反编译成功时，PRD有92.9%的概率生成与测试等价的二进制程序。此外，我们在两种场景下评估了PRD：整合了源代码层面自动程序修复（Automated Program Repair，APR）方法的全自动化流程；人工编辑的源代码层面修复。在DARPA网络大挑战（Cyber Grand Challenge，CGC）二进制程序上进行评估时，我们发现仅基于二进制程序运行的、支持PRD的APR工具，其表现与全源代码工具相当，有时甚至更优，二者合计缓解了148个场景中的85个，该成功率与这些工具在可访问完整源代码时的运行表现一致。PRD取得了与CGC优胜参赛作品相近的成功率，有时还能找到比顶级CGC团队生成的方案质量更高的缓解措施。为保证通用性，我们的评估纳入了两款独立开发的APR工具，以及C++、Rode0day和真实场景的二进制程序。
英文摘要：
Vulnerabilities are challenging to locate and repair, especially when source code is unavailable and binary patching is required. Manual methods are time-consuming, require significant expertise, and do not scale to the rate at which new vulnerabilities are discovered. Automated methods are an attractive alternative, and we propose Partially Recompilable Decompilation (PRD). PRD lifts suspect binary functions to source, available for analysis, revision, or review, and creates a patched binary using source- and binary-level techniques. Although decompilation and recompilation do not typically work on an entire binary, our approach succeeds because it is limited to a few functions, like those identified by our binary fault localization. We evaluate these assumptions and find that, without any grammar or compilation restrictions, 70-89% of individual functions are successfully decompiled and recompiled with sufficient type recovery. In comparison, only 1.7% of the full C-binaries succeed. When decompilation succeeds, PRD produces test-equivalent binaries 92.9% of the time. In addition, we evaluate PRD in two contexts: a fully automated process incorporating source-level Automated Program Repair (APR) methods; human-edited source-level repairs. When evaluated on DARPA Cyber Grand Challenge (CGC) binaries, we find that PRD-enabled APR tools, operating only on binaries, performs as well as, and sometimes better than full-source tools, collectively mitigating 85 of the 148 scenarios, a success rate consistent with these same tools operating with access to the entire source code. PRD achieves similar success rates as the winning CGC entries, sometimes finding higher-quality mitigations than those produced by top CGC teams. For generality, our evaluation includes two independently developed APR tools and C++, Rode0day, and real-world binaries.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
