检索结果-内蒙古大学图书馆

Shining Light on the Inter-procedural Code Obfuscation: Keep Pace with Progress in binary diffing

ACM TRANSACTIONS ON ARCHITECTURE AND CODE OPTIMIZATION 2025年第1期22卷 1-28页

作者： Zhang, Peihua Wu, Chenggang Hu, Hanzhi Jia, Lichen Peng, Mingfan Xu, Jiali Xie, Mengyao Lai, Yuanming Kang, Yan Wang, Zhe Chinese Acad Sci Inst Comp Technol SKLP Beijing Peoples R China Tencent WeChat Beijing Peoples R China Univ Chinese Acad Sci Beijing Peoples R China Zhongguancun Lab Beijing Peoples R China

Software obfuscation techniques have lost their effectiveness due to the rapid development of binary diffing techniques, which can achieve accurate function matching and identification. In this paper, we propose a new inter-procedural code obfuscation mechanism KHAos,1 which moves the code across functions to obfuscate the function by using compilation optimizations. Three obfuscation primitives are proposed to separate, aggregate, and hide the function. They can be combined to enhance the obfuscation effect further. This article also reveals distinguishing factors on obfuscation and compiler optimization and presents novel observations to gain insights into the impact of actively utilizing compiler optimization in obfuscation. A prototype of KHAos is implemented and evaluated on a large number of real-world programs. Experimental results show that KHAos outperforms existing code obfuscations and can significantly reduce the accuracy rates of six state-of-the-art binary diffing techniques with lower runtime overhead.

关键词： Software protection obfuscation binary diffing

来源：评论

学校读者我要写书评

暂无评论

binary diffing as a Network Alignment Problem via Belief Propagation 36

Binary Diffing as a Network Alignment Problem via Belief Pro...

引用

36th IEEE/ACM International Conference on Automated Software Engineering (ASE)

作者： Mengin, Elie Rossi, Fabrice Univ Paris 1 Pantheon Sorbonne SAMM EA 4543 Paris France Quarkslab SA 13 Rue St Ambroise Paris France PSL Univ Univ Paris Dauphine CEREMADE CNRSUMR 7534 Paris France

ISBN: (纸本)9781665403375

In this paper, we address the problem of finding a correspondence, or matching, between the functions of two programs in binary form, which is one of the most common task in binary diffing We introduce a new formulation of this problem as a particular instance of a graph edit problem over the call graphs of the programs. In this formulation, the quality of a mapping is evaluated simultaneously with respect to both function content and call graph similarities. We show that this formulation is equivalent to a network alignment problem. We propose a solving strategy for this problem based on max-product belief propagation. Finally, we implement a prototype of our method, called QBinDiff, and propose an extensive evaluation which shows that our approach outperforms state of the art diffing tools.

关键词： binary diffing binary Program Analysis Graph Edit Distance Network Alignment Belief Propagation

来源：评论

学校读者我要写书评

暂无评论

BinDiff NN: Learning Distributed Representation of Assembly for Robust binary diffing Against Semantic Differences

引用

IEEE TRANSACTIONS ON SOFTWARE ENGINEERING 2022年第9期48卷 3442-3466页

作者： Ullah, Sami Oh, Heekuck Hanyang Univ Dept Comp Sci & Engn Ansan 15588 South Korea

binary diffing is a process to discover the differences and similarities in functionality between two binary programs. Previous research on binary diffing approaches it as a function matching problem to formulate an initial 1:1 mapping between functions, and later a sequence matching ratio is computed to classify two functions being an exact match, a partial match or no-match. The accuracy of existing techniques is best only when detecting exact matches and they are not efficient in detecting partially changed functions;especially those with minor patches. These drawbacks are due to two major challenges (i) In the 1:1 mapping phase, using a strict policy to match function features (ii) In the classification phase, considering an assembly snippet as a normal text, and using sequence matching for similarity comparison. Instruction has a unique structure i.e. mnemonics and registers have a specific position in instruction and also have a semantic relationship, which makes assembly code different from general text. Sequence matching performs best for general text but it fails to detect structural and semantic changes at an instruction level thus, its use for classification produces many false results. In this research, we have addressed the aforementioned underlying challenges by proposing a two-fold solution. For the 1:1 mapping phase, we have proposed computationally inexpensive features, which are compared with distance-based selection criteria to map similar functions and filter unmatched functions. For the classification phase, we have proposed a Siamese binary-classification neural network where each branch is an attention-based distributed learning embedding neural network - that learn the semantic similarity among assembly instructions, learn to highlight the changes at an instruction level and a final stage fully connected layer learn to accurately classify two 1:1 mapped function either an exact or a partial match. We have used x86 kernel binaries for training

关键词： Asm2Vec attention network binary diffing exact match Inst2vec partial match siamese neural network

来源：评论

学校读者我要写书评

暂无评论

Improving binary diffing speed and accuracy using community detection and locality-sensitive hashing: an empirical study

引用

JOURNAL OF COMPUTER VIROLOGY AND HACKING TECHNIQUES 2023年第2期19卷 319-337页

作者： Karamitas, Chariton Kehagias, Athanasios Aristotle Univ Thessaloniki Dept Elect & Comp Engn CENSUS SA Thessaloniki Greece Aristotle Univ Thessaloniki Dept Elect & Comp Engn Thessaloniki Greece

binary diffing is a commonly used technique for detecting syntactic and semantic similarities and/or differences between two programs' binary executables (not source code). Here we present REveal, a binary diffing application. REveal is based on the detection of Function Call Graph (FCG) approximate isomorphism and improves both speed and accuracy, mainly by the use of two techniques. First, we propose the use of hierarchical Community Detection (CD) in executables' FCGs, for the purpose of detecting groups of densely connected functions, thus partitioning them in smaller groups. Moreover, we use Locality-Sensitive Hashing (LSH) for further grouping of similar functions in hash buckets. Both techniques are used in a divide-and-conquer fashion to simplify the diffing process of the programs being compared, practically reducing it to diffing of their FCG communities and LSH buckets.

关键词： binary diffing Community detection Locality-sensitive hashing Divide-and-conquer

来源：评论

学校读者我要写书评

暂无评论

OPTango: Multi-central Representation Learning against Innumerable Compiler Optimization for binary diffing 34

OPTango: Multi-central Representation Learning against Innum...

引用

34th IEEE International Symposium on Software Reliability Engineering (ISSRE)

作者： Geng, Hongna Zhong, Ming Zhang, Peihua Lv, Fang Feng, Xiaobing UCAS CAS ICT SKLP Beijing Peoples R China Chinese Acad Sci ICT SKLP Beijing Peoples R China

ISBN: (纸本)9798350315943

binary diffing, which quantitatively measures the difference between given binaries, has been broadly used in critical security areas. Previous studies have been tackling the challenge of default compiler optimization, as it can affect binary representation but overlooked the exploration of non-default optimization settings, which can also significantly affect the accuracy of diffing. Recent research indicates a growing trend of compiling applications with non-default optimization settings to magnify binary code discrepancies, enabling them to evade detection by binary diffing tools. This paper takes the first step to systematically studying the resistance of compiler optimization (including default and non-default optimization settings) on binary diffing tasks. To this end, we construct a diverse and unique dataset, OPTbinary, with 3.6 million functions compiled from 514 optimization settings. Then, we propose OPTango, an innovative transformer-based multi-central representation learning approach, exploring the solution to build a compiler optimization-agnostic binary diffing tool. We conduct extensive experiments and benchmark OPTango with state-of-the-art binary diffing approaches. Evaluation results show that OPTango is more robust and significantly outperforms existing methods against both default and non-default compiler optimization.

关键词： binary diffing compiler optimization representation learning

来源：评论

学校读者我要写书评

暂无评论

Improved Algorithm for the Network Alignment Problem with Application to binary diffing 25

Improved Algorithm for the Network Alignment Problem with Ap...

引用

25th KES International Conference on Knowledge-Based and Intelligent Information & Engineering Systems (KES)

作者： Mengin, Elie Rossi, Fabrice Univ Paris 1 Pantheon Sorbonne SAMM EA 4543 F-75013 Paris France Quarkslab SA 13 Rue St Ambroise F-75011 Paris France Univ Paris 09 PSL Univ CNRS CEREMADEUMR 7534 F-75016 Paris France

In this paper, we present a novel algorithm to address the Network Alignment problem. It is inspired from a previous message passing framework of Bayati et al. [2] and includes several modifications designed to significantly speed up the message updates as well as to enforce their convergence. Experiments show that our proposed model outperforms other state-of-the-art solvers. Finally, we propose an application of our method in order to address the binary diffing problem. We show that our solution provides better assignment than the reference differs in almost all submitted instances and outline the importance of leveraging the graphical structure of binary programs. (C) 2021 The Authors. Published by Elsevier B.V.

关键词： Network Alignment Graph Matching Belief Propagation binary diffing binary Code Analysis

来源：评论

学校读者我要写书评

暂无评论

Khaos: The Impact of Inter-procedural Code Obfuscation on binary diffing Techniques 2023

Khaos: The Impact of Inter-procedural Code Obfuscation on Bi...

引用

21st ACM/IEEE International Symposium on Code Generation and Optimization (CGO)

作者： Zhang, Peihua Wu, Chenggang Peng, Mingfan Zeng, Kai Yu, Ding Lai, Yuanming Kang, Yan Wang, Wei Wang, Zhe Chinese Acad Sci Inst Comp Technol SKLP Beijing Peoples R China Univ Chinese Acad Sci Beijing Peoples R China Zhongguancun Lab Beijing Peoples R China

ISBN: (纸本)9798400701016

Software obfuscation techniques can prevent binary diffing techniques from locating vulnerable code by obfuscating the third-party code, to achieve the purpose of protecting embedded device software. With the rapid development of binary diffing techniques, they can achieve more and more accurate function matching and identification by extracting the features within the function. This makes existing software obfuscation techniques, which mainly focus on the intra-procedural code obfuscation, no longer effective. In this paper, we propose a new inter-procedural code obfuscation mechanism Khaos, which moves the code across functions to obfuscate the function by using compilation optimizations. Two obfuscation primitives are proposed to separate and aggregate the function, which are called fission and fusion respectively. A prototype of Khaos is implemented based on the LLVM compiler and evaluated on a large number of real-world programs including SPEC CPU 2006 & 2017, CoreUtils, JavaScript engines, etc. Experimental results show that Khaos outperforms existing code obfuscations and can significantly reduce the accuracy rates of five state-of-the-art binary diffing techniques (less than 19%) with lower runtime overhead (less than 7%).

关键词： Software Protection Obfuscation binary diffing

来源：评论

学校读者我要写书评

暂无评论

Improved Algorithm for the Network Alignment Problem with Application to binary diffing

引用

Procedia Computer Science 2021年 192卷 961-970页

作者： Elie Mengin Fabrice Rossi SAMM EA 4543 Université Paris 1 Panthéon-Sorbonne 75013 Paris CEREMADE CNRS UMR 7534 Université Paris-Dauphine PSL University 75016 Paris

关键词： Network Alignment Graph Matching Belief Propagation binary diffing binary Code Analysis

来源：评论

学校读者我要写书评

暂无评论

Efficient Features for Function Matching in Multi-Architecture binary Executables

引用

IEEE ACCESS 2021年 9卷 104950-104968页

作者： Ullah, Sami Jin, Wenhui Oh, Heekuck Hanyang Univ Dept Comp Sci & Engn Ansan 15588 South Korea

binary-binary function matching problem serves as a plinth in many reverse engineering techniques such as binary diffing, malware analysis, and code plagiarism detection. In literature, function matching is performed by first extracting function features (syntactic and semantic), and later these features are used as selection criteria to formulate an approximate 1:1 correspondence between binary functions. The accuracy of the approximation is dependent on the selection of efficient features. Although substantial research has been conducted on this topic, we have explored two major drawbacks in previous research. (i) The features are optimized only for a single architecture and their matching efficiency drops for other architectures. (ii) function matching algorithms mainly focus on the structural properties of a function, which are not inherently resilient against compiler optimizations. To resolve the architecture dependency and compiler optimizations, we benefit from the intermediate representation (IR) of function assembly and propose a set of syntactic and semantic (embedding-based) features which are efficient for multi-architectures, and sensitive to compiler-based optimizations. The proposed function matching algorithm employs one-shot encoding that is flexible to small changes and uses a KNN based approach to effectively map similar functions. We have evaluated proposed features and algorithms using various binaries, which were compiled for x86 and ARM architectures;and the prototype implementation is compared with Diaphora (an industry-standard tool), and other baseline research. Our proposed prototype has achieved a matching accuracy of approx. 96%, which is higher than the compared tools and consistent against optimizations and multi-architecture binaries.

关键词： Feature extraction Semantics Optimization Tools Syntactics Malware Computer architecture binary diffing efficient features function matching multi-architecture

来源：评论

学校读者我要写书评

暂无评论

Feedback-Driven binary Code Diversification

引用

ACM TRANSACTIONS ON ARCHITECTURE AND CODE OPTIMIZATION 2013年第4期9卷 1–26页

作者： Coppens, Bart De Sutter, Bjorn Maebe, Jonas Univ Ghent Comp Syst Lab Ghent Belgium

As described in many blog posts and in the scientific literature, exploits for software vulnerabilities are often engineered on the basis of patches. For example, "Microsoft Patch Tuesday" is often followed by "Exploit Wednesday" during which yet unpatched systems become vulnerable to patch-based exploits. Part of the patch engineering includes the identification of the vulnerable binary code by means of reverse-engineering tools and diffing add-ons. In this article we present a feedback-driven compiler tool flow that iteratively transforms code until diffing tools become ineffective enough to close the "Exploit Wednesday" window of opportunity. We demonstrate the tool's effectiveness on a set of real-world patches and against the latest version of BinDiff.

关键词： Experimentation Measurement Security Compiler transformations software diversity binary diffing program matching patches

来源：评论

学校读者我要写书评

暂无评论

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案：

请选择收藏分类：

通借通还

建议与咨询 留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案： 新增检索档案 确定 取消

请选择收藏分类： 新增自定义分类 确定 取消

通借通还

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

请选择保存的检索档案：

请选择收藏分类：