Abstract:Software security analysts typically only have access to the executable program and cannot directly access the source code of the program. This poses significant challenges to security analysis. While it is crucial to identify vulnerabilities in such non-source code programs, there exists a limited set of generalized tools due to the low versatility of current vulnerability mining methods. However, these tools suffer from some shortcomings. In terms of targeted fuzzing, the path searching for target points is not streamlined enough, and the completely random testing leads to an excessively large search space. Additionally, when it comes to code similarity analysis, there are issues with incomplete code feature extraction, which may result in information loss. In this paper, we propose a cross-platform and cross-architecture approach to exploit vulnerabilities using neural network obfuscation techniques. By leveraging the Angr framework, a deobfuscation technique is introduced, along with the adoption of a VEX-IR-based intermediate language conversion method. This combination allows for the unified handling of binary programs across various architectures, compilers, and compilation options. Subsequently, binary programs are processed to extract multi-level spatial features using a combination of a skip-gram model with self-attention mechanism and a bidirectional Long Short-Term Memory (LSTM) network. Finally, the graph embedding network is utilized to evaluate the similarity of program functionalities. Based on these similarity scores, a target function is determined, and symbolic execution is applied to solve the target function. The solved content serves as the initial seed for targeted fuzzing. The binary program is processed by using the de-obfuscation technique and intermediate language transformation method, and then the similarity of program functions is evaluated by using a graph embedding network, and symbolic execution is performed based on these similarity scores. This approach facilitates cross-architecture analysis of executable programs without their source codes and concurrently reduces the risk of symbolic execution path explosion.

Technique on Locating Main Function from Portable Executables

The Research of Information Hiding Technology Based on Portable Executable File Format

Feature Location in Source Code by Trace-Based Impact Analysis and Information Retrieval.

Automatically resolving virtual function calls in binary executables

Generic Unpacking Method Based on Detecting Original Entry Point

Flaw function static detection method for executable

GenLog: Accurate Log Template Discovery for Stripped X86 Binaries

Scalable and Accurate Binary Search Method Based on Simhash and Partial Trace

A Function Call Graph Extraction Method Combining Static and Dynamic Analysis

Research on same source feature measuring technology of executable code

Identification of Exception Return in Subroutine of Executable File

Binary Program Vulnerability Mining Based on Neural Network

IntFinder: automatically detecting integer bugs in x86 binary program

PEM: Representing Binary Program Semantics for Similarity Analysis via a Probabilistic Execution Model

Towards Optimal Use of Exception Handling Information for Function Detection

A Study of Rarely Appeared Instructions in an Executable Binary

POSTER : PT-DBG : Bypass Anti-debugging with Intel Processor Tracing

Practical analysis of stripped binary code

Detection and Analysis of Virtual Machine Exits

EFACT: an External Function Auto-Completion Tool to Strengthen Static Binary Lifting

A Comprehensive Study on Learning-Based PE Malware Family Classification Methods