Abstract:Reverse execution and coredump analysis have long been used to diagnose the root cause of software crashes. Each of these techniques, however, face inherent challenges, such as insufficient capability when handling memory aliases. Recent works have used hypothesis testing to address this drawback, albeit with high computational complexity, making them impractical for real world applications. To address this issue, we propose a new deep neural architecture, which could significantly improve memory alias resolution. At the high level, our approach employs a recurrent neural network (RNN) to learn the binary code pattern pertaining to memory accesses. It then infers the memory region accessed by memory references. Since memory references to different regions naturally indicate a non-alias relationship, our neural architecture can greatly reduce the burden of doing hypothesis testing to track down non-alias relation in binary code. Different from previous researches that have utilized deep learning for other binary analysis tasks, the neural network proposed in this work is fundamentally novel. Instead of simply using off-the-shelf neural networks, we designed a new recurrent neural architecture that could capture the data dependency between machine code segments. To demonstrate the utility of our deep neural architecture, we implement it as RENN, a neural network-assisted reverse execution system. We utilize this tool to analyze software crashes corresponding to 40 memory corruption vulnerabilities from the real world. Our experiments show that RENN can significantly improve the efficiency of locating the root cause for the crashes. Compared to a state-of-the-art technique, RENN has 36.25% faster execution time on average, detects an average of 21.35% more non-alias pairs, and successfully identified the root cause of 12.5% more cases.

Reversing and Identifying Overwritten Data Structures for Memory-Corruption Exploit Diagnosis

deExploit: Identifying misuses of input data to diagnose memory-corruption exploits at the binary level.

Memory corruption exploit diagnosis based on field integrity

Identifying exploitable memory objects for out‐of‐bound write vulnerabilities

AutoPwn: Artifact-Assisted Heap Exploit Generation for CTF PWN Competitions

Capturing Invalid Input Manipulations for Memory Corruption Diagnosis

Revery

Learning Fine-Grained Structured Input for Memory Corruption Detection

Revery: From Proof-Of-Concept To Exploitable (One Step Towards Automatic Exploit Generation)

An Effective Taint‐based Software Vulnerability Miner

Detecting Exploit Primitives Automatically for Heap Vulnerabilities on Binary Programs

DEPA: Determining Exploit Primitives Automatically for Interactive Programs

Trace-Free Memory Data Structure Forensics Via Past Inference and Future Speculations

Automated Use-After-Free Detection and Exploit Mitigation: How Far Have We Gone

Locating Vulnerabilities in Binaries Via Memory Layout Recovering

POMP++: Facilitating Postmortem Program Diagnosis with Value-Set Analysis.

Postmortem Program Analysis with Hardware-Enhanced Post-Crash Artifacts.

Identifying Valuable Pointers in Heap Data

RENN: Efficient Reverse Execution with Neural-Network-assisted Alias Analysis

BofAEG: Automated Stack Buffer Overflow Vulnerability Detection and Exploit Generation Based on Symbolic Execution and Dynamic Analysis

Targeting Infeasibility Questions on Obfuscated Codes