Abstract:Control-Flow Integrity (CFI) is considered a promising solution in thwarting advanced code-reuse attacks. While the problem of backward-edge protection in CFI is nearly closed, effective forwardedge protection is still a major challenge. The keystone of protecting the forward edge is to resolve indirect call targets, which although can be done quite accurately using type-based solutions given the program source code, it faces difficulties when carried out at the binary level. Since the actual type information is unavailable in COTS binaries, type-based indirect call target matching typically resorts to approximate function signatures inferred using the arity and argument width of indirect callsites and calltargets. Doing so with static analysis, therefore, forces the existing solutions to assume the arity/width boundaries in a too-permissive way to defeat sophisticated attacks. In this paper, we propose a novel hybrid approach to recover fine-grained function signatures at the binary level, called TYPESQUEEZER. By observing program behaviors dynamically, TYPESQUEEZER combines the static analysis results on indirect callsites and calltargets together, so that both the lower and the upper bounds of their arity/width can be computed according to a philosophy similar to the squeeze theorem. Moreover, the introduction of dynamic analysis also enables TypeS..eezeR to approximate the actual type of function arguments instead of only representing them using their widths. These together allow TYPESQUEEZER to significantly refine the capability of indirect call target resolving, and generate the approximate CFGs with better accuracy. We have evaluated TYPESQUEEZER on the SPEC CPU2006 benchmarks as well as several real-world applications. The experimental results suggest that TYPESQUEEZER achieves higher type-matching precision compared to existing binary-level type-based solutions. Moreover, we also discuss the intrinsic limitations of static analysis and show that it is not enough in defeating certain type of practical attacks; while on the other hand, the same attacks can be successfully thwarted with the hybrid analysis result of our approach.

Refining Indirect Call Targets at the Binary Level.

Points to analysis for partial call graph construction

Adaptive Call-Site Sensitive Control Flow Integrity

Necessity and Capability of Flow, Context, Field and Quasi Path Sensitive Points-to Analysis

Refining the Pointer Analysis by Exploiting Constraints on the CFL-Paths.

Fine-Grained Control-Flow Integrity Based on Points-to Analysis for CPS.

An Effective Approach of Points-To Analysis

The ART of Sharing Points-to Analysis (Extended Abstract)

Construction Approach for Control Flow Graph from Binaries Using Hybrid Analysis

Assessing the Effectiveness of Binary-Level CFI Techniques

BDA: Practical Dependence Analysis for Binary Executables by Unbiased Whole-Program Path Sampling and Per-Path Abstract Interpretation.

DTT: program structure-aware indirect branch optimization via direct-TPC-table in DBT system.

TYPESQUEEZER: When Static Recovery of Function Signatures for Binary Executables Meets Dynamic Analysis

Binary Code Continent

Call-Graph-Based Context-Sensitive Points-to Analysis for Java

Spire: Improving Dynamic Binary Translation Through Spc-Indexed Indirect Branch Redirecting

CP-BCS: Binary Code Summarization Guided by Control Flow Graph and Pseudo Code

Indirect Branch Prediction in Dynamic Binary Translator

Precise and Efficient Points-to Analysis via New Context-Sensitivity and Heap Abstraction.

Rethinking Incremental and Parallel Pointer Analysis

A Value Set Analysis Refinement Approach Based on Conditional Merging and Lazy Constraint Solving