Method for binary code vulnerability discovery on basis of simple symbolic execution

Abstract

The invention discloses a method for binary code vulnerability discovery on the basis of simple symbolic execution. The method comprises five steps that: firstly, binary codes are translated into an intermediate language with a static single assignment through a binary code translation component; and then, a disassembling engine is used to disassemble the binary codes, the control flow information of the binary codes is extracted, static symbolic execution is carried out in the intermediate language on the basis of the control flow information, an entrance point needs to be determined during the symbolic execution process, an input vector is converted into a symbol, and a called function is modeled. After the symbolic execution process is completed, the statement assembly of the intermediate language which depends on the input vector can be obtained, the statements of an assembly are simplified, and a vulnerability discovery confirmation report is generated after security attribute rules are used to confirm.

Description

technical field [0001] The invention relates to a binary code loophole mining method based on simple symbol execution, which can detect loopholes caused by improper input. It is applicable to multiple platforms, and only statically interprets the binary code without actual execution, so it is more efficient. Using one of the security attribute rules successfully verified all the vulnerabilities in the ioctrol routines reported in antivirus software drivers such as Rising, Super Patrol, and Norton in recent years. It is suitable for software testing, vulnerability mining and other fields. Background technique [0002] Traditional software vulnerability mining methods generally use black-box Fuzz testing to construct a set of random inputs and pass them to the program until the program crashes. This method is blind, neither can know which program paths have been executed, nor can it construct the input in a oriented manner, so that the program can be executed to the paths th...

AI Technical Summary

Problems solved by technology

This method is blind, neither can know which program paths have been executed, nor can it construct the input in a oriented manner, so that the program can be executed to paths that have not been traversed

Most of the time in the test process is repeated execution of the same path, making the test time cost too high

Source-level testing can help programmers find many bugs caused by code style or wrong syntax and semantics, but there are several disadvantages: 1) It is impossible to find bugs when the program is running; 2) In many cases, the source code is not accessible 3) Each type of programming language needs to be considered separately

However, these tools have a common disadvantage. Due to the need to instrument the source code or binary code, the operation efficiency is low due to the large number of instrumented codes. For malware, the actual operation will bring other dangers.

Images