Binary Analysis Framework for Analysis of Hardware Binary Code

Abstract

The present invention relates to a binary analysis framework for analyzing hardware binary code. More specifically, by adopting a crash classification and vulnerability detection framework structure configured to allow any binary code manipulation tool to operate rather than a single binary code manipulation tool, it is possible to obtain high-level abstraction analysis and crash classification results by selecting a binary code manipulation tool that most effectively supports various hardware architecture backends according to the situation, as well as to connect any hardware backend. Furthermore, when a superior binary code manipulation tool is newly released, an intermediate code converter for that tool is automatically generated, thereby allowing the existing high-level abstraction analysis to be utilized as is. Additionally, by converting into an intermediate language using a converter generated from information on existing binary manipulation tools and performing various crash analyses through abstract analysis designed to match the intermediate language, the invention has the effect of being applicable to security technology.

Description

Technology Field

[0001] The present invention relates to a binary analysis framework for analyzing hardware binary code applicable to security technology, which adopts a crash classification and vulnerability detection framework structure configured to allow any binary code manipulation tool to operate rather than a single binary code manipulation tool. This allows for the selection of a binary code manipulation tool that most effectively supports various hardware architecture backends according to the situation to obtain high-level abstraction analysis and crash classification results, as well as the ability to connect any hardware backend. Furthermore, by automatically generating an intermediate code converter for a new superior binary code manipulation tool when it becomes available, existing high-level abstraction analysis can be utilized as is. Additionally, by using a converter generated from information on existing binary manipulation tools to convert into an intermediate language and performing various crash analyses through abstraction analysis designed for said intermediate language, the invention enables the analysis of hardware binary code applicable to security technology. Background Technology

[0002] Since vulnerability analysis, such as high-level crash classification of binary code, is hardware-dependent, it is necessary to analyze binary code for the various hardware that has recently emerged.

[0003] To this end, while direct hardware support is possible, the analysis is produced by utilizing professional existing binary manipulation tools capable of handling binary code for various hardware, such as Angr, Miasm, and Binnavi.

[0004] However, there is a problem in that if support for these existing binary manipulation tools is discontinued or commercialization policies change, binary vulnerability analyzers such as crash classification must be modified, redesigned, and developed to fit the new binary manipulation tools.

[0005] Furthermore, crash analysis of binary programs is performed through advanced abstract interpretation analysis, including memory analysis, and it is necessary to consider the various hardware scenarios that have recently emerged.

[0006] To achieve this, binary code manipulation tools dedicated to various hardware backends are used.

[0007] Furthermore, while abstraction analysis, taint analysis, and crash analysis have traditionally been supported by relying on specific binary manipulation tools, this method makes it difficult to properly analyze the binary code of various modern hardware in response to rapidly changing hardware conditions.

[0008] Therefore, since it adopts a crash classification and vulnerability detection framework structure configured to allow arbitrary binary code manipulation tools to operate rather than a single one, it is possible to obtain high-level abstraction analysis and crash classification results by selecting the binary code manipulation tool that most effectively supports various hardware architecture backends according to the situation, as well as connect arbitrary hardware backends. Furthermore, when a superior binary code manipulation tool is newly released, an intermediate code converter for that tool is automatically generated to utilize existing high-level abstraction analysis. Additionally, since it is possible to convert the data into an intermediate language using the converter generated from information on existing binary manipulation tools and perform various crash analyses through abstraction analysis designed for said intermediate language, there is an urgent need for the development of a binary analysis framework for analyzing hardware binary code applicable to security technology. Prior art literature

[0009] KR 10-2020-0148944(2020. 11. 09) The problem to be solved

[0010] Therefore, the present invention was conceived to solve the aforementioned problems, and by adopting a crash classification and vulnerability detection framework configured to allow any binary code manipulation tool to operate rather than a single binary code manipulation tool, the invention aims to provide a binary analysis framework for analyzing hardware binary code that can connect any hardware backend, as well as obtain high-level abstraction analysis and crash classification results by selecting a binary code manipulation tool that most effectively supports various hardware architecture backends according to the situation.

[0011] Another objective of the present invention is to provide a binary analysis framework for analyzing hardware binary code that can utilize existing high-level abstraction analysis by automatically generating an intermediate code converter for a tool when a superior binary code manipulation tool is newly released.

[0012] Another objective of the present invention is to provide a binary analysis framework for analyzing hardware binary code applicable to security technology, which converts the code into an intermediate language using a converter generated through information on existing binary manipulation tools and enables various analyses of crash analysis through abstract analysis designed to fit the intermediate language. means of solving the problem

[0013] A binary analysis framework for analyzing hardware binary code according to a preferred embodiment of the present invention for achieving the above objective comprises: a general-purpose intermediate language unit encompassing various binary manipulation tools; an input module that defines and inputs a low-level intermediate language semantic for various binary manipulation tools; a conversion module that correctly converts the binary code of a binary manipulation tool supporting various hardware backends or the general-purpose intermediate language proposed in the input module based on the semantic input from the input module; and a generator that automatically generates the conversion module.

[0014] In the present invention, the generator is characterized by comprising an intermediate code converter generator that generates a converter that converts the result of a binary code manipulation tool into a proposed general-purpose intermediate language based on information provided by a binary code manipulation tool that supports various hardware backends.

[0015] The present invention is characterized by including the ability to construct and utilize a vulnerability determination framework for crash classification by combining a converter generated by the intermediate code converter generator with an abstraction analyzer for advanced memory analysis.

[0016] In the present invention, the actual analysis performed in the binary analysis framework is characterized by including performing one or more of the following: abstraction analysis, crash analysis, taint analysis, and control flow analysis.

[0017] The present invention is a crash classification and vulnerability detection framework configured to allow any binary code manipulation tool to operate, rather than a single binary code manipulation tool, and is characterized by including the ability to obtain high-level abstraction analysis and crash classification results by selecting a binary code manipulation tool that most effectively supports various hardware architecture backends according to the situation.

[0018] In the present invention, the binary analysis framework for analyzing hardware binary code is characterized by being applicable to security technology as it converts into an intermediate language using a converter generated through information on existing binary manipulation tools and performs various analyses of crash analysis through abstract analysis designed to fit the intermediate language. Effects of the invention

[0019] As described above, the binary analysis framework for analyzing hardware binary code according to the present invention has the following effects.

[0020] First, the present invention adopts a crash classification and vulnerability detection framework structure configured to allow any binary code manipulation tool to operate rather than a single binary code manipulation tool, thereby enabling the selection of a binary code manipulation tool that most effectively supports various hardware architecture backends according to the situation to obtain high-level abstraction analysis and crash classification results, as well as the ability to connect any hardware backend.

[0021] Second, the present invention automatically generates an intermediate code converter for a new excellent binary code manipulation tool when it becomes available, thereby allowing the existing high-level abstraction analysis to be utilized as is.

[0022] Third, the present invention can be applied to security technology because it converts into an intermediate language using a converter generated through information on existing binary manipulation tools and enables various analyses of crash analysis through abstraction analysis designed to fit the intermediate language. Brief explanation of the drawing

[0023] FIG. 1 is a diagram illustrating the configuration of a binary analysis framework for analyzing hardware binary code according to an embodiment of the present invention. FIG. 2 is a diagram illustrating the configuration of a binary analysis framework for analyzing hardware binary code according to an embodiment of the present invention, wherein an intermediate code converter generator module is generated only once per binary tool and utilized internally. FIG. 3 is a diagram illustrating the form in which an intermediate code converter generator is utilized in the configuration of a binary analysis framework for analyzing hardware binary code according to an embodiment of the present invention. Specific details for implementing the invention

[0024] Preferred embodiments of the present invention are described below in conjunction with the attached drawings. In describing the present invention, if it is determined that a detailed description of related known technologies or configurations may unnecessarily obscure the essence of the invention, such detailed description will be omitted. Furthermore, the terms described below are defined considering their functions in the present invention, and since these may vary depending on the intentions or conventions of the user or operator, their definitions should be based on the content throughout this specification describing the binary analysis framework for analyzing hardware binary code, which is the present invention.

[0025] Hereinafter, a binary analysis framework for analyzing hardware binary code according to a preferred embodiment of the present invention will be described in detail with reference to the attached drawings.

[0026] FIG. 1 is a diagram illustrating the configuration of a binary analysis framework for analyzing hardware binary code according to an embodiment of the present invention, FIG. 2 is a diagram illustrating the configuration of a binary analysis framework for analyzing hardware binary code according to an embodiment of the present invention in which an intermediate code converter generator module is generated only once per binary tool and utilized internally, FIG. 3 is a diagram illustrating the configuration of a binary analysis framework for analyzing hardware binary code according to an embodiment of the present invention in which an intermediate code converter generator is utilized.

[0027] The binary analysis framework for analyzing hardware binary code according to the present invention is composed of a general-purpose intermediate language unit (10), an input module (20), a conversion module (30), a generator (or intermediate code converter generator) (40), a binary analysis framework (100), etc.

[0028] As illustrated in FIG. 1, the binary analysis framework (100) for analyzing hardware binary code according to the present invention comprises: a general-purpose intermediate language section (10) that encompasses various binary manipulation tools; an input module (20) that determines and inputs a low-level intermediate language semantic for various binary manipulation tools; a conversion module (30) that correctly converts the binary code of a binary manipulation tool supporting various hardware backends or the low-level intermediate language proposed in the input module (20) based on the semantic input from the input module (20) into a general-purpose intermediate language in the input module (20); and a generator (40) that automatically generates the conversion module (30).

[0029] The functions of each technical means constituting the binary analysis framework (100) for analyzing hardware binary code according to the present invention are described as follows.

[0030] The above general-purpose intermediate language unit (10) encompasses various binary manipulation tools.

[0031] The above input module (20) inputs a low-level intermediate language semantic for various binary manipulation tools.

[0032] The above conversion module (30) correctly converts the binary code of a binary manipulation tool that supports various hardware backends or the general-purpose intermediate language in the input module (20) proposed in the low-level intermediate language based on the meaning input from the above input module (20).

[0033] The generator (40) above automatically generates the conversion module (30).

[0034] Here, the generator (40) is an intermediate code converter generator (40) that generates a converter that converts the result of a binary code manipulation tool into a general-purpose intermediate language based on information provided by a binary code manipulation tool that supports various hardware backends.

[0035] In addition, a vulnerability determination framework for crash classification can be constructed and utilized by combining the converter generated from the intermediate code converter generator (40) and an abstraction analyzer for advanced memory analysis.

[0036] As described above, the actual analysis performed in the binary analysis framework is carried out in one or more of the following: abstraction analysis, crash analysis, taint analysis, and control flow analysis.

[0037] Furthermore, it is a crash classification and vulnerability detection framework configured to allow arbitrary binary code manipulation tools to operate, rather than a single one; it enables high-level abstraction analysis and crash classification results by selecting the appropriate binary code manipulation tool that most effectively supports various hardware architecture backends.

[0038] Figure 2 shows a configuration of a binary analysis framework for analyzing hardware binary code in which only one intermediate code converter generator module is generated per binary tool and utilized internally, and the analysis result is obtained by passing through the intermediate code converter generator for each existing binary manipulation tool, and then passing through an abstraction analyzer and other analyzers.

[0039] Figure 3 shows the configuration of a binary analysis framework for analyzing hardware binary code in which an intermediate code converter generator is utilized, the process of generating an intermediate code converter using the intermediate code converter generator, and the resulting converter being used to convert the actual binary code into intermediate code.

[0040] As explained above, since various substitutions, modifications, and changes are possible within the scope of the technical concept of the present invention without departing from the technical spirit of the present invention by a person skilled in the art to which the present invention pertains, the invention is not limited to the aforementioned embodiments and attached drawings.

[0041] As described above, the binary analysis framework for analyzing hardware binary code according to the present invention can be applied to security technology because it converts into an intermediate language using a converter generated through information on existing binary manipulation tools and performs various analyses of crash analysis through abstract analysis designed to suit the intermediate language. Explanation of the symbols

[0042] 10: General-purpose intermediate language section 20: Input module 30 : Conversion module 40 : Generator (or intermediate code converter generator) 100: Binary Analysis Framework

Claims

Claim 1 A binary analysis framework for analyzing hardware binary code comprises: a general-purpose intermediate language unit encompassing various binary manipulation tools; an input module that defines and inputs low-level intermediate language semantics for various binary manipulation tools; a conversion module that correctly converts binary code of a binary manipulation tool supporting various hardware backends or a low-level intermediate language proposed in the input module into a general-purpose intermediate language in the input module based on the semantics input in the input module; and a generator that automatically generates the conversion module; wherein the conversion module selects a binary code manipulation tool that most effectively supports various hardware architecture backends according to the situation, combines the conversion module generated by the generator with an abstraction analyzer for advanced memory analysis to construct a vulnerability determination framework for crash classification, and performs abstraction analysis, crash analysis, taint analysis, and control flow analysis in the constructed vulnerability determination framework for crash classification. Claim 2 A binary analysis framework for analyzing hardware binary code, characterized in that, in claim 1, the generator is an intermediate code converter generator that generates a converter that converts the result of a binary code manipulation tool into a proposed general-purpose intermediate language based on information provided by a binary code manipulation tool that supports various hardware backends. Claim 3 A binary analysis framework for analyzing hardware binary code, characterized in that, in paragraph 2, it includes the ability to construct and utilize a crash classification vulnerability determination framework by combining a converter generated from the intermediate code converter generator and an abstraction analyzer for advanced memory analysis. Claim 4 delete Claim 5 A binary analysis framework for analyzing hardware binary code, characterized in that, in claim 1, it is a crash classification and vulnerability detection framework configured to allow any binary code manipulation tool to operate rather than a single binary code manipulation tool, and includes the ability to obtain high-level abstraction analysis and crash classification results by selecting a binary code manipulation tool that most effectively supports various hardware architecture backends according to the situation. Claim 6 A binary analysis framework for analyzing hardware binary code according to claim 1, characterized in that it can be applied to security technology by converting into an intermediate language using a converter generated through information on existing binary manipulation tools and performing various analyses of crash analysis through abstract analysis designed to fit the intermediate language.

Images