Binary Code Security Analysis via Assembly Disassembly
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for detecting security risks in binary software code, particularly in sideloaded applications, are inadequate as they fail to effectively identify malicious modifications such as junk routines or NOP instructions that can pose security threats.
Innovation Solution
An electronic device analyzes binary software code by disassembling it into assembly instructions, searching for patterns and frequencies of specific instructions like NOP, and determining security risks based on thresholds and expected locations, preventing installation if risks are detected.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If binary software code is disassembled and analyzed for security risks, then detection precision is improved, but device complexity increases
Solution Approach 1:
The security analysis system is divided into distinct modules: a disassembly module that converts binary code to assembly instructions, a search module that identifies specific instructions, a determination module that assesses security risks, and a notification module that alerts users. This segmentation allows each module to perform its function independently, improving detection precision while managing system complexity through modular design.
Solution Approach 2:
The system performs disassembly of binary software code into assembly instructions before conducting security analysis. This preliminary action transforms the code into a more analyzable format, enabling the subsequent search for specific instructions (such as NOP instructions) and accurate determination of security risks without requiring complex real-time analysis of binary format.
2Reliability
If comprehensive security analysis is performed on all binary code, then reliability is improved, but productivity decreases
Solution Approach 1:
Instead of performing exhaustive analysis on all binary code, the system applies partial action by searching for specific security-critical instructions (such as NOP instructions) that are indicative of malicious modifications. This targeted approach maintains high reliability for detecting known security threats while preserving installation productivity by avoiding unnecessary comprehensive analysis of benign code.
Solution Approach 2:
The system provides feedback to users through notifications when security risks are detected in sideloaded applications. This feedback mechanism allows users to make informed decisions about whether to proceed with installation, balancing security reliability with user convenience and maintaining overall system productivity by allowing safe installations to proceed without interruption.
Data Source
Figure 1~2
Figure 3
Figure 4
AI summary
Systems, methods, and software can be used to detect security risks in binary software code. In some aspects, a computer-implemented method comprises: receiving, at an electronic device, a set of binary software code to be loaded onto the electronic device; disassembling, by the electronic device, the set of binary software code into a set of assembly code; determining, by the electronic device, a number of occurrences of an assembly instruction in the set of assembly code; and determining, by the electronic device, whether the set of binary software code has a security risk based on the number of occurrences of the assembly instruction.