Executable Binary Disassembly via Runtime API Monitoring
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The inverse process of converting machine instructions back into human-readable code is challenging due to non-uniqueness and the absence of symbol table information, making it difficult to accurately disassemble executable binaries, especially for debugging and vulnerability detection.
Innovation Solution
A method involving runtime monitoring of API/system calls and control transfers to generate and validate disassembly traces, using software hooks and event lists to improve the disassembly process, allowing for accurate and efficient disassembly of executable binaries without relying on symbol tables.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional disassembly methods are used without runtime information, then the disassembly process is simpler and faster, but the accuracy and reliability of disassembly traces deteriorate due to non-unique parsing and missing symbol table information
Solution Approach 1:
The system performs preliminary runtime monitoring to collect API/system call events and control transfer information before the actual disassembly process. This pre-collected information is then used to validate disassembly traces, improving accuracy without adding complexity to the core disassembly algorithm.
Solution Approach 2:
The patent introduces an intermediary validation mechanism that uses runtime-collected events as a reference standard. This intermediary layer mediates between the disassembler output and the final results, validating traces against observed runtime behavior without requiring modifications to the disassembler itself.
2Reliability
If runtime monitoring is implemented to collect API/system call events and control transfers, then disassembly trace validation accuracy improves, but the complexity and overhead of the disassembly system increases
Solution Approach 1:
The patent extracts only the essential runtime information needed for validation - specifically API/system call events and control transfer information - rather than monitoring all program execution. This selective extraction provides sufficient validation data while minimizing monitoring overhead and system complexity.
Solution Approach 2:
The system uses the program's own runtime behavior (its actual API calls and control transfers) as the validation reference. This self-service approach eliminates the need for external ground truth data or complex comparison mechanisms, simplifying the validation system while maintaining high reliability.
3Measurement precision
If multiple disassembly traces are generated and validated against runtime events, then the precision of identifying correct disassembly improves, but the time and computational resources required increase
Solution Approach 1:
The system implements feedback validation where each generated disassembly trace is checked against the pre-collected runtime events. Traces that contradict observed runtime behavior are immediately discarded, providing rapid elimination of incorrect traces without requiring exhaustive analysis of all possibilities.
Solution Approach 2:
Rather than attempting to generate and validate every possible disassembly trace, the system validates traces selectively based on their consistency with key runtime events. This partial validation approach achieves sufficient precision for practical purposes while avoiding the exponential time cost of exhaustive trace validation.
Data Source
AI summary
In another aspect, method useful for monitoring of an API/system call implemented by an application for generating disassembly of an executable binary of the application, includes the steps of scanning a computer system for an executable application. The method includes the step of scanning the computer system for a running process associated with the executable binary. The method includes the step of initiating an application programming interface (API) call monitoring method that associates an observed API/system call with the executable binary. The method includes the step of reporting a set of collected events to a local server.