Binary Function Entry Determination via End Branch Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional methods for identifying binary function entries in binary analysis are inaccurate and time-consuming, especially when using static analysis or meta information, and are not applicable to x86 binaries without meta data, and existing machine learning-based approaches vary in accuracy depending on compiler types and options.
Innovation Solution
A method and apparatus that determine binary function entries by parsing binary code to identify the location of end branch instructions representing indirect branch targets, excluding indirect return function call addresses and exception handling blocks, and selecting tail calls from direct jump targets to implement control flow integrity in hardware.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional static analysis is used to identify binary function entries, then analysis completeness may be improved, but analysis time increases significantly
Solution Approach 1:
The patent segments the binary code into text section and exception handling section, then further segments the analysis by identifying end branch instructions as key markers. This segmentation allows the system to focus analysis on critical locations rather than performing exhaustive static analysis on the entire binary, thereby reducing analysis time while maintaining identification accuracy.
Solution Approach 2:
The patent performs preliminary disassembly of the text section to identify end branch instructions, direct call targets, and direct jump targets before proceeding to function entry determination. By preparing these key elements in advance, the system avoids time-consuming analysis during the function entry identification phase, thus reducing overall analysis time while maintaining reliability.
2Extent of automation
If machine learning-based pattern generation is used, then automation is improved, but accuracy varies depending on compiler types and options
Solution Approach 1:
The patent employs a self-service approach by using end branch instructions (which are hardware-defined markers) as the basis for function entry identification. This method does not require external training data or compiler-specific patterns, making it universally applicable across different compiler types and options while maintaining high accuracy and full automation.
3Productivity
If meta information is used for function identification, then identification speed is improved, but applicability is limited to binaries with meta information
Solution Approach 1:
The patent extracts function entry information directly from the binary code structure itself, specifically from end branch instructions and control flow patterns, rather than relying on external meta information. This extraction approach removes the dependency on meta information, making the method universally applicable to all x86/x64 binaries regardless of whether they contain symbols or debugging information, while maintaining fast identification speed.
4Ease of operation
If conventional pattern-based analysis is used, then ease of operation is improved, but patterns require manual updates
Solution Approach 1:
The patent uses end branch instructions, which are hardware-defined and universally present in x86/x64 binaries with Control Flow Enforcement Technology. These instructions serve as self-identifying markers that do not require manual pattern creation or updates. The method automatically identifies function entries by detecting these standardized markers, simplifying operation while eliminating pattern maintenance complexity.
Data Source
AI summary
A method for determining a binary function entry includes distinguishing a text section and an exception handling section by parsing a binary code, disassembling the text section to determine an address of an end branch instruction, an address of a direct call target, and an address of a direct jump target, determining an indirect return function call address from the addresses of the end branch instructions, determining an exception handling block address from the addresses of the end branch instructions, excluding the indirect return function call address and the exception handling block address from the addresses of the end branch instructions and determining a tail call corresponding to the binary function entry from the addresses of the direct jump targets.