Binary Type Confusion Detection via Class Hierarchy Restoration

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Current methods for detecting type confusion bugs in C++ binaries are limited, as they require source code and are not effective for black-box testing, particularly in performance-critical software where dynamic_cast is not used due to performance concerns.

Innovation Solution

A method for detecting type confusion bugs in binary code through dynamic analysis by restoring class and inheritance relationships, recognizing virtual function tables, and identifying target areas to determine if type confusion occurs during execution without requiring source code.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If dynamic_cast is used to verify typecasting compatibility at runtime, then type confusion bug detection capability is improved, but program execution speed deteriorates

Engineering Contradiction:
Improvetype confusion bug detection capabilityVSAvoidprogram execution speed
Core Design Contradiction:
ReliabilityVSSpeed

Solution Approach 1:

The patent performs preliminary analysis of the binary code to restore class hierarchy information and identify valid typecasting paths before runtime execution. By pre-computing which typecasts are safe based on the restored class relationships, the system avoids the need for slow runtime type verification while still detecting type confusion bugs when they occur.

Inventive Principle:
Principle #10Preliminary action

2Measurement precision

If source code is required to detect type confusion bugs, then detection precision is improved, but applicability to black-box testing deteriorates

Engineering Contradiction:
Improvetype confusion bug detection precisionVSAvoidapplicability to black-box testing
Core Design Contradiction:
Measurement precisionVSAdaptability or versatility

Solution Approach 1:

The patent creates a copy of the class hierarchy information by analyzing and restoring it from the compiled binary code itself. Instead of requiring the original source code, the system extracts and reconstructs class relationships, inheritance structures, and typecasting rules directly from the binary, enabling precise type confusion detection in black-box testing scenarios.

Inventive Principle:
Principle #26Copying

3Speed

If static_cast is used for typecasting in performance-critical software, then program execution speed is improved, but type confusion bug risk increases

Engineering Contradiction:
Improveprogram execution speedVSAvoidtype safety
Core Design Contradiction:
SpeedVSReliability

Solution Approach 1:

The patent introduces an intermediary layer that analyzes binary code to restore class hierarchy information and identify safe typecasting operations. This intermediary analysis enables the system to verify type safety without inserting slow runtime checks into the execution path, thus maintaining the speed benefits of static_cast while providing type confusion bug detection through separate binary analysis.

Inventive Principle:
Principle #24Intermediary (Mediator)

Data Source

PatentUS20240281361A1Bintyper: type confusion bug detection for c++ program binaries
Publication Date: 2024.08.22 KOREA UNIV RES & BUSINESS FOUND
  • US20240281361A1 patent drawing
  • US20240281361A1 patent drawing
  • US20240281361A1 patent drawing

AI summary

According to some exemplary embodiments of the present disclosure, disclosed is a method for detecting a type confusion bug of a binary code target of an object-oriented programming language using a processor of a computing device. The method may include: restoring at least one class and an inheritance relationship of at least one class by analyzing a binary code of an object-oriented programming language; recognizing a layout of at least one class by using at least one class and the inheritance relationship; and detecting the type confusion bug by using the layout of at least one class.