Binary Type Confusion Detection via Class Hierarchy Restoration
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for detecting type confusion bugs in C++ binaries are limited, as they require source code and are not effective for black-box testing, particularly in performance-critical software where dynamic_cast is not used due to performance concerns.
Innovation Solution
A method for detecting type confusion bugs in binary code through dynamic analysis by restoring class and inheritance relationships, recognizing virtual function tables, and identifying target areas to determine if type confusion occurs during execution without requiring source code.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If dynamic_cast is used to verify typecasting compatibility at runtime, then type confusion bug detection capability is improved, but program execution speed deteriorates
Solution Approach 1:
The patent performs preliminary analysis of the binary code to restore class hierarchy information and identify valid typecasting paths before runtime execution. By pre-computing which typecasts are safe based on the restored class relationships, the system avoids the need for slow runtime type verification while still detecting type confusion bugs when they occur.
2Measurement precision
If source code is required to detect type confusion bugs, then detection precision is improved, but applicability to black-box testing deteriorates
Solution Approach 1:
The patent creates a copy of the class hierarchy information by analyzing and restoring it from the compiled binary code itself. Instead of requiring the original source code, the system extracts and reconstructs class relationships, inheritance structures, and typecasting rules directly from the binary, enabling precise type confusion detection in black-box testing scenarios.
3Speed
If static_cast is used for typecasting in performance-critical software, then program execution speed is improved, but type confusion bug risk increases
Solution Approach 1:
The patent introduces an intermediary layer that analyzes binary code to restore class hierarchy information and identify safe typecasting operations. This intermediary analysis enables the system to verify type safety without inserting slow runtime checks into the execution path, thus maintaining the speed benefits of static_cast while providing type confusion bug detection through separate binary analysis.
Data Source
AI summary
According to some exemplary embodiments of the present disclosure, disclosed is a method for detecting a type confusion bug of a binary code target of an object-oriented programming language using a processor of a computing device. The method may include: restoring at least one class and an inheritance relationship of at least one class by analyzing a binary code of an object-oriented programming language; recognizing a layout of at least one class by using at least one class and the inheritance relationship; and detecting the type confusion bug by using the layout of at least one class.


