Binary Code Vulnerability Detection via Memory-Write Profile Analysis

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Detecting software vulnerabilities in binary code without source code is challenging, as the binary code is not human-readable, making it difficult to assess its ability to handle fault injections, and distinguishing between non-damaging and damaging behavior changes is crucial for security.

Innovation Solution

Monitoring and identifying behavior changes through memory-write patterns during fault injection, using a software analysis platform that generates base and test memory-write profiles to determine the impact of input changes and memory corruption, allowing for cross-validation with error alerts to assess the software's handling of faults.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Adaptability or versatility

If source code is not available for analysis, then the analysis can be performed on compiled binary code, but the ability to detect software vulnerabilities and assess fault handling capability is significantly reduced

Engineering Contradiction:

Improveability to analyze software without source codeVSAvoidvulnerability detection accuracy

Core Design Contradiction:

Adaptability or versatilityVSMeasurement precision

Solution Approach 1:

The patent creates a shadow memory that copies and tracks the memory access patterns of the binary code execution. By monitoring the shadow memory writes instead of directly analyzing the binary code or source code, the system can detect vulnerabilities and assess fault handling capability through behavioral observation rather than code inspection

Inventive Principle:

Principle #26Copying

Solution Approach 2:

The patent replaces traditional static code analysis methods with dynamic runtime behavioral monitoring. Instead of mechanically parsing and analyzing code structure, the system substitutes this with observing the actual execution behavior through memory access patterns, allowing vulnerability detection without source code

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

2Ease of manufacture

If binary code is analyzed directly without source code, then analysis can proceed on compiled code, but the binary code is not human-readable and cannot be easily parsed or analyzed

Engineering Contradiction:

Improveease of code analysisVSAvoidbinary code parseability

Core Design Contradiction:

Ease of manufactureVSDifficulty of detecting and measuring

Solution Approach 1:

The patent introduces shadow memory as an intermediary between the binary code execution and the analysis system. The shadow memory captures and externalizes the memory access patterns, transforming the unparseable binary code behavior into observable and analyzable data that can be monitored and evaluated

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The patent substitutes traditional code parsing and static analysis methods with dynamic runtime monitoring of memory behavior. This replacement transforms the intractable problem of parsing binary code into the manageable task of observing and analyzing memory access patterns during execution

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

3Reliability

If fault injection is performed to test software resilience, then security assessment can be improved, but distinguishing between non-damaging and damaging behavior changes becomes challenging

Engineering Contradiction:

Improvesoftware fault handling capabilityVSAvoidbehavior change impact assessment

Core Design Contradiction:

ReliabilityVSDifficulty of detecting and measuring

Solution Approach 1:

The patent implements a feedback mechanism where the shadow memory continuously monitors memory access patterns during fault injection. By comparing the observed behavior against expected baseline patterns, the system can determine whether fault-induced behavior changes are damaging or non-damaging, providing feedback on software resilience without requiring source code

Inventive Principle:

Principle #23Feedback

Solution Approach 2:

The patent creates a copy of the memory access behavior through shadow memory monitoring. This copied behavioral trace allows for comparison and analysis of fault-induced changes, enabling the distinction between acceptable and damaging behavior modifications without needing to understand the underlying source code logic

Inventive Principle:

Principle #26Copying

Data Source

PatentUS12182271B2Detecting software vulnerabilities in a binary code

Publication Date: 2024.12.31 BLACKBERRY LTD

AI summary

Systems, methods, and software can be used to detect software errors in a binary code. In some aspects, a method comprises: obtaining a binary code; generating a base memory-write profile for the binary code, wherein the base memory-write profile comprises a count of memory updates for each of a plurality of memory locations during an execution of the binary code according to a base input; for each of a plurality of test inputs, generating a test memory-write profile for the binary code, wherein the test memory-write profile comprises a count of memory updates for each memory location during an execution of the binary code according to the test input; comparing the base memory-write profile and the plurality of test memory-write profiles; and generating a notification based on the comparison, wherein the notification indicates whether there is a difference between the base memory-write profile and the plurality of test memory-write profiles.