Declarative Logic Binary Disassembly with Datalog Inference
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing disassembly techniques face challenges in generating accurate and reassemblable disassemblies due to lossy assembly and compilation processes, ambiguity in machine language interpretation, and many-to-many operations, which can lead to inaccuracies and ambiguities, particularly in security vulnerability analysis and mission-critical operations.
Innovation Solution
A method involving declarative logic using Datalog to parse and decode executable code, with inference modules for disambiguating symbols and memory addresses, identifying functions, and organizing content into valid assembler code, incorporating soft heuristics and hard rules to enhance accuracy and reassemblability.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If traditional disassembly techniques are used, then human readability is improved, but reassemblability and accuracy deteriorate
Solution Approach 1:
The disassembly process is segmented into multiple independent inference modules (code inference module, symbolization module, function inference module) that operate on a fact database. Each module handles specific aspects of disassembly independently, allowing the system to maintain both readability and reassemblability by organizing information in a structured, modular manner.
Solution Approach 2:
A fact database serves as an intermediary between the binary code and the final disassembled assembly code. The declarative logic inference modules query this fact database to generate disassembly output, ensuring that the intermediate representation preserves sufficient information for reassemblability while presenting human-readable output.
2Measurement precision
If declarative logic with multiple inference modules is used, then disassembly accuracy is improved, but system complexity increases
Solution Approach 1:
The fact database serves multiple functions: it stores binary code information, intermediate analysis results, and serves as a queryable knowledge base for all inference modules. This universal data structure reduces overall system complexity by providing a single source of truth that all modules can access and contribute to.
Solution Approach 2:
The inference modules use declarative logic to automatically query and process information from the fact database without requiring complex control flow management. The declarative nature of the logic allows the system to self-organize the disassembly process, reducing the complexity of coordinating multiple modules while maintaining high accuracy.
3Productivity
If lossy assembly and compilation processes are used, then productivity is improved, but information completeness deteriorates
Solution Approach 1:
The system performs preliminary analysis of the binary code to build a comprehensive fact database before generating the final disassembly. This preliminary action captures variable type information and other semantic details that would otherwise be lost in traditional lossy compilation processes, enabling accurate reassemblability while maintaining productivity.
Data Source
AI summary
Certain example embodiments relate to techniques for generating reassemblable disassemblies of binaries using declarative logic. A declarative logic programming language (e.g., Datalog) is used to compile reverse engineering, binary analysis, and disassembly rules into a format applicable to an executable program, yielding disassembly of that program. Datalog, for example, can be used as a query language for deductive databases, to facilitate this approach. Certain example embodiments thus involve (1) preparation of an executable for Datalog analysis, (2) inference rules and the application of Datalog for program analysis, including the application of Datalog to the domain of binary reverse engineering and analysis, and (3) the collection of assembly code from the results of the Datalog analysis. These rules can include both “hard rules” and “soft rules” or heuristics, even though standard Datalog does not support the latter.