Live Debugging of Transformed Binaries via In-Memory Symbol Mapping
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Debugging software that has undergone binary transformation, such as Load-time Function Randomization, becomes challenging due to the reorganization of machine code in memory, rendering original debugging data obsolete and making it difficult for developers to validate and develop the program effectively.
Innovation Solution
The solution involves creating an in-memory object file with updated debug data or restructuring the original debug file to reflect the reorganization of function blocks, using techniques like Load-time Function Randomization and Just-In-Time compilation, to maintain linkages between debug data and the transformed binary, facilitating live and post-mortem debugging.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If binary transformation is applied to reorganize machine code in memory for cybersecurity fortification, then security against attackers is improved, but debugging capability deteriorates because original debugging data loses meaningful linkage to the reordered executable
Solution Approach 1:
The patent introduces a mapping data structure that acts as an intermediary between the original debugging data and the transformed binary. This mapping maintains the correspondence between original function locations and their new locations after transformation, allowing the debugger to translate addresses and symbols correctly without breaking the security benefits of binary transformation.
Solution Approach 2:
The patent performs preliminary actions by capturing and storing the transformation mapping information before the binary transformation is applied. By recording the original-to-transformed location mappings in advance, the system ensures that debugging data remains valid even after the executable code is reorganized, thus preserving debugging capability while maintaining security.
2Reliability
If binary transformation reorganizes portions of the executable in memory, then cybersecurity fortification is improved, but the validity of original debugging data deteriorates
Solution Approach 1:
The patent introduces a mapping data structure that acts as an intermediary between the original debugging data and the transformed binary. This mapping maintains the correspondence between original function locations and their new locations after transformation, allowing the debugger to translate addresses and symbols correctly without breaking the security benefits of binary transformation.
Solution Approach 2:
The patent creates a copy of the transformation mapping information that preserves the relationship between original and transformed code locations. This copied mapping data is stored separately and used by the debugger to reconstruct the correct view of the program, ensuring debugging data validity is maintained despite the binary transformation.
3Ease of operation
If debug data is updated to reflect reorganization from binary transformation, then debugging capability is maintained, but system complexity increases
Solution Approach 1:
The patent segments the debugging system into distinct components: the original debugging data, the transformation mapping data structure, and the address translation mechanism. This segmentation allows each component to remain relatively simple while collectively maintaining full debugging capability, as the complexity is distributed rather than concentrated in a single system.
Data Source
AI summary
A method, system, or apparatus to debug software that is reorganized in memory is presented. An interactive debugging session is established with an executable code component corresponding to a packed binary file includes machine code that corresponds to blocks of original source code. A randomly reorganized layout of the machine code is generated in memory based on a transformation defined in a function randomization library. An in-memory object file is created by using a debug data component corresponding to the packed binary file. The debug data component includes symbol table information to debug the blocks of the original source code generated prior to the randomly reorganized layout. The symbol table information is updated based on the randomly reorganized layout of the machine code, and the debugger program is instructed to load the in-memory object file with the updated symbol information to debug the blocks of the original source code.