Post-Mortem Debugging of Transformed Binaries
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Debugging software that has undergone binary transformation, such as Load-time Function Randomization, becomes challenging due to the reorganization of machine code in memory, rendering original debugging data obsolete and making it difficult for developers to validate and develop the program effectively.
Innovation Solution
The solution involves creating an in-memory object file with updated debug data or restructuring the original debug file to reflect the reorganization of function blocks, using techniques like Load-time Function Randomization and Just-In-Time compilation, to maintain linkages between debug data and the transformed binary, facilitating live and post-mortem debugging.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If binary transformation is applied to reorganize machine code in memory for cybersecurity fortification, then security against attackers is improved, but debugging capability deteriorates because original debugging data loses meaningful linkage to the reordered executable
Solution Approach 1:
The patent introduces an intermediary mapping structure that connects original debugging data to transformed binary code. This mapping acts as a mediator that preserves the relationship between debug information and reordered machine code, allowing debuggers to function correctly even after binary transformation. The mapping translates debugger requests using original addresses to the new addresses after reorganization, thus maintaining debugging capability while preserving security transformations.
2Reliability
If binary transformation reorganizes portions of the executable in memory, then cybersecurity protection is enhanced, but the ability to validate and develop source code deteriorates due to loss of meaningful linkage in debugging data
Solution Approach 1:
The patent performs preliminary actions by creating and storing a mapping of original addresses to transformed addresses before the binary transformation takes effect. This pre-established mapping allows the debugger to later translate addresses and maintain source code validation capability. The mapping is prepared in advance so that when debugging occurs after transformation, the linkage between source code and machine code is restored through the pre-computed address translations.
3Reliability
If random ordering of executable portions is applied for security fortification, then resistance to attacks is improved, but debugging efficiency deteriorates due to obsolete debugging data
Solution Approach 1:
The patent implements a feedback mechanism where the mapping structure receives information about the actual reorganization performed by the binary transformation and uses this feedback to adjust address translations. The system monitors how code portions were reordered and feeds this information back into the mapping logic, enabling accurate address translation that maintains debugging efficiency despite the random reordering for security purposes.
Data Source
AI summary
A method, system, or apparatus to debug software that is reorganized in memory is presented. A post-mortem debugging session is established by loading an executable code component corresponding to a packed binary file into memory. A randomly reorganized layout of the machine code corresponding to the blocks of the original source code is generated based on a transformation defined in a function randomization library corresponding to the blocks of original source code. A core dump file corresponding to the crash event associated with the executing of the executable code component and a debug data file that includes symbol table information to debug the blocks of the original source code are received. An updated debug data file is generated that includes symbol table information corresponding to the randomly reorganized layout. A debugger program is called with the executable code component, the core dump file, and the updated debug data file.