Scalable, Sound, and Accurate Jump Table Analysis
Jump tables are a common source of indirect jumps in binary code. Resolving these indirect jumps is critical for constructing a complete control-flow graph, which is an essential first step for most applications involving binaries, including binary hardening and instrumentation, binary analysis and fuzzing for vulnerability discovery, malware analysis and reverse engineering. Existing techniques for jump table analysis generally prioritize performance over soundness. While lack of soundness may be acceptable for applications such as decompilation, it can cause unpredictable runtime failures in binary instrumentation applications. We therefore present SJA, a new jump table analysis technique in this paper that is sound and scalable. Our analysis uses a novel abstract domain to systematically track the "structure" of computed code pointers without relying on syntactic pattern-matching that is common in previous works. In addition, we present a bounds analysis that efficiently and losslessly reasons about equality and inequality relations that arise in the context of jump tables. As a result, our system reduces miss rate by 35× over the next best technique. When evaluated on error rate based on F1-score, our technique outperforms the best previous techniques by 3×.
Thu 19 SepDisplayed time zone: Amsterdam, Berlin, Bern, Rome, Stockholm, Vienna change
13:30 - 14:50 | Static analysisTechnical Papers at EI 9 Hlawka Chair(s): Dominik Helm University of Duisburg-Essen; TU Darmstadt; National Research Center for Applied Cybersecurity ATHENE | ||
13:30 20mTalk | Precise Compositional Buffer Overflow Detection via Heap DisjointnessACM SIGSOFT Distinguished Paper Award Technical Papers Yiyuan Guo Hong Kong University of Science and Technology, Peisen Yao Zhejiang University, Charles Zhang Hong Kong University of Science and Technology DOI Pre-print | ||
13:50 20mTalk | Finding Cuts in Static Analysis Graphs to Debloat Software Technical Papers Christoph Blumschein Hasso Plattner Institute; University of Potsdam, Fabio Niephaus Oracle Labs, Codrut Stancu Oracle Labs, Christian Wimmer Oracle Labs, Jens Lincke Hasso Plattner Institute; University of Potsdam, Robert Hirschfeld Hasso Plattner Institute; University of Potsdam DOI Pre-print | ||
14:10 20mTalk | Scalable, Sound, and Accurate Jump Table Analysis Technical Papers Huan Nguyen Stony Brook University, Soumyakant Priyadarshan Stony Brook University, R. Sekar Stony Brook University DOI | ||
14:30 20mTalk | Better Not Together: Staged Solving for Context-Free Language Reachability Technical Papers Chenghang Shi Institute of Computing Technology at Chinese Academy of Sciences; University of Chinese Academy of Sciences, Haofeng Li Institute of Computing Technology at Chinese Academy of Sciences, Jie Lu Institute of Computing Technology at Chinese Academy of Sciences, Lian Li Institute of Computing Technology at Chinese Academy of Sciences; University of Chinese Academy of Sciences DOI Pre-print |