Declarative Demand-Driven Reverse Engineering

Abstract

interactively, via a GUI or CLI) in a variety of ways. For example, a reverse engineer looking for a time bomb may first search for calls to the system's time function, and then walk backwards to understand whether each call is associated with legitimate or malicious behavior. In doing so, the RE may need to reason about, e.g., indirect control flow, or even identify the time function (in a stripped binary). Because REs are expert users, and often skilled programmers, RE tools provide programmatic interfaces that enable REs to systematize reasoning tasks via extensions. A broad range of popular extensions exist for several tools which perform such tasks as loading the results of static analyses [7], [8], interacting with debuggers [9], and identifying common cryptographic-relevant code [10].In this paper, we argue that deductive databases (e.g., Datalog) serve as a natural abstraction boundary between RE tools and logical inference tasks over binaries. We envision a future in which a reverse engineer interactively explores a binary using an RE tool while simultaneously querying arbitrarilycomplex logical properties written in a terse declarative style. We call this Declarative Demand-Driven Reverse Engineering (henceforth D 3 RE). In D 3 RE, an RE interacts with a deductive database by giving inputs (e.g., the currently highlighted address) to a rule-based deductive inference system written in a declarative language such as Datalog. Rules inductively compute relations over facts about the binary. As an example, consider a relation direct call ∈ Addr × Addr which relates callsite addresses (offsets within the binary) to procedure invocation target addresses. In our vision, D 3 RE allows REs to interactively compute with and visualize the results of queries over these deductive rules.We see D 3 RE as a natural extension of several observations about the state of the start. First, many existing RE tools assemble databases to index various properties (e.g., addresses, symbols, etc...) of binaries for quick exploration. Deductive databases further allow REs to write arbitrary logical queries which are computed maximally efficiently via, e.g., compilation to relational algebra kernels as done in Soufflé. Deductive databases have also enabled several recent advances in binary analysis demonstrating both efficiency and robustness over conventional techniques. For example, the Datalogbased disassembler ddisasm achieves both faster and moreprecise disassembly than other state-of-the-art disassemblers, and OOAnalyzer uses Prolog to enable declarative recovery of classes from compiled C++ code.In this short paper we describe our progress in implementing a prototype tool, d3re, which we are building to realize the Abstract-Binary reverse engineering is a challenging task because it often necessitates reasoning using both domain-specific knowledge (e.g., understanding entrypoint idioms common to an ABI) and logical inference (e.g., reconstructing interprocedural control flow). To help perform these tasks, reverse engineers oft...