Get Rid of Inline Assembly through Verification-Oriented Lifting

Abstract

Formal methods for software development have made great strides in the last two decades, to the point that their application in safety-critical embedded software is an undeniable success. Their extension to non-critical software is one of the notable forthcoming challenges. For example, C programmers regularly use inline assembly for low-level optimizations and system primitives. This usually results in rendering state-ofthe-art formal analyzers developed for C ineffective. We thus propose TINA, the first automated, generic, verification-friendly and trustworthy lifting technique turning inline assembly into semantically equivalent C code amenable to verification, in order to take advantage of existing C analyzers. Extensive experiments on real-world code (including GMP and ffmpeg) show the feasibility and benefits of TINA.Assuming no side-effect beyond those mentioned in output operands'. 1 # 54 "/usr/include/i386-linux-gnu/sys/select.h" 2 typedef long int __ fd _ mask; 3 4 # 64 "/usr/include/i386-linux-gnu/sys/select.h" 5 typedef struct { 6 __ fd _ mask __ fds _ bits[1024 / (8 * sizeof( __ fd _ mask))]; 7 } fd _ set; 8 9 # 1074 "socklib.c" 10 int udpc _ prepareForSelect 11 (int * socks, int nr, fd _ set * read _ set) 12 { 13 / * [...] * / 14 int maxFd; 15 do { 16 int __ d0, __ d1; 17 __ asm __ __ volatile __ 18 ("cld; rep; " "stosl" 19: "=c" ( __ d0), "=D" ( __ d1) 20 : "a" (0), 21 "0" (sizeof(fd _ set) / sizeof( __ fd _ mask)), 22 void sub _ median _ pred _ mmxext(uint8 _ t * dst, uint8 _ t const * src1,

Not All Bugs Are Created Equal, But Robust Reachability Can Tell the Difference

“…We propose Binsec/RSE, the first symbolic execution engine dedicated to robust reachability. We base our proof-of-concept on Binsec [23], a binary executable formal analysis engine written in OCaml and already used in several significant case studies [19,20,43]. For the sake of experimental evaluation (Sect.…”

Interface Compliance of Inline Assembly: Automatically Check, Patch and Refine

“…Assembly code lifting and mixed code verification. Two recent works [1], [6] lift GNU inline assembly to semantically equivalent C code in order to perform verification of mixed codes combining C and inline assembly. Their work is complementary to ours: their lifting assume interface compliance but in turn they can prove functional correctness of assembly chunks.…”

“…Binary-level analysis. While binary-level semantic analysis is hard [30], [31], [32], [33], inline assembly chunks offer nice structural properties [1] allowing efficient and precise analysis. We also benefit from previous engineering efforts on generic binary lifters [10], [11], [25].…”

“…Inline assembly, i.e. embedding assembly code inside a higher-level host language, is still a common practice in lowlevel C /C + + programming, for efficiency reasons or for accessing specific hardware resources -it is typically widespread in resource-sensitive areas such as cryptography, multimedia, drivers, system, automated trading or video games [1], [2]. Recoules et al [1] estimate that 11% of Debian packages written in C /C + + directly or indirectly depend on inline assembly, including major projects such as GMP or ffmpeg, while 28% of the top rated C projects on GitHub contain inline assembly according to Rigger et al [2].…”

“…Note that recent attempts for verifying codes mixing C and assembly [1], [6] simply assume interface compliance.…”