Interprocedural static slicing of binary executables

Abstract

Although the slicing of programs written in a high-level language has been widely studied in the literature, very little work has been published on the slicing of binary executable programs. The lack of existing solutions is really hard to understand since the application domain for slicing binaries is similar to that for slicing high-level languages. In this paper we present a method for the interprocedural static slicing of binary executables. We applied our slicing method to real size binaries and achieved an interprocedural slice size of between 56%-68%. We used conservative approaches to handle unresolved function calls and branching instructions. Our current implementation contains an imprecise (but safe) memory dependence model as well. However, this conservative slicing method might still be useful in analysing large binary programs. In the paper we suggest some improvements to eliminate useless edges from dependence graphs as well.

Firmalice - Automatic Detection of Authentication Bypass Vulnerabilities in Binary Firmware

“…The extracted authentication slice 5 is then passed to Firmalice's Symbolic Execution engine. This engine explores the slice symbolically, and attempts to find user inputs that would reach the privileged program point.…”

“…That is, starting from a given program point, we can produce every statement on which that point depends. This step leverages slicing techniques from existing work in the literature [5]. Slicing is used to improve the feasibility of the symbolic analysis on large binaries, in two ways.…”

Using Dynamic Information in the Interprocedural Static Slicing of Binary Executables

“…In previous work (Kiss et al, 2003) we furnished two static methods for improving the slicing of binaries. The first approach described how architecture specific knowledge could be used to extract information from function prologs and epilogs in order to determine the output parameters of functions more precisely.…”

“…However, static slices of even small programs are in many cases too large (Beszédes et al, 2002), which means that often too large portions of the code still need to be examined. In our previous paper (Kiss et al, 2003) we applied interprocedural static slicing on real life binary executables and achieved an average slice size of 56-68%. We looked for ways of improving static data dependence analysis but found that, although the number of data dependences could be reduced significantly, sometimes even by 59%, this reduction was not reflected in the size of the slices, which only dropped by 1-4%.…”

Improved Memory-Access Analysis for x86 Executables

“…Research carried out during the last decade by our research group [64,65,6,56,55,7,8,36,4,49,9] as well as by others [48,22,33,14,2,31,13,44,32,3,54,37,21,46,28,19,16,34,66] has developed the foundations for performing static analysis at the machine-code level. The machine-code-analysis problem comes in two versions: (i) with symbol-table/debugging information (unstripped executables), and (ii) without symbol-table/debugging information (stripped executables).…”