Learning Types for Binaries

Abstract

Type inference for Binary codes is a challenging problem due partly to the fact that much type-related information has been lost during the compilation from high-level source code. Most of the existing research on binary code type inference tend to resort to program analysis techniques, which can be too conservative to infer types with high accuracy or too heavyweight to be viable in practice. In this paper, we propose a new approach to learning types for recovered variables from their related representative instructions. Our idea is motivated by "duck typing", where the type of a variable is determined by its features and properties. Our approach first learns a classifier from existing binaries with debug information and then uses this classifier to predict types for new, unseen binaries. We have implemented our approach in a tool called BITY and used it to conduct some experiments on a well-known benchmark coreutils (v8.4). The results show that our tool is more precise than the commercial tool Hey-Rays, both in terms of correct types and compatible types. 1 Introduction Binary code type inference aims to infer a high-level typed variables from executables, which is required for, or significantly benefits, many applications such as decompilation, binary code rewriting, vulnerability detection and analysis, binary code reuse, protocol reverse engineering, virtual machine introspection, game hacking, hooking, malware analysis, and so on. However, unlike high-level source codes, binary code type inference is challenging because, during compilation, much program information is lost, particularly, the variables that store the data, and their types, which constrain how the data are stored, manipulated, and interpreted. A significant amount of research has been carried out on binary code type inference, such as REWORD [1], TIE [2] , SmartDec [3], SecondWrite [4], Retypd [5] and Hex-Rays [6]. Most of them resort to program analysis techniques, which are often too conservative to infer types with high accuracy. For example, for a memory byte (i.e., a variable) that is only used to store 0 and 1, most existing tools, such as SmartDec and Hex-Rays, recover the type char or byte t (i.e., a type for bytes), which is clearly either incorrect or too conservative. Moreover, some of them are too heavyweight to use in practice, for example, in the sense that they may generate too many constraints to solve for large-scale programs.

SigRec: Automatic Recovery of Function Signatures in Smart Contracts

“…Studies on reverse engineering of variable types from binary executables by leveraging the semantics of instructions [20], [21], [22], [23], [24], [25], [26], [27], [28], [29] are related to our work. However, TASE has several differences with existing approaches.…”

“…Related studies on x86/x64 binaries include recovering parameter types [20], [21], recognizing parameters without recovering parameter types [60], [61], [62], [63], identifying function boundary [64], [65], [66], [67], and inferring variable types [22], [23], [24], [25], [26], [27], [28], [29]. Detailed description is in given Supplementary material K.…”

A Value Set Analysis Refinement Approach Based on Conditional Merging and Lazy Constraint Solving

“…In the variable recovery phase, TIE uses VSA to infer high-level variable locations by analyzing access patterns in memory. BITY [33] uses a pre-learned classifier to predict types for binaries. BITY first recovers variables from binary codes using VSA, then extracts the related representative instructions of the variables as well as some other useful information as their features.…”

Type Learning for Binaries and Its Applications

“…• A series of experiments are conducted to evaluate our approach, which demonstrated that our approach is able to learn more precise types, with reasonable performance, and can help detect malware. This paper extends [11] and further contains the details of the revised algorithms, a points-to analysis for pointer and struct, the generation of the type learning problem, more experiments and several recent related work. In more detail, we first revise the variable recovery algorithm and instruction extraction algorithm for global variables.…”

“…end if 25: end for 26: return V Compared to our conference version [11], there are two minor differences for the processing for pointer type: one is to take some possible offsets into account, that is, the address pattern * (v + of f set) in Line 11; and the other is to extend transitivity of variables from data registers to any possible variables, that is v in Line 13 can be any possible variable. Both of them enable us to find more indirect variables.…”