Partial evaluation of machine code

Abstract

This paper presents an algorithm for off-line partial evaluation of machine code. The algorithm follows the classical two-phase approach of binding-time analysis (BTA) followed by specialization. However, machine-code partial evaluation presents a number of new challenges, and it was necessary to devise new techniques for use in each phase.• Our BTA algorithm makes use of an instruction-rewriting method that "decouples" multiple updates performed by a single instruction. This method counters the cascading imprecision that would otherwise occur with a more naïve approach to BTA.• Our specializer specializes an explicit representation of the semantics of an instruction, and emits residual code via machine-code synthesis. Moreover, to create code that allows the stack and heap to be at different positions at run-time than at specialization-time, the specializer represents specialization-time addresses using symbolic constants, and uses a symbolic state for specialization. Our experiments show that our algorithm can be used to specialize binaries with respect to commonly used inputs to produce faster binaries, as well as to extract an executable component from a bloated binary.

Model-assisted machine-code synthesis

“…By repeating steps (1), (2), and (3) on different straight-line instruction sequences in a binary, one can produce an optimized binary. Note that if one has a machine-code synthesizer for performing step (3), one can use different analyses and transformation mechanisms in step (2) to build different semantics-based binary rewriters (e.g., partial evaluators [Srinivasan and Reps 2015a], slicers , binary translators [Bansal and Aiken 2008], etc. ).…”

“…Binary rewriting becomes particularly important if one wishes to modify the functionality of a binary that lacks source code and/or the compiler toolchain used to build the binary. Binary rewriting can be done for purposes of software reuse (e.g., slicing , partial evaluation [Srinivasan and Reps 2015a], binary translation [Bansal and Aiken 2008]), optimization (e.g., superoptimization [Bansal and Aiken 2006]), and software security (e.g., binary hardening [Abadi et al 2005;Erlingsson and Schneider 1999;Slowinska et al 2012]).…”

“…Recently [Srinivasan and Reps 2015b], it has been observed that a machine-code synthesizer 1 can be used to create a general framework for semantics-based binary rewriting (see §2.2), and one can instantiate the framework with different analyses to create different rewriters, such as partial evaluators [Srinivasan and Reps 2015a] and slicers . A machine-code synthesizer is a tool that synthesizes a straight-line instruction sequence that implements a semantic specification of the desired behavior, which is often given as a formula in QFBV.…”

“…Consequently, if a binary-rewriter client supplies a formula as input to McSynth++, the client has to wait several minutes or hours before McSynth++ finds an implementation. This delay might not be tolerable for a client that has to invoke the synthesizer multiple times to rewrite an entire binary, e.g., a machine-code partial evaluator [Srinivasan and Reps 2015a].…”

Speeding up machine-code synthesis

“…• convert instructions in the binary to QFBV formulas, • use analysis results to transform QFBV formulas, and • use MCSYNTH to produce an instruction sequence that implements each transformed formula. Examples of semantics-based binary rewriters that can be created using the above recipe include offline optimizers, partial evaluators [25], slicers [27], and binary translators [5]. For example, the machine-code partial evaluator WIPER [25] specializes the QFBV formulas of instructions with respect to a static partial state, and uses MCSYNTH to produce residual instructions from the specialized formulas.…”