SYMBION: Interleaving Symbolic with Concrete Execution

Abstract

Symbolic execution is a powerful technique for exploring programs and generating inputs that drive them into specific states. However, symbolic execution is also known to suffer from severe limitations, which prevent its application to real-world software. For example, symbolically executing programs requires modeling their interactions with the surrounding environment (e.g., libraries, operating systems). Unfortunately, models are usually created manually, introducing considerable approximations of the programs behaviors and significant imprecision in the analysis. In addition, as the complexity of the system under analysis grows, additional models are needed, making this process unsustainable. For these reasons, in this paper we propose a novel technique that allows interleaving symbolic execution with concrete execution, focusing the symbolic exploration only on interesting portions of code. We call this approach interleaved symbolic execution. The key idea of our approach is to re-use the concrete environment to run the input program, and then synchronize the results of the environment interactions with the symbolic execution engine. As a consequence, our approach does not make any assumption about such interactions, and it is agnostic with respect to the concrete environment. We implement a prototype for this technique, SYMBION, and we demonstrate its effectiveness by analyzing real-world malware, showing that it allows us to effectively skip complex portions of code that do not need to be analyzed symbolically.

PS3: Precise Patch Presence Test based on Semantic Symbolic Signature

“…PS 3 can work with various architectures, since we can access the source code and compile it into the corresponding binaries. Angr is an open source binary program analysis framework in Python and has been used extensively in binary analysis [8,17,22], as well as patch presence test [23,33,37]. We use Z3 [15] to simplify the expression and calculation of the stack address offset to ensure that the memory mapping is more precise.…”

PyPANDA: Taming the PANDAmonium of Whole System Dynamic Analysis

“…Angr [47] is a Python-based framework that enables static analyses of binaries and symbolic execution. Recent advances to Angr [14] allow transfering state to and from concrete execution environments (e.g., QEMU) which enables transitioning between concrete and symbolic executions.…”

Malware MultiVerse: From Automatic Logic Bomb Identification to Automatic Patching and Tracing

“…Angr is an open-source powerful tool for binary analysis ], thus being selected as basis for the MALVERSE development. Angr was also used as basis for other research work in multiple aspects, such as for: tracing disjoint binary functions [Ma et al 2019] (a technique presented in [Caballero et al 2010]), fixing binary loading [Xu et al 2017], or in concolic executions [Gritti et al 2020]. Despite powerful, Angr has some limitations, as pointed in previous work [Yin et al 2018.…”