TrABin: Trustworthy analyses of binaries

Lindner, Andreas; Guanciale, Roberto; Metere, Roberto

doi:10.1016/j.scico.2019.01.001

“…We implemented our logic and verified its soundness in HOL4. We also instantiated the logic for two transition systems: the formal model of ARMv8 and the machine-independent intermediate language, BIR, of the binary analysis framework HolBA [38].…”

Section: Methodsmentioning

confidence: 99%

“…The logical framework is demonstrated in Section 4, where we verify the two running examples. Finally, L A has been formalised in the HOL4 interactive theorem prover, integrated into the HOL4 binary analysis framework HolBA [38] ‡ , and instantiated for two machine models: the ARMv8 ISA and the HolBA intermediate language, which is called BIR. This is described in Section 5.…”

Section: Introductionmentioning

confidence: 99%

Hoare-Style Logic for Unstructured Programs

Lundberg

¹

,

Guanciale

²

,

Lindner

³

et al. 2020

Software Engineering and Formal Methods

Self Cite

View full text Add to dashboard Cite

Enabling Hoare-style reasoning for low-level code is attractive since it opens the way to regain structure and modularity in a domain where structure is essentially absent. The field, however, has not yet arrived at a fully satisfactory solution, in the sense of avoiding restrictions on control flow (important for compiler optimization), controlling access to intermediate program points (important for modularity), and supporting total correctness. Proposals in the literature support some of these properties, but a solution that meets them all is yet to be found. We introduce the novel Hoare-style program logic LA, which interprets postconditions relative to program points when these are first encountered. The logic can support both partial and total correctness, derive contracts for arbitrary control flow, and allows one to freely choose decomposition strategy during verification while avoiding step-indexed approximations and global invariants. The logic can be instantiated for a variety of concrete instruction set architectures and intermediate languages. The rules of LA have been verified in the interactive theorem prover HOL4 and integrated with the toolbox HolBA for semi-automated program verification, making it applicable to the ARMv6 and ARMv8 instruction sets.

show abstract

“…To achieve a degree of hardware independence, we use an architecture-agnostic intermediate representation known as BIR [34]. BIR is an abstract assembly language with statements that work on memory, arithmetic expressions, and jumps.…”

Section: Binary Intermediate Representationmentioning

confidence: 99%

Validation of Abstract Side-Channel Models for Computer Architectures

Nemati¹,

Buiras²,

Lindner³

et al. 2020

Preprint

Self Cite

0

View full text Add to dashboard Cite

Observational models make tractable the analysis of information flow properties by providing an abstraction of side channels. We introduce a methodology and a tool, Scam-V, to validate observational models for modern computer architectures. We combine symbolic execution, relational analysis, and different program generation techniques to generate experiments and validate the models. An experiment consists of a randomly generated program together with two inputs that are observationally equivalent according to the model under the test. Validation is done by checking indistinguishability of the two inputs on real hardware by executing the program and analyzing the side channel. We have evaluated our framework by validating models that abstract the data-cache side channel of a Raspberry Pi 3 board with a processor implementing the ARMv8-A architecture. Our results show that Scam-V can identify bugs in the implementation of the models and generate test programs which invalidate the models due to hidden microarchitectural behavior.

show abstract

“…To achieve a degree of hardware independence, we use the architecture-agnostic intermediate representation BIR [ 34 ]. It is an abstract assembly language with statements that work on memory, arithmetic expressions, and jumps.…”

Section: Introductionmentioning

confidence: 99%

Validation of Abstract Side-Channel Models for Computer Architectures

Nemati

¹

,

Buiras

²

,

Lindner

³

et al. 2020

Lecture Notes in Computer Science

Self Cite

View full text Add to dashboard Cite

Observational models make tractable the analysis of information flow properties by providing an abstraction of side channels. We introduce a methodology and a tool, Scam-V, to validate observational models for modern computer architectures. We combine symbolic execution, relational analysis, and different program generation techniques to generate experiments and validate the models. An experiment consists of a randomly generated program together with two inputs that are observationally equivalent according to the model under the test. Validation is done by checking indistinguishability of the two inputs on real hardware by executing the program and analyzing the side channel. We have evaluated our framework by validating models that abstract the data-cache side channel of a Raspberry Pi 3 board with a processor implementing the ARMv8-A architecture. Our results show that Scam-V can identify bugs in the implementation of the models and generate test programs which invalidate the models due to hidden microarchitectural behavior.

show abstract

TrABin: Trustworthy analyses of binaries

Cited by 8 publications

References 23 publications

Hoare-Style Logic for Unstructured Programs

Hoare-Style Logic for Unstructured Programs

Validation of Abstract Side-Channel Models for Computer Architectures

Validation of Abstract Side-Channel Models for Computer Architectures

Contact Info

Product

Resources

About