PPC和MIPS指令集下二进制代码中函数参数个数的识别方法

doi:10.11959/j.issn.2096-109x.2020047

Abstract

Abstract:

The identification of the number of function argument contributes to the recovery of the function prototype and is the basis for data flow analysis and other security analysis.In order to improve the accuracy of the recognition of the number of function parameters,an algorithm (Findargs) which determines the number of parameters of the function according to the voting mechanism of the function call relationship was proposed.Findargs starts from the function call characteristics of PPC and MIPS instruction set,and uses function call relationship combined with argument pass analysis to identify the number of function arguments,which can help to recover function prototype.In order to evaluate the recognition effect of Findargs,a large binary file was selected and tested it with radare2.The experiments results show that Findargs has higher accuracy,and the accuracy rate for PPC instruction set reaches 90.3%.For MIPS instruction set,the accuracy rate is 86%.

Key words: static analysis, function call resolve, argument number identification, voting mechanism

CLC Number:

TP309

Xiaokang YIN,Liu LIU,Long LIU,Shengli LIU. Function argument number identification in stripped binary under PPC and MIPS instruction set[J]. Chinese Journal of Network and Information Security, 2020, 6(4): 95-103.

Figures/Tables 13

References 14

[15]	BAO T , BURKET J , WOO M ,et al. BYTEWEIGHT:learning to recognize functions in binary code[C]// The 23rd USENIX Security Symposium. 2014: 845-860.
[16]	段钢 . 加密与解密 (第四版)[M]. 北京: 电子工业出版社, 2018： 104-105.
	DUAN G . Encryption and decryption (4th edition)[M]. Beijing: Publishing House of Electronics IndustryPress, 2018: 104-105.
[17]	YIN X , LIU S , LIU L ,et al. Function recognition in stripped binary of embedded devices[J]. IEEE Access, 2018,6: 75682-75694.
[18]	HU X , CHIUEH T , SHIN K G . Large-scale malware indexing using function-call graphs[C]// The 16th ACM Conference on Computer and communications security. 2009: 611-620.
[19]	HASSEN M , CHAN P K . Scalable function call graph-based malware classification[C]// The Seventh ACM on Conference on Data and Application Security and Privacy. 2017: 239-248.
[20]	HUANG D X , TANG Y , WANG Y ,et al. Toward efficient and accurate function‐call graph matching of binary codes[J]. Con-currency and Computation:Practice and Experience, 2018,31(21).
[21]	KONG D , YAN G . Discriminant malware distance learning on structural information for automated malware classification[C]// The 19th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining. 2013: 1357-1365.
[1]	DURDEN T . Automated vulnerability auditing in machine code[J]. Phrack Magazine, 2007,64.
[2]	ABADI M , BUDIU M , ERLINGSSON ú ,et al. Control-flow integrity principles,implementations,and applications[J]. ACM Transactions on Information and System Security (TISSEC), 2009,13(1):4.
[3]	CLAUSE J , LI W , ORSO A . Dytan:a generic dynamic taint analysis framework[C]// International Symposium on Software Testing and Analysis. 2007: 196-206.
[4]	NEWSOME J , SONG D X . Dynamic taint analysis for automatic detection,analysis,and signature generation of exploits on commodity software[C]// NDSS. 2005: 3-4.
[5]	STAATS M , PASAREANU C . Parallel symbolic execution for structural test generation[C]// The 19th International Symposium on Software Testing and Analysis. 2010: 183-194.
[6]	LI H , KIM T , BAT-ERDENE M ,et al. Software vulnerability detection using backward trace analysis and symbolic execution[C]// 2013 International Conference on Availability,Reliability and Security. 2013: 446-454.
[7]	PERKINS J H , KIM S , LARSEN S ,et al. Automatically patching errors in deployed software[C]// The ACM SIGOPS 22nd Symposium on Operating Systems Principles. 2009: 87-102.
[8]	SHACHAM H , . The geometry of innocent flesh on the bone:return-into-libc without function calls (on the x86)[C]// ACM Conference on Computer and Communications Security. 2007: 552-561.
[9]	SONG D , BRUMLEY D , YIN H ,et al. BitBlaze:a new approach to computer security via binary analysis[C]// International Conference on Information Systems Security. 2008: 1-25.
[10]	SHOSHITAISHVILI Y , WANG R , SALLS C ,et al. Sok:(state of) the art of war:offensive techniques in binary analysis[C]// 2016 IEEE Symposium on Security and Privacy (SP). 2016: 138-157.
[11]	李珍, 邹德清, 王泽丽 ,等. 面向源代码的软件漏洞静态检测综述[J]. 网络与信息安全学报, 2019,5(1): 1-14.
	LI Z , ZOU D Q , WANG Z L ,et al. Survey on static software vul-nerability detection for source code[J]. Chinese Journal of Network and Information Security, 2019,5(1): 1-14.
[12]	MENG X , MILLER B P . Binary code is not easy[C]// The 25th International Symposium on Software Testing and Analysis. 2016: 24-35.
[13]	CABALLERO J , JOHNSON N M , MCCAMANT S ,et al. Binary code extraction and interface identification for security applications[R]. California Univ Berkeley Dept of Electrical Engineering and Computer Science, 2009.
[14]	Radare. The official radare2 book (1st edition)[EB].

Metrics

Recommended 0

No Suggested Reading articles found!

约定类型	参数传递方式	参数传递顺序	平衡栈者
_cdecl（C规范）	栈	从右到左	调用者
pascal	栈	从左到右	子程序
stdcall	栈	从右到左	子程序
fastcall	寄存器和栈	先寄存器后使用栈（顺序由编译器确定）	子程序

指令集	传递方式	参数寄存器
MIPS	fastcall	$a0 ~ $a3
PPC	fastcall	r3 ~ r10

函数名	指令集	函数地址	函数实际参数个数	识别出的参数个数
strcpy	MIPS	0x3732c5d0	2	2
	PPC	0x80ec0c70	2	2
strncpy	MIPS	0x3732d4d0	3	3
	PPC	0x80ec138c	3	3
strchr	MIPS	0x3732c534	2	2
	PPC	0x80ec0ba8	2	2
memcpy	MIPS	0x3732ab10	3	3
	PPC	0x80ec0630	3	3
memmove	MIPS	0x3732ad40	3	3
	PPC	0x80ec074c	3	3
bcopy	MIPS	0x37327590	3	3
	PPC	0x8047a460	3	3
strcat	MIPS	0x3732c4f0	2	2
	PPC	0x80ec0854	2	2
alps_copy	MIPS	0x3406ab04	3	3
	PPC	—	—	—
copy_mem	MIPS	0x30fc4bec	4	4
	PPC	0x80478994	4	4

指令集	函数个数	radare2准确识别个数	radare2准确率	Findargs准确识别个数	Findargs准确率
PPC	300	86	28.7%	271	90.3%
MIPS	300	11	3.7%	258	86.0%

指令集				函数调用次数
	≥2			≥3			≥4
	总函数	多调用分析	单调用分析	总函数	多调用分析	单调用分析	总函数	多调用分析	单调用分析
PPC	139	124	124	77	72	72	54	52	51
MIPS	144	126	119	105	94	88	76	68	58

Function argument number identification in stripped binary under PPC and MIPS instruction set

RichHTML

PDF下载

Knowledge

Abstract

Cite this article

share this article

Figures/Tables 13

References 14

Related Articles 7

Metrics

Recommended 0

指令集	函数参数个数
	0		1		2		3		4		5		6		7		≥8
	函数个数	准确识别	函数个数	准确识别	函数个数	准确识别	函数个数	准确识别	函数个数	准确识别	函数个数	准确识别	函数个数	准确识别	函数个数	准确识别	函数个数	准确识别
PPC	35	30	94	83	71	65	45	40	34	34	13	13	3	3	1	0	4	3
MIPS	9	8	97	89	75	58	46	41	30	30	15	10	6	5	11	11	11	6

指令集	参数个数变化时的识别准确率
指令集	0	1	2	3	4	5	6	7	≥8
PPC	85.7%	88.3%	91.5%	88.9%	100.0%	100.0%	100.0%	0.0%	75.0%
MIPS	88.9%	91.8%	77.3%	89.1%	100.0%	66.7%	83.3%	100.0%	54.5%

[1]	Fan CHAO, Zhi YANG, Xuehui DU, Bing HAN. Classified risk assessment method of Android application based on multi-factor clustering selection [J]. Chinese Journal of Network and Information Security, 2021, 7(2): 161-173.
[2]	Tianyu ZHOU,Wenbo SHEN,Nanzi YANG,Jinku LI,Chenggang QIN,Wang YU. Analysis of DoS attacks on Docker inter-component stdio copy [J]. Chinese Journal of Network and Information Security, 2020, 6(6): 45-56.
[3]	Fan CHAO,Zhi YANG,Xuehui DU,Yan SUN. Android malware detection method based on deep neural network [J]. Chinese Journal of Network and Information Security, 2020, 6(5): 67-79.
[4]	Dong ZHANG,Yao ZHANG,Gang LIU,Gui-xiang SONG. Research on host malcode detection using machine learning [J]. Chinese Journal of Network and Information Security, 2017, 3(7): 25-32.
[5]	Bo-wen SUN,Yan-yi HUANG,Qiao-kun WEN,Bin TIAN,Peng WU,Qi LI. Malware classification method based on static multiple-feature fusion [J]. Chinese Journal of Network and Information Security, 2017, 3(11): 68-76.
[6]	Yue-xiu XING,Ai-qun HU,Yong-jian WANG,Ran ZHAO. Research on multi-dimensional iOS privacy disclosure evaluation model [J]. Chinese Journal of Network and Information Security, 2016, 2(4): 73-79.
[7]	Jia CHEN,Shan-qing1 GUO. Toward discovering and exploiting private server-side Web API [J]. Chinese Journal of Network and Information Security, 2016, 2(12): 27-38.