BinCAT Purrfecting binary static analysis June 16th 2017 - REcon - - PowerPoint PPT Presentation

▶
bincat
SMART_READER_LITE
LIVE PREVIEW

BinCAT Purrfecting binary static analysis June 16th 2017 - REcon - - PowerPoint PPT Presentation

Jun 05, 2023 279 likes •956 views

BinCAT Purrfecting binary static analysis June 16th 2017 - REcon Philippe Biondi, Raphal Rigo, Sarah Zennou, Xavier Mehrenberger Plan Introduction Demo Under the hood Conclusion 2 Biondi, Mehrenberger, Rigo, Zennou :: BinCAT Plan

slide-1
SLIDE 1

BinCAT

Purrfecting binary static analysis

June 16th 2017 - REcon

Philippe Biondi, Raphaël Rigo, Sarah Zennou, Xavier Mehrenberger
slide-2
SLIDE 2

Plan

Introduction Demo Under the hood Conclusion

Biondi, Mehrenberger, Rigo, Zennou :: BinCAT

2

slide-3
SLIDE 3

Plan

Introduction Demo Under the hood Conclusion

Biondi, Mehrenberger, Rigo, Zennou :: BinCAT

3

slide-4
SLIDE 4

BinCAT (Binary Code Analysis Toolkit)

Binary analyzer

extensible x86 . . . x86 . . . static theory backed IDA in- tegration forward / backward analysis computed properties . . . types CFG with indirect jumps taint analysis values . . . Biondi, Mehrenberger, Rigo, Zennou :: BinCAT

4

slide-5
SLIDE 5

BinCAT (Binary Code Analysis Toolkit)

Binary analyzer

extensible x86 . . . x86 . . . static theory backed IDA in- tegration forward / backward analysis computed properties . . . types CFG with indirect jumps taint analysis values . . . Biondi, Mehrenberger, Rigo, Zennou :: BinCAT

5

slide-6
SLIDE 6

BinCAT (Binary Code Analysis Toolkit)

Binary analyzer

extensible x86 . . . x86 . . . static theory backed IDA in- tegration forward / backward analysis computed properties . . . types CFG with indirect jumps taint analysis values . . . Biondi, Mehrenberger, Rigo, Zennou :: BinCAT

6

slide-7
SLIDE 7

BinCAT (Binary Code Analysis Toolkit)

Binary analyzer

extensible x86 . . . x86 . . . static theory backed IDA in- tegration forward / backward analysis computed properties . . . types CFG with indirect jumps taint analysis values . . . Biondi, Mehrenberger, Rigo, Zennou :: BinCAT

7

slide-8
SLIDE 8

BinCAT (Binary Code Analysis Toolkit)

Binary analyzer

extensible x86 . . . x86 . . . static theory backed IDA in- tegration forward / backward analysis computed properties . . . types CFG with indirect jumps taint analysis values . . . Biondi, Mehrenberger, Rigo, Zennou :: BinCAT

8

slide-9
SLIDE 9

BinCAT (Binary Code Analysis Toolkit)

Binary analyzer

extensible x86 . . . x86 . . . static theory backed IDA in- tegration forward / backward analysis computed properties . . . types CFG with indirect jumps taint analysis values . . . Biondi, Mehrenberger, Rigo, Zennou :: BinCAT

9

slide-10
SLIDE 10

BinCAT (Binary Code Analysis Toolkit)

Binary analyzer

extensible x86 . . . x86 . . . static theory backed IDA in- tegration forward / backward analysis computed properties . . . types CFG with indirect jumps taint analysis values . . . Biondi, Mehrenberger, Rigo, Zennou :: BinCAT

10

slide-11
SLIDE 11

BinCAT (Binary Code Analysis Toolkit)

Binary analyzer

extensible x86 . . . x86 . . . static theory backed IDA in- tegration forward / backward analysis computed properties . . . types CFG with indirect jumps taint analysis values . . . Biondi, Mehrenberger, Rigo, Zennou :: BinCAT

11

slide-12
SLIDE 12

BinCAT (Binary Code Analysis Toolkit)

Binary analyzer

extensible inter- mediate language . . . x86 . . . static theory backed IDA in- tegration forward / backward analysis computed properties . . . types CFG with indirect jumps taint analysis values . . . Biondi, Mehrenberger, Rigo, Zennou :: BinCAT

12

slide-13
SLIDE 13

BinCAT (Binary Code Analysis Toolkit)

Binary analyzer

extensible inter- mediate language . . . x86 . . . static theory backed IDA in- tegration forward / backward analysis computed properties . . . types CFG with indirect jumps taint analysis values . . . Biondi, Mehrenberger, Rigo, Zennou :: BinCAT

13

slide-14
SLIDE 14

Plan

Introduction Demo Under the hood Conclusion

Biondi, Mehrenberger, Rigo, Zennou :: BinCAT

14

slide-15
SLIDE 15

Example: keygenme

$ ./get_key Usage: ./get_key company department name licence

Biondi, Mehrenberger, Rigo, Zennou :: BinCAT

15

slide-16
SLIDE 16

Example: keygenme

$ ./get_key Usage: ./get_key company department name licence $ ./get_key company department name wrong_serial

Biondi, Mehrenberger, Rigo, Zennou :: BinCAT

16

slide-17
SLIDE 17

Example: keygenme

$ ./get_key Usage: ./get_key company department name licence $ ./get_key company department name wrong_serial Licence=>[025E60CB08F00A1A23F236CC78FC819CE6590DD7] Invalid serial wrong_serial

Biondi, Mehrenberger, Rigo, Zennou :: BinCAT

17

slide-18
SLIDE 18

Example: keygenme

$ ./get_key Usage: ./get_key company department name licence $ ./get_key company department name wrong_serial Licence=>[025E60CB08F00A1A23F236CC78FC819CE6590DD7] Invalid serial wrong_serial $ ./get_key company department name 025E60CB0[...]

Biondi, Mehrenberger, Rigo, Zennou :: BinCAT

18

slide-19
SLIDE 19

Example: keygenme

$ ./get_key Usage: ./get_key company department name licence $ ./get_key company department name wrong_serial Licence=>[025E60CB08F00A1A23F236CC78FC819CE6590DD7] Invalid serial wrong_serial $ ./get_key company department name 025E60CB0[...] Licence=>[025E60CB08F00A1A23F236CC78FC819CE6590DD7] Thank you for registering !

Biondi, Mehrenberger, Rigo, Zennou :: BinCAT

19

slide-20
SLIDE 20

Keygenme: data flow

argv[0] department company name CRC CRC CRC CRC

Biondi, Mehrenberger, Rigo, Zennou :: BinCAT

20

slide-21
SLIDE 21

Keygenme: data flow

argv[0] department company name CRC CRC CRC CRC mul

Biondi, Mehrenberger, Rigo, Zennou :: BinCAT

21

slide-22
SLIDE 22

Keygenme: data flow

argv[0] department company name CRC CRC CRC CRC mul sprintf

Biondi, Mehrenberger, Rigo, Zennou :: BinCAT

22

slide-23
SLIDE 23

Keygenme: data flow

argv[0] department company name CRC CRC CRC CRC mul sprintf

Biondi, Mehrenberger, Rigo, Zennou :: BinCAT

23

slide-24
SLIDE 24

Keygenme: data flow

argv[0] department company name CRC CRC CRC CRC mul sprintf SHA-1

Biondi, Mehrenberger, Rigo, Zennou :: BinCAT

24

slide-25
SLIDE 25

Keygenme: data flow

argv[0] department company name CRC CRC CRC CRC mul sprintf SHA-1 hex encode

Biondi, Mehrenberger, Rigo, Zennou :: BinCAT

25

slide-26
SLIDE 26

Keygenme: data flow

argv[0] department company name CRC CRC CRC CRC mul sprintf SHA-1 hex encode license

Biondi, Mehrenberger, Rigo, Zennou :: BinCAT

26

slide-27
SLIDE 27

Demo 1: BinCAT usage

Biondi, Mehrenberger, Rigo, Zennou :: BinCAT

27

slide-28
SLIDE 28

Demo 2: Tainting

Biondi, Mehrenberger, Rigo, Zennou :: BinCAT

28

slide-29
SLIDE 29

Plan

Introduction Demo Under the hood Conclusion

Biondi, Mehrenberger, Rigo, Zennou :: BinCAT

29

slide-30
SLIDE 30

Architecture

IDA plugin IDA

Biondi, Mehrenberger, Rigo, Zennou :: BinCAT

30

slide-31
SLIDE 31

Architecture

IDA plugin IDA bincat binary

Biondi, Mehrenberger, Rigo, Zennou :: BinCAT

31

slide-32
SLIDE 32

Architecture

IDA plugin IDA bincat binary config, binary...

Biondi, Mehrenberger, Rigo, Zennou :: BinCAT

32

slide-33
SLIDE 33

Architecture

IDA plugin local mode IDA bincat binary config, binary... results, logs

Biondi, Mehrenberger, Rigo, Zennou :: BinCAT

33

slide-34
SLIDE 34

Architecture

IDA plugin remote mode IDA bincat binary Web server REST REST

Biondi, Mehrenberger, Rigo, Zennou :: BinCAT

34

slide-35
SLIDE 35

Architecture

IDA plugin remote mode IDA bincat binary Web server REST REST

Biondi, Mehrenberger, Rigo, Zennou :: BinCAT

35

slide-36
SLIDE 36

Control flow graph reconstruction

state1 state2 state3 state4

IP=0x08041236 EAX=0x00000000 EBX=0x87654321 mem[0x1000]=|323130| IP=0x08041238 EAX=0x00000000 EBX=0x87654321 mem[0x1000]=|303132| IP=0x0804123A EAX=0x12345678 EBX=0x87654321 mem[0x1000]=|303132| IP=0x0804143D EAX=0x12345678 EBX=0x8765432? mem[0x1000]=|303132| EIP=0x0804123C EAX=0x0007FFFF ZF=1 mem[0x1000]=|303132| Biondi, Mehrenberger, Rigo, Zennou :: BinCAT

36

slide-37
SLIDE 37

Control flow graph reconstruction

state1 state2 state3 state4

IP=0x08041236 EAX=0x00000000 EBX=0x87654321 mem[0x1000]=|323130| IP=0x08041238 EAX=0x00000000 EBX=0x87654321 mem[0x1000]=|303132| IP=0x0804123A EAX=0x12345678 EBX=0x87654321 mem[0x1000]=|303132| IP=0x0804143D EAX=0x12345678 EBX=0x8765432? mem[0x1000]=|303132| EIP=0x0804123C EAX=0x0007FFFF ZF=1 mem[0x1000]=|303132|

state4

IP=0x0804123A EAX=0x12345678 EBX=0x87654321 mem[0x1000]=|303132| EIP=0x0804123C EAX=0x0007FFFF ZF=1 mem[0x1000]=|303132|

Biondi, Mehrenberger, Rigo, Zennou :: BinCAT

37

slide-38
SLIDE 38

Control flow graph reconstruction

state1 state2 state3 state4

IP=0x08041236 EAX=0x00000000 EBX=0x87654321 mem[0x1000]=|323130| IP=0x08041238 EAX=0x00000000 EBX=0x87654321 mem[0x1000]=|303132| IP=0x0804123A EAX=0x12345678 EBX=0x87654321 mem[0x1000]=|303132| IP=0x0804143D EAX=0x12345678 EBX=0x8765432? mem[0x1000]=|303132| EIP=0x0804123C EAX=0x0007FFFF ZF=1 mem[0x1000]=|303132|

Decoder P C , c

  • n

t e x t , s e g m e n t s

Biondi, Mehrenberger, Rigo, Zennou :: BinCAT

38

slide-39
SLIDE 39

Control flow graph reconstruction

state1 state2 state3 state4

IP=0x08041236 EAX=0x00000000 EBX=0x87654321 mem[0x1000]=|323130| IP=0x08041238 EAX=0x00000000 EBX=0x87654321 mem[0x1000]=|303132| IP=0x0804123A EAX=0x12345678 EBX=0x87654321 mem[0x1000]=|303132| IP=0x0804143D EAX=0x12345678 EBX=0x8765432? mem[0x1000]=|303132| EIP=0x0804123C EAX=0x0007FFFF ZF=1 mem[0x1000]=|303132|

Decoder intermediate language

eax ← (eax + 0x1); zf ← eax=0 ? 1: 0; sf ← (eax >> 0x1f)=1 ? 1: 0; . . .

inc eax

Biondi, Mehrenberger, Rigo, Zennou :: BinCAT

39

slide-40
SLIDE 40

Control flow graph reconstruction

state1 state2 state3 state4

IP=0x08041236 EAX=0x00000000 EBX=0x87654321 mem[0x1000]=|323130| IP=0x08041238 EAX=0x00000000 EBX=0x87654321 mem[0x1000]=|303132| IP=0x0804123A EAX=0x12345678 EBX=0x87654321 mem[0x1000]=|303132| IP=0x0804143D EAX=0x12345678 EBX=0x8765432? mem[0x1000]=|303132| EIP=0x0804123C EAX=0x0007FFFF ZF=1 mem[0x1000]=|303132|

Decoder intermediate language

eax ← (eax + 0x1); zf ← eax=0 ? 1: 0; sf ← (eax >> 0x1f)=1 ? 1: 0; . . .

inc eax

language

eax ← (eax + 0x1); zf ← eax=0 ? 1: 0; sf ← (eax >> 0x1f)=1 ? 1: 0; . . .

Biondi, Mehrenberger, Rigo, Zennou :: BinCAT

40

slide-41
SLIDE 41

Control flow graph reconstruction

state1 state2 state3 state4

IP=0x08041236 EAX=0x00000000 EBX=0x87654321 mem[0x1000]=|323130| IP=0x08041238 EAX=0x00000000 EBX=0x87654321 mem[0x1000]=|303132| IP=0x0804123A EAX=0x12345678 EBX=0x87654321 mem[0x1000]=|303132| IP=0x0804143D EAX=0x12345678 EBX=0x8765432? mem[0x1000]=|303132| EIP=0x0804123C EAX=0x0007FFFF ZF=1 mem[0x1000]=|303132|

Decoder intermediate language

eax ← (eax + 0x1); zf ← eax=0 ? 1: 0; sf ← (eax >> 0x1f)=1 ? 1: 0; . . .

State generator

Biondi, Mehrenberger, Rigo, Zennou :: BinCAT

41

slide-42
SLIDE 42

Control flow graph reconstruction

state1 state2 state3 state4

IP=0x08041236 EAX=0x00000000 EBX=0x87654321 mem[0x1000]=|323130| IP=0x08041238 EAX=0x00000000 EBX=0x87654321 mem[0x1000]=|303132| IP=0x0804123A EAX=0x12345678 EBX=0x87654321 mem[0x1000]=|303132| IP=0x0804143D EAX=0x12345678 EBX=0x8765432? mem[0x1000]=|303132| EIP=0x0804123C EAX=0x0007FFFF ZF=1 mem[0x1000]=|303132|

Decoder State generator state5

EIP=0x0804123D EAX=0x00080000 ZF=0 mem[0x1000]=|303132| Biondi, Mehrenberger, Rigo, Zennou :: BinCAT

42

slide-43
SLIDE 43

Control flow graph reconstruction

state1 state2 state3 state4

IP=0x08041236 EAX=0x00000000 EBX=0x87654321 mem[0x1000]=|323130| IP=0x08041238 EAX=0x00000000 EBX=0x87654321 mem[0x1000]=|303132| IP=0x0804123A EAX=0x12345678 EBX=0x87654321 mem[0x1000]=|303132| IP=0x0804143D EAX=0x12345678 EBX=0x8765432? mem[0x1000]=|303132| EIP=0x0804123C EAX=0x0007FFFF ZF=1 mem[0x1000]=|303132|

Decoder State generator state5

EIP=0x0804123D EAX=0x00080000 ZF=0 mem[0x1000]=|303132|

state4

IP=0x0804123A EAX=0x12345678 EBX=0x87654321 mem[0x1000]=|303132| EIP=0x0804123C EAX=0x0007FFFF ZF=1 mem[0x1000]=|303132|

state5

EIP=0x0804123D EAX=0x00080000 ZF=0 mem[0x1000]=|303132|

Biondi, Mehrenberger, Rigo, Zennou :: BinCAT

43

slide-44
SLIDE 44

Control flow graph reconstruction

state1 state2 state3 state4 state5

IP=0x08041236 EAX=0x00000000 EBX=0x87654321 mem[0x1000]=|323130| IP=0x08041238 EAX=0x00000000 EBX=0x87654321 mem[0x1000]=|303132| IP=0x0804123A EAX=0x12345678 EBX=0x87654321 mem[0x1000]=|303132| IP=0x0804143D EAX=0x12345678 EBX=0x8765432? mem[0x1000]=|303132| EIP=0x0804123C EAX=0x0007FFFF ZF=1 mem[0x1000]=|303132| EIP=0x0804123D EAX=0x00800000 ZF=0 mem[0x1000]=|303132|

Decoder State generator state5

EIP=0x0804123D EAX=0x00080000 ZF=0 mem[0x1000]=|303132|

i f n e w

Biondi, Mehrenberger, Rigo, Zennou :: BinCAT

44

slide-45
SLIDE 45

Formal correctness: static analysis by abstract interpretation

  • operations on values/taint/types are done on abstract objects which

represent sets of values/taint/types ex: 0 ≡ {0}, ? ≡ {integers}, Struct ≡ {C structs}

  • abstract computations are always an overapproximation of actual ones
  • approximation example: loop widening (∇)
Biondi, Mehrenberger, Rigo, Zennou :: BinCAT

45

slide-46
SLIDE 46

Formal correctness: static analysis by abstract interpretation

  • operations on values/taint/types are done on abstract objects which

represent sets of values/taint/types ex: 0 ≡ {0}, ? ≡ {integers}, Struct ≡ {C structs}

  • abstract computations are always an overapproximation of actual ones
  • approximation example: loop widening (∇)

s1: esi = 0x1000, uint32* while esi < 0x8000

  • esi = esi + 4
Biondi, Mehrenberger, Rigo, Zennou :: BinCAT

46

slide-47
SLIDE 47

Formal correctness: static analysis by abstract interpretation

  • operations on values/taint/types are done on abstract objects which

represent sets of values/taint/types ex: 0 ≡ {0}, ? ≡ {integers}, Struct ≡ {C structs}

  • abstract computations are always an overapproximation of actual ones
  • approximation example: loop widening (∇)

s1: esi = 0x1000, uint32* s2: esi = 0x1004, uint32* s′

2 = s1∇s2

esi = 0x????????, uint32* while esi < 0x8000

  • esi = esi + 4
  • Idea:
  • what is stable is kept
Ex: type
  • what changes is
  • verapproximated
Ex: value Biondi, Mehrenberger, Rigo, Zennou :: BinCAT

47

slide-48
SLIDE 48

Formal correctness: static analysis by abstract interpretation

  • operations on values/taint/types are done on abstract objects which

represent sets of values/taint/types ex: 0 ≡ {0}, ? ≡ {integers}, Struct ≡ {C structs}

  • abstract computations are always an overapproximation of actual ones
  • approximation example: loop widening (∇)

s1: esi = 0x1000, uint32* s2: esi = 0x1004, uint32* s′

2 = s1∇s2

esi = 0x????????, uint32* s3: esi = 0x????????, uint32* s′

3 = s′ 2∇s3

esi = 0x????????, uint32* while esi < 0x8000

  • esi = esi + 4
  • Idea:
  • what is stable is kept
Ex: type
  • what changes is
  • verapproximated
Ex: value Biondi, Mehrenberger, Rigo, Zennou :: BinCAT

48

slide-49
SLIDE 49

Formal correctness: static analysis by abstract interpretation

  • operations on values/taint/types are done on abstract objects which

represent sets of values/taint/types ex: 0 ≡ {0}, ? ≡ {integers}, Struct ≡ {C structs}

  • abstract computations are always an overapproximation of actual ones
  • approximation example: loop widening (∇)

s1: esi = 0x1000, uint32* s2: esi = 0x1004, uint32* s′

2 = s1∇s2

esi = 0x????????, uint32* s3: esi = 0x????????, uint32* s′

3 = s′ 2∇s3

esi = 0x????????, uint32* s2 s3 sn ⊑ ⊑ ⊑ while esi < 0x8000

  • esi = esi + 4
  • Idea:
  • what is stable is kept
Ex: type
  • what changes is
  • verapproximated
Ex: value
  • Theorem 1: (s′
i ) sequence is

ultimately stationary

  • Theorem 2: fixpoint s′
f is an
  • verapproximation of the real

execution trace

Biondi, Mehrenberger, Rigo, Zennou :: BinCAT

49

slide-50
SLIDE 50

Formal correctness: static analysis by abstract interpretation

  • operations on values/taint/types are done on abstract objects which

represent sets of values/taint/types ex: 0 ≡ {0}, ? ≡ {integers}, Struct ≡ {C structs}

  • abstract computations are always an overapproximation of actual ones
  • approximation example: loop widening (∇)

s1: esi = 0x1000, uint32* s2: esi = 0x1004, uint32* s′

2 = s1∇s2

esi = 0x????????, uint32* s3: esi = 0x????????, uint32* s′

3 = s′ 2∇s3

esi = 0x????????, uint32* s2 s3 sn ⊑ ⊑ ⊑ while esi < 0x8000

  • esi = esi + 4
  • Idea:
  • what is stable is kept
Ex: type
  • what changes is
  • verapproximated
Ex: value
  • Theorem 1: (s′
i ) sequence is

ultimately stationary

  • Theorem 2: fixpoint s′
f is an
  • verapproximation of the real

execution trace

  • some techniques allow for precision

recovery

Biondi, Mehrenberger, Rigo, Zennou :: BinCAT

50

slide-51
SLIDE 51

Empirical testing

  • Theory is correct.
Biondi, Mehrenberger, Rigo, Zennou :: BinCAT

51

slide-52
SLIDE 52

Empirical testing

  • Theory is correct.
  • In theory, the implementation too.
Biondi, Mehrenberger, Rigo, Zennou :: BinCAT

52

slide-53
SLIDE 53

Empirical testing

  • Theory is correct.
  • In theory, the implementation too.
  • In practice, a lot of things are complex and bug prone: the decoder,

abstract operations, etc.

Biondi, Mehrenberger, Rigo, Zennou :: BinCAT

53

slide-54
SLIDE 54

Empirical testing

  • Theory is correct.
  • In theory, the implementation too.
  • In practice, a lot of things are complex and bug prone: the decoder,

abstract operations, etc. = ⇒ lots of unit tests

Biondi, Mehrenberger, Rigo, Zennou :: BinCAT

54

slide-55
SLIDE 55

Empirical testing

  • Theory is correct.
  • In theory, the implementation too.
  • In practice, a lot of things are complex and bug prone: the decoder,

abstract operations, etc. = ⇒ lots of unit tests

  • BinCAT vs CPU: > 67.000 tests for ≃ 55 instructions
Biondi, Mehrenberger, Rigo, Zennou :: BinCAT

55

slide-56
SLIDE 56

Empirical testing

  • Theory is correct.
  • In theory, the implementation too.
  • In practice, a lot of things are complex and bug prone: the decoder,

abstract operations, etc. = ⇒ lots of unit tests

  • BinCAT vs CPU: > 67.000 tests for ≃ 55 instructions
  • BinCAT vs QEMU test-i386: 87% test coverage over ≃ 105 instructions
Biondi, Mehrenberger, Rigo, Zennou :: BinCAT

56

slide-57
SLIDE 57

Empirical testing

  • Theory is correct.
  • In theory, the implementation too.
  • In practice, a lot of things are complex and bug prone: the decoder,

abstract operations, etc. = ⇒ lots of unit tests

  • BinCAT vs CPU: > 67.000 tests for ≃ 55 instructions
  • BinCAT vs QEMU test-i386: 87% test coverage over ≃ 105 instructions
P A W S O M E ! ! ! Biondi, Mehrenberger, Rigo, Zennou :: BinCAT

57

slide-58
SLIDE 58

Analyzer’s performance

Example: keygenme

  • 6407 instructions analyzed
  • RAM usage: 90 MiB
  • running time: 6s
  • average: ≃ 1060 insn/s

QEMU tests:

  • 209 120 instructions analyzed
  • RAM usage: 2.3 GiB
  • running time: 23 min 30 s
  • average: ≃ 150 insn/s
Intel Core i7-6700K CPU @ 4,00GHz Biondi, Mehrenberger, Rigo, Zennou :: BinCAT

58

slide-59
SLIDE 59

Plan

Introduction Demo Under the hood Conclusion

Biondi, Mehrenberger, Rigo, Zennou :: BinCAT

59

slide-60
SLIDE 60

Conclusion

Binary analyzer

extensible intermediate language x86 static theory backed IDA in- tegration forward / backward analysis computed properties types CFG with indirect jumsp taint analysis values Biondi, Mehrenberger, Rigo, Zennou :: BinCAT

60

slide-61
SLIDE 61

Current features improvements (planned)

BinCAT extensible inter- mediate language x86 statique base théorique IDA in- tegration forward / backward analysis computed properties reconstruction du CFG avec sauts indirects résolus types taint valeurs
  • better type reconstruction
  • new types from heuristics. Ex:
structures detection on stack
  • several distinct taint sources
  • more precise computations in

backward analysis

  • more standard library functions

models

  • type and value override in IDA
  • memory definition directly in IDA
Biondi, Mehrenberger, Rigo, Zennou :: BinCAT

61

slide-62
SLIDE 62

Future features

BinCAT extensible intermediate language x86 x86-64 ARM statique base théorique intégré à IDA analyses avan- t/arrière computed properties reconstruction du CFG avec sauts indirects résolus reconstruction de types values taint analysis
  • bject
recon- struc- tion (C++)
  • finer approximations in values computation by using intervals
  • complex objects reconstruction (C++)
  • x86-64 and ARM decoders
Biondi, Mehrenberger, Rigo, Zennou :: BinCAT

62

slide-63
SLIDE 63

Thanks!

Full paper (link in README):

https://www.sstic.org/media/SSTIC2017/SSTIC-actes/bincat_purrfecting_ binary_static_analysis/SSTIC2017-Article-bincat_purrfecting_binary_ static_analysis-biondi_rigo_zennou_mehrenberger.pdf
  • project was partially financed by DGA-MI
  • Get it! (AGPL licence)

https://github.com/airbus-seclab/bincat docker run -p 5000:5000 airbusseclab/bincat tutorial in doc/tutorial.md

Biondi, Mehrenberger, Rigo, Zennou :: BinCAT

63

slide-64
SLIDE 64

x86 coverage

ADD PUSH ES POP ESOR PUSH CS 2 bytes

ADC PUSH SS POP SSSBB PUSH DS POP DS AND ES: DAASUB CS: DAS XOR SS: AAACMP DS: AAS

INCDEC

PUSHPOP

PUSHA POPA BOUND ARPL FS: GS: OPSIZE: ADSIZE: PUSH IMUL PUSH IMUL INSB INSW OUTSB OUTSW

JNO JNO JB JNB JZ JNZ JBE JA JS JNS JP JNP JL JNL JLE JNLE

Grp1 Grp1 Grp1 TEST XCHGMOV LEA MOV POP

NOP XCHG EAX CWD CDQ CALL WAIT PUSHF POPF SAHF LAHF

MOV EAX MOVS CMPS TEST STOS LODS SCAS

MOV

SHIFT RETN LES LDS MOV ENTER LEAVE RETF INT3 INT INTO IRETD

Grp2 AAM AAD SALC XLATFPU

LOOPNZ LOOPZ LOOP JCXZ IN OUT CALL JMP JMPF JMPS IN OUT

LOCK: INT1 REPNE: REP: HLT CMC Grp3 CLC STC CLI STI CLD STD Grp4 Grp5

Biondi, Mehrenberger, Rigo, Zennou :: BinCAT

64

slide-65
SLIDE 65

x86 coverage - Second table Grp6 Grp7 LAR LSL

CLTS INVD WBINVD

UD2 NOP

SSE PrefetchSSE1 HINT NOP

MOV CR DR

SSE

WRMSR RDTSC RDMSR RDPMC SYSENTER SYSEXIT GETSECSMX MOVBE

SSE

CMOV

SSE

MMX SSE

MMX SSE VMX

MMX SSE

JNO JNO JB JNB JZ JNZ JBE JA JS JNS JP JNP JL JNL JLE JNLE

SETNO SETNO SETB SETNB SETZ SETNZ SETBE SETA SETS SETNS SETP SETNP SETL SETNL SETLE SETNLE PUSH FS POP FS CPUID BT SHLD PUSH GS POP GS RSM BTS SHRD FENCE IMUL

CMPXCHG LSS BTR LFS LGS MOVZX POPCNT UD BTx BTC BSF BSR MOVSX

XADDSSE CMPXCHGBSWAP

MMX SSE MMX SSE

MMX SSE

Biondi, Mehrenberger, Rigo, Zennou :: BinCAT

65

slide-66
SLIDE 66

Currently implemented lattices

⊤ . . . ⊥ 7

  • 4

. . . . . . very precise less precise ⊑ ⊤ untainted tainted ⊥ ⊤ int struct . . . . . . int32 uint32 ⊥ very precise less precise ⊑

Biondi, Mehrenberger, Rigo, Zennou :: BinCAT

66