RevNIC ReverseEngineeringofBinaryDeviceDrivers - - PowerPoint PPT Presentation

▶
revnic
SMART_READER_LITE
LIVE PREVIEW

RevNIC ReverseEngineeringofBinaryDeviceDrivers - - PowerPoint PPT Presentation

Dec 07, 2023 408 likes •1.22k views

RevNIC ReverseEngineeringofBinaryDeviceDrivers VitalyChipounovandGeorgeCandea SchoolofComputer&Communica3onSciences jeudi, 15 avril 2010 Drivers:HardtoWriteandHardtoPort

slide-1
SLIDE 1

Vitaly
Chipounov
and
George
Candea

School
of
Computer
&
Communica3on
Sciences

RevNIC

Reverse
Engineering
of
Binary
Device
Drivers

jeudi, 15 avril 2010

slide-2
SLIDE 2

Drivers:
Hard
to
Write
and
Hard
to
Port


  • Drivers
are
o@en
closed
source

Por3ng
from
exis3ng
drivers
is
difficult

  • Devices
rarely
come
with
an
interface
specificaDon

Hard
to
write
a
driver
from
scratch

  • SpecificaDons
are
o@en
incomplete
and
buggy

Buggy
driver
implementa3on

jeudi, 15 avril 2010

slide-3
SLIDE 3

ExisDng
SoluDons

  • EmulaDng
source
OS
(VMs,
NDISwrapper...)

Run‐3me
overhead,
hard
to
maintain

  • Making
drivers
from
specificaDons
(Termite)

Requires
formal
specifica3ons

  • Manual
trace
analysis,
decompilaDon

Tedious,
imprecise

jeudi, 15 avril 2010

slide-4
SLIDE 4

http://bplteensofwa.files.wordpress.com/2009/07/computer.jpg

x86 PC Virtual Machines FPGA Windows Linux KitOS μC/OS II Windows

jeudi, 15 avril 2010

slide-5
SLIDE 5

RevNIC


SyntheDc
Driver NIC
Driver
 Template Virtual
Machine Guest
OS

Original
Binary
Driver

Driver
Exerciser RevNIC
Code
 Synthesizer

Hardware
 interac3on
traces

jeudi, 15 avril 2010

slide-6
SLIDE 6

RevNIC


SyntheDc
Driver NIC
Driver
 Template Virtual
Machine Guest
OS

Original
Binary
Driver

Driver
Exerciser RevNIC
Code
 Synthesizer

Hardware
 interac3on
traces

jeudi, 15 avril 2010

slide-7
SLIDE 7

RevNIC


SyntheDc
Driver NIC
Driver
 Template Virtual
Machine Guest
OS

Original
Binary
Driver

Driver
Exerciser RevNIC
Code
 Synthesizer

Hardware
 interac3on
traces

jeudi, 15 avril 2010

slide-8
SLIDE 8

RevNIC


SyntheDc
Driver NIC
Driver
 Template Virtual
Machine Guest
OS

Original
Binary
Driver

Driver
Exerciser RevNIC
Code
 Synthesizer

Hardware
 interac3on
traces

jeudi, 15 avril 2010

slide-9
SLIDE 9

High
Coverage
Driver
Exerciser

  • Hand‐cra@ed
workload
is
not
enough

jeudi, 15 avril 2010

slide-10
SLIDE 10

int irq_handler(device_t *dev) { status = hw_read(STATUS_REG); if (status == RX){ pkt_size = hw_read(RX_SIZE_REG); if (pkt_size < 1514) { recv_packet(dev); }else { drop_packet(dev); } }else if (status == TX) { ... } }

jeudi, 15 avril 2010

slide-11
SLIDE 11
  • Boundary
condiDons
  • Error
recovery
code

int irq_handler(device_t *dev) { status = hw_read(STATUS_REG); if (status == RX){ pkt_size = hw_read(RX_SIZE_REG); if (pkt_size < 1514) { recv_packet(dev); }else { drop_packet(dev); } }else if (status == TX) { ... } }

jeudi, 15 avril 2010

slide-12
SLIDE 12

int irq_handler(device_t *dev) { status = hw_read(STATUS_REG); if (status == RX){ pkt_size = hw_read(RX_SIZE_REG); if (pkt_size < 1514) { recv_packet(dev); }else { drop_packet(dev); } }else if (status == TX) { ... } }

jeudi, 15 avril 2010

slide-13
SLIDE 13

int irq_handler(device_t *dev) { status = hw_read(STATUS_REG); if (status == RX){ pkt_size = hw_read(RX_SIZE_REG); if (pkt_size < 1514) { recv_packet(dev); }else { drop_packet(dev); } }else if (status == TX) { ... } }

jeudi, 15 avril 2010

slide-14
SLIDE 14

status == RX pkt_size < 1514 status == TX ... ... drop packet receive packet

F T

int irq_handler(device_t *dev) { status = hw_read(STATUS_REG); if (status == RX){ pkt_size = hw_read(RX_SIZE_REG); if (pkt_size < 1514) { recv_packet(dev); }else { drop_packet(dev); } }else if (status == TX) { ... } }

jeudi, 15 avril 2010

slide-15
SLIDE 15

High
coverage
automated
driver
exerciser

status == RX pkt_size < 1514 status == TX ... ... drop packet receive packet

F T

int irq_handler(device_t *dev) { status = hw_read(STATUS_REG); if (status == RX){ pkt_size = hw_read(RX_SIZE_REG); if (pkt_size < 1514) { recv_packet(dev); }else { drop_packet(dev); } }else if (status == TX) { ... } }

jeudi, 15 avril 2010

slide-16
SLIDE 16

Device Drivers ndis.sys

e x p l

  • r

e r . e x e m s v c r t . d l l a d v a p i 3 2 . d l l n t d l l . d l l . . . . . . . . .

Applications and libraries Windows Kernel

. . . rtl8139.sys u s e r 3 2 . d l l

jeudi, 15 avril 2010

slide-17
SLIDE 17

Exercising
Windows
NIC
Drivers

NICDRIVER.SYS IniDalize(...) QueryInformaDon(...) SendPacket(...) HandleInterrupt(...) Unload(...)

...

jeudi, 15 avril 2010

slide-18
SLIDE 18

Exercising
Windows
NIC
Drivers

NICDRIVER.SYS IniDalize(...) QueryInformaDon(...) SendPacket(...) HandleInterrupt(...) Unload(...)

...

jeudi, 15 avril 2010

slide-19
SLIDE 19

Exercising
Windows
NIC
Drivers

IniDalize(...)

jeudi, 15 avril 2010

slide-20
SLIDE 20

Exercising
Windows
NIC
Drivers

IniDalize(...)

☹ ☺ ☹ ☹ ☹ ☺ ☹

jeudi, 15 avril 2010

slide-21
SLIDE 21

Exercising
Windows
NIC
Drivers

IniDalize(...)

☹ ☺ ☹ ☹ ☹ ☺ ☹ ☺

jeudi, 15 avril 2010

slide-22
SLIDE 22

IniDalize(...)

☹ ☺ ☹ ☹ ☹ ☺ ☹ ☺

jeudi, 15 avril 2010

slide-23
SLIDE 23

IniDalize(...)

☹ ☺ ☹ ☹ ☹ ☺ ☹

Send(...,
Packet,
...)

☺

jeudi, 15 avril 2010

slide-24
SLIDE 24

IniDalize(...)

☹ ☺ ☹ ☹ ☹ ☺ ☹

Send(...,
Packet,
...)

☺

001a706650e3...

jeudi, 15 avril 2010

slide-25
SLIDE 25

IniDalize(...)

☹ ☺ ☹ ☹ ☹ ☺ ☹ ☹ ☺ ☹ ☹ ☹ ☺ ☹

Send(...,
Packet,
...)

☺

α β γ δ ε ϛ...

jeudi, 15 avril 2010

slide-26
SLIDE 26

☹ ☺ ☹ ☹ ☹ ☺ ☹ ☹ ☹ ☺ ☹

Send(...,
Packet,
...)

☺

α β γ δ ε ϛ...

jeudi, 15 avril 2010

slide-27
SLIDE 27

☹ ☺ ☹ ☹ ☹ ☺ ☹ ☹ ☹ ☺ ☹

Send(...,
Packet,
...)

Interrupt

☺

α β γ δ ε ϛ...

jeudi, 15 avril 2010

slide-28
SLIDE 28

☹ ☺ ☹ ☹ ☹ ☺ ☹ ☹ ☹ ☺ ☹

Send(...,
Packet,
...)

Interrupt

HandleInterrupt(...)

☺

α β γ δ ε ϛ...

jeudi, 15 avril 2010

slide-29
SLIDE 29

☹ ☺ ☹

Send(...,
Packet,
...) HandleInterrupt(...)

Interrupt

jeudi, 15 avril 2010

slide-30
SLIDE 30

☹ ☺ ☹

Send(...,
Packet,
...) HandleInterrupt(...) Unload(...)

Interrupt

jeudi, 15 avril 2010

slide-31
SLIDE 31

RevNIC


SyntheDc
Driver NIC
Driver
 Template Virtual
Machine Guest
OS

Original
Binary
Driver

Driver
Exerciser RevNIC
Code
 Synthesizer

Hardware
 interac3on
traces

jeudi, 15 avril 2010

slide-32
SLIDE 32

RevNIC


SyntheDc
Driver NIC
Driver
 Template Virtual
Machine Guest
OS

Original
Binary
Driver

Driver
Exerciser RevNIC
Code
 Synthesizer

Hardware
 interac,on
traces

jeudi, 15 avril 2010

slide-33
SLIDE 33

Hardware
InteracDon
Traces

Trace
Files

  • ExecuDon
tree
  • Machine
instrucDons
  • Memory
accesses
  • Register
values
  • (Memory‐Mapped)
I/O

Virtual
Machine Guest
OS

Original
Binary
Driver

Driver
Exerciser

jeudi, 15 avril 2010

slide-34
SLIDE 34

RevNIC


SyntheDc
Driver NIC
Driver
 Template Virtual
Machine Guest
OS

Original
Binary
Driver

Driver
Exerciser RevNIC
Code
 Synthesizer

Hardware
 interac,on
traces

jeudi, 15 avril 2010

slide-35
SLIDE 35

RevNIC


SyntheDc
Driver NIC
Driver
 Template Virtual
Machine Guest
OS

Original
Binary
Driver

Driver
Exerciser RevNIC
Code
 Synthesizer

Hardware
 interac3on
traces

Traces ➔
C code

jeudi, 15 avril 2010

slide-36
SLIDE 36

ExecuDon
Tree

jeudi, 15 avril 2010

slide-37
SLIDE 37

BB
4 BB
1 BB
2 BB
3 BB
5 BB
6 BB
7

ExecuDon
Tree Sequences
of basic
blocks

Trace
#1

jeudi, 15 avril 2010

slide-38
SLIDE 38

BB
4 BB
1 BB
2 BB
3 BB
5 BB
6 BB
7 BB
8 BB
9 BB
1 BB
2 BB
3 BB
4 BB
7

ExecuDon
Tree Sequences
of basic
blocks

Trace
#1 Trace
#2

jeudi, 15 avril 2010

slide-39
SLIDE 39

BB
4 BB
1 BB
2 BB
3 BB
5 BB
6 BB
7 BB
8 BB
9 BB
1 BB
2 BB
3 BB
4 BB
7

Trace
#1 Trace
#2

jeudi, 15 avril 2010

slide-40
SLIDE 40

BB
4 BB
1 BB
2 BB
3 BB
5 BB
6 BB
7 BB
8 BB
9 BB
1 BB
2 BB
3 BB
4 BB
7 BB
4 BB
1 BB
2 BB
3 BB
5 BB
6 BB
7 BB
8 BB
9 BB
1 BB
2 BB
3 BB
4 BB
7

Trace
#1 Trace
#2

jeudi, 15 avril 2010

slide-41
SLIDE 41

BB
4 BB
1 BB
2 BB
3 BB
5 BB
6 BB
7 BB
8 BB
9 BB
1 BB
2 BB
3 BB
4 BB
7 BB
4 BB
1 BB
2 BB
3 BB
5 BB
6 BB
7 BB
8 BB
9 BB
1 BB
2 BB
3 BB
4 BB
7

Trace
#1 Trace
#2

jeudi, 15 avril 2010

slide-42
SLIDE 42

CFG

BB
1 BB
2 BB
3 BB
4 BB
5 BB
6 BB
7 BB
8 BB
9 BB
1 BB
2 BB
3 BB
4 BB
7

Trace
#1 Trace
#2

BB
1 BB
2 BB
3 BB
4 BB
5 BB
6 BB
7 BB
8 BB
9 BB
1 BB
2 BB
3 BB
4 BB
7

jeudi, 15 avril 2010

slide-43
SLIDE 43

CFG

BB
1 BB
2 BB
3 BB
4 BB
5 BB
6 BB
7 BB
8 BB
9 BB
1 BB
2 BB
3 BB
4 BB
7

jeudi, 15 avril 2010

slide-44
SLIDE 44

uint32_t function_0001(...) { BB1: BB2: BB3: BB4: BB5: BB6: BB8: BB9: BB7: }

CFG

BB
1 BB
2 BB
3 BB
4 BB
5 BB
6 BB
7 BB
8 BB
9 BB
1 BB
2 BB
3 BB
4 BB
7

jeudi, 15 avril 2010

slide-45
SLIDE 45

uint32_t function_0001(uint32_t param1, uint32_t param2) { /* ... */ BB1: goto BB2; BB2: v1 = read_port(param1); BB3: v2 = read_port(param2); BB4: if (v1 & 0x21) goto BB8; BB5: write_port(param2, 0x1234); BB6: goto BB7; BB8: write_port(param1, 0x4567); BB9: goto BB7; BB7: }

CFG

BB
1 BB
2 BB
3 BB
4 BB
5 BB
6 BB
7 BB
8 BB
9 BB
1 BB
2 BB
3 BB
4 BB
7

jeudi, 15 avril 2010

slide-46
SLIDE 46

RevNIC


SyntheDc
Driver NIC
Driver
 Template Virtual
Machine Guest
OS

Original
Binary
Driver

Driver
Exerciser RevNIC
Code
 Synthesizer

Hardware
 interac3on
traces

Traces ➔
C code

jeudi, 15 avril 2010

slide-47
SLIDE 47

RevNIC


SyntheDc
Driver NIC
Driver
 Template Virtual
Machine Guest
OS

Original
Binary
Driver

Driver
Exerciser RevNIC
Code
 Synthesizer

Hardware
 interac3on
traces

Traces ➔
C code C code ➔
driver

jeudi, 15 avril 2010

slide-48
SLIDE 48

Device
Driver
Structure

  • Hardware‐facing
funcDons

Automa3cally
synthesized
by
RevNIC

  • OS‐facing
funcDons

Provided
by
the
driver
template

jeudi, 15 avril 2010

slide-49
SLIDE 49

Driver Template Hardware
 InteracDon
Code

jeudi, 15 avril 2010

slide-50
SLIDE 50

Templates contain
OS‐ specific
 boilerplate

Linux
Network
Driver
Template

int pci_nic_init(...) {

/* Allocate device resources */

i = pci_enable_device (pdev); if (i) { ... } ioaddr = pci_resource_start (pdev, 0); irq = pdev->irq; if (request_region (ioaddr, ADDR_RANGE, DRV_NAME) == NULL) { ... }

/* --------------------------------- * Insert device detection code here * --------------------------------- */ /* Allocate private memory */

dev = alloc_netdev(...); if (!dev) { ... }

/* Register entry points */

... }

jeudi, 15 avril 2010

slide-51
SLIDE 51

Templates contain
OS‐ specific
 boilerplate

Linux
Network
Driver
Template

int pci_nic_init(...) {

/* Allocate device resources */

i = pci_enable_device (pdev); if (i) { ... } ioaddr = pci_resource_start (pdev, 0); irq = pdev->irq; if (request_region (ioaddr, ADDR_RANGE, DRV_NAME) == NULL) { ... }

/* --------------------------------- * Insert device detection code here * --------------------------------- */ /* Allocate private memory */

dev = alloc_netdev(...); if (!dev) { ... }

/* Register entry points */

... }

jeudi, 15 avril 2010

slide-52
SLIDE 52

/* Allocate private memory */

dev = alloc_netdev(...); if (!dev) { ... }

/* Register entry points */

... } int pci_nic_init(...) {

/* Allocate device resources */

i = pci_enable_device (pdev); if (i) { ... } ioaddr = pci_resource_start (pdev, 0); irq = pdev->irq; if (request_region (ioaddr, ADDR_RANGE, DRV_NAME) == NULL) { ... }

/* --------------------------------- * Insert device detection code here * --------------------------------- */

jeudi, 15 avril 2010

slide-53
SLIDE 53

/* Allocate private memory */

dev = alloc_netdev(...); if (!dev) { ... }

/* Register entry points */

... } int pci_nic_init(...) {

/* Allocate device resources */

i = pci_enable_device (pdev); if (i) { ... } ioaddr = pci_resource_start (pdev, 0); irq = pdev->irq; if (request_region (ioaddr, ADDR_RANGE, DRV_NAME) == NULL) { ... }

/* --------------------------------- * Insert device detection code here * --------------------------------- */

Placeholders
for
 hardware
interacDon

jeudi, 15 avril 2010

slide-54
SLIDE 54

/* Allocate private memory */

dev = alloc_netdev(...); if (!dev) { ... }

/* Register entry points */

... } int pci_nic_init(...) {

/* Allocate device resources */

i = pci_enable_device (pdev); if (i) { ... } ioaddr = pci_resource_start (pdev, 0); irq = pdev->irq; if (request_region (ioaddr, ADDR_RANGE, DRV_NAME) == NULL) { ... }

/* --------------------------------- * Insert device detection code here * --------------------------------- */

if (hw_checkdevice(ioaddr) < 0) { v1 = read_port(ioaddr); if (!(v1 & 1)) { goto lbl0; } write_port(ioaddr, 0); lbl0: write_port(ioaddr, 1); }

jeudi, 15 avril 2010

slide-55
SLIDE 55

RevNIC


SyntheDc
Driver NIC
Driver
 Template Virtual
Machine Guest
OS

Original
Binary
Driver

Driver
Exerciser RevNIC
Code
 Synthesizer

Hardware
 interac3on
traces

jeudi, 15 avril 2010

slide-56
SLIDE 56

RevNIC


SyntheDc
Driver NIC
Driver
 Template Virtual
Machine Guest
OS

Original
Binary
Driver

Driver
Exerciser RevNIC
Code
 Synthesizer

Hardware
 interac3on
traces

insmod revnic_driver.ko

jeudi, 15 avril 2010

slide-57
SLIDE 57
  • QEMU
virtual
machine1
  • x86‐to‐LLVM
translator
  • KLEE
symbolic
execuDon
engine2

ImplementaDon

1
F.
Bellard.
QEMU,
a
Fast
and
Portable
Dynamic
Translator.
In
USENIX
2005. 2
C.
Cadar
et
al.
KLEE:
Unassisted
and
automa3c
genera3on
of
high‐coverage
tests
for


complex
systems
programs.
In
OSDI
2008.

jeudi, 15 avril 2010

slide-58
SLIDE 58

EvaluaDon

  • RevNIC
can
port
network
drivers
between
  • different
OS
plaiorms
  • different
hardware
architectures
  • SyntheDc
drivers
have
good
performance

jeudi, 15 avril 2010

slide-59
SLIDE 59

Reverse
Engineered
Drivers

Driver Size1
 AMD
PCNet 35
KB Realtek
RTL8139 20
KB SMSC
91C111 19
KB Realtek
RTL8029
(NE2000) 18
KB

1
80%
of
Linux
2.6.26
NIC
drivers
are
smaller
than
35KB

jeudi, 15 avril 2010

slide-60
SLIDE 60

Target
Plaiorms

http://bplteensofwa.files.wordpress.com/2009/07/computer.jpg

Windows Linux KitOS μC/OS II Windows

jeudi, 15 avril 2010

slide-61
SLIDE 61

Target
Plaiorms

http://bplteensofwa.files.wordpress.com/2009/07/computer.jpg

x86 PC RTL8139 Windows Linux KitOS μC/OS II Windows

jeudi, 15 avril 2010

slide-62
SLIDE 62

Target
Plaiorms

http://bplteensofwa.files.wordpress.com/2009/07/computer.jpg

x86 PC VMware QEMU PCnet, NE2000 RTL8139 Windows Linux KitOS μC/OS II Windows

jeudi, 15 avril 2010

slide-63
SLIDE 63

Target
Plaiorms

http://bplteensofwa.files.wordpress.com/2009/07/computer.jpg

x86 PC VMware QEMU FPGA4U PCnet, NE2000 SMSC 91C111 RTL8139 Windows Linux KitOS μC/OS II Windows

jeudi, 15 avril 2010

slide-64
SLIDE 64

EffecDveness

  • RevNIC
reverse
engineers
all
relevant


funcDonality

  • IniDalizaDon,
sending,
recepDon,
shutdown,


DMA,
etc.

jeudi, 15 avril 2010

slide-65
SLIDE 65

Performance

20 40 60 80 100 200 400 600 800 1000 1200 1400 Throughput (Mbps) UDP Packet Size (Bytes) Windows→KitOS Windows→Windows Linux Original Windows→Linux Windows Original

jeudi, 15 avril 2010

slide-66
SLIDE 66

Performance

20 40 60 80 100 200 400 600 800 1000 1200 1400 Throughput (Mbps) UDP Packet Size (Bytes) Windows→KitOS Windows→Windows Linux Original Windows→Linux Windows Original

jeudi, 15 avril 2010

slide-67
SLIDE 67

Performance

20 40 60 80 100 200 400 600 800 1000 1200 1400 Throughput (Mbps) UDP Packet Size (Bytes) Windows→KitOS Windows→Windows Linux Original Windows→Linux Windows Original

jeudi, 15 avril 2010

slide-68
SLIDE 68

Performance

20 40 60 80 100 200 400 600 800 1000 1200 1400 Throughput (Mbps) UDP Packet Size (Bytes) Windows→KitOS Windows→Windows Linux Original Windows→Linux Windows Original

jeudi, 15 avril 2010

slide-69
SLIDE 69

PorDng
Effort


jeudi, 15 avril 2010

slide-70
SLIDE 70

PorDng
Effort


80%
basic
block
coverage ~20
min Zero
manual
effort

Virtual
Machine Guest
OS

Original
Binary
Driver

Driver
Exerciser

jeudi, 15 avril 2010

slide-71
SLIDE 71

PorDng
Effort


RevNIC Code Synthesizer

80%
basic
block
coverage ~20
min Zero
manual
effort ~1
min Zero
manual
effort

Virtual
Machine Guest
OS

Original
Binary
Driver

Driver
Exerciser

jeudi, 15 avril 2010

slide-72
SLIDE 72

PorDng
Effort


NIC
Driver
 Template RevNIC Code Synthesizer

80%
basic
block
coverage ~20
min Zero
manual
effort ~1
min Zero
manual
effort Few
hours
‐
5
days One‐Dme
effort

Virtual
Machine Guest
OS

Original
Binary
Driver

Driver
Exerciser

jeudi, 15 avril 2010

slide-73
SLIDE 73

PorDng
Effort


SyntheDc
Driver (e.g.,
Linux) NIC
Driver
 Template RevNIC Code Synthesizer

80%
basic
block
coverage ~20
min Zero
manual
effort ~1
min Zero
manual
effort Few
hours
‐
5
days One‐Dme
effort

Virtual
Machine Guest
OS

Original
Binary
Driver

Driver
Exerciser

jeudi, 15 avril 2010

slide-74
SLIDE 74

PorDng
Effort

Device Manual
(Linux) Manual
(Linux) RevNIC vNIC Device Persons Span Persons Span RTL8139 18 4
years 1 1
week 91C111 8 4
years 1 4
days NE2000 5 2
years 1 5
days PCNet 3 4
years 1 1
week

RevNIC
speeds
up
driver
development

jeudi, 15 avril 2010

slide-75
SLIDE 75

PorDng
Effort

Device Manual
(Linux) Manual
(Linux) RevNIC vNIC Device Persons Span Persons Span RTL8139 18 4
years 1 1
week 91C111 8 4
years 1 4
days NE2000 5 2
years 1 5
days PCNet 3 4
years 1 1
week

RevNIC
speeds
up
driver
development

jeudi, 15 avril 2010

slide-76
SLIDE 76

PorDng
Effort

Device Manual
(Linux) Manual
(Linux) RevNIC vNIC Device Persons Span Persons Span RTL8139 18 4
years 1 1
week 91C111 8 4
years 1 4
days NE2000 5 2
years 1 5
days PCNet 3 4
years 1 1
week

Mostly fixing undocumented quirks

RevNIC
speeds
up
driver
development

jeudi, 15 avril 2010

slide-77
SLIDE 77

PorDng
Effort

Device Manual
(Linux) Manual
(Linux) RevNIC vNIC Device Persons Span Persons Span RTL8139 18 4
years 1 1
week 91C111 8 4
years 1 4
days NE2000 5 2
years 1 5
days PCNet 3 4
years 1 1
week

RevNIC
speeds
up
driver
development

jeudi, 15 avril 2010

slide-78
SLIDE 78

RevNIC

  • Reverse
engineering
of
driver’s
state
machine


from
interacDon
traces

  • High‐coverage
reverse
engineering
through


symbolic
execuDon

  • Using
symbolic
hardware
for
reverse


engineering
without
access
to
original
devices

jeudi, 15 avril 2010

slide-79
SLIDE 79

RevNIC

  • Reverse
engineering
of
driver’s
state
machine


from
interacDon
traces

  • High‐coverage
reverse
engineering
through


symbolic
execuDon

  • Using
symbolic
hardware
for
reverse


engineering
without
access
to
original
devices

http://reveng.epfl.ch

jeudi, 15 avril 2010