32

When we're doing reverse engineering, we have a few levels of models. One of them is the instruction semantics model, which tells us what every native instruction does to modify instruction state. We're making progress there. However, another problem is that of platform semantics, which is at a higher level.

For example, a high-level model of a userspace linux program would need to include information about mprotect and that it can alter the visibility of certain regions of code. Threading and callback semantics are also a platform modeling issue, we can discover a programs entrypoint from its header (which is another kind of semantic! but one we're probably not going to compromise on), but other entrypoints are published in the program in the form of arguments to atexit, pthread_create, etc.

What is our current best effort/state of the art at capturing this high level platform information in a way that is understood by practicioners? What about by mechanical / automated understanding systems? I know that IDA has (or has to have) information about different platform APIs, it seems to know that when an immediate is a parameter to pthread_create then that immediate is a pointer to code and should be treated as such. What do we have beyond that?

Improve this question
2
  • 1
    Are you asking for something like REIL or BUP, but at the "program"/code level instead of the instruction level?
    – Jesper.Reenberg
    Mar 20, 2013 at 1:39
  • He is referring to a model of the environment in which the application runs, like an "IL" for the system. For example, what's the best way to model the call connect() followed by a subsequent call recv().
    – endeavor
    Mar 26, 2013 at 16:18

2 Answers 2

Reset to default
9

Direct Detection

At the lowest level you can just have copies of the libraries and check if they are the one used.

Signature based Detection

At a higher level than that is IDA FLIRT which stores just enough information about a library to identify its use. But its main benefit is reduced disk usage... it is worth noting that you can add more definitions to the default ones.

Hex-Rays talks about the technology in-depth here.

Generic recognition

Tools like Coverity or the Clang static analyzer or KLEE are more general and more likely to include models for programming idioms.

The only thing I know of coming close to IDA that is open source is radare which might have some library recognition. Also radare's main page. And I have been looking since I am hunting something like IDA that supports SPARC for free and it looks like radare does although I haven't had time it give it a go yet.

From what I can tell REC and Boomerang do not recognize libraries the way IDA does, but instead just attempt to decompile everything. BAP does analysis of binaries and is derived from the Vine component of the BitBlaze project the two projects below are part of as well.

Flow Analysis

TEMU and Rudder here look to be quite advanced. And deal with code as it executes. TEMU helps to relate imputs and outputs to the flow.

It is also worth noting that the Bitblaze tools are designed to provide traces for use in IDA although they could probably be adapted for use otherwise.

Going off of the specifics you provided TEMU sounds the closest to what you want.... it allows you to mark tainted inputs (memory locations, physical inputs etc...) and detect the effects of those taints on the execution. If you want to try out TEMU and are on a newer Linux distro (anything with GCC 4+ which is most anything in the past few years) follow the instructions here.

Improve this answer
2

I'm not sure I understand the question but various sandbox solutions(Norman, Androguard) tend to produce a log of events on the system which my give you some idea of the platform and it's state. Other than that I'm unaware on any tools which would help you determine system state via static analysis. I use a debugger to answer such questions when possible and manual static analysis when not.

Improve this answer
1
  • I think this is more related to the actual modeling of the functions of the system. The only think I can think of which does this sort of thing is static code analysis products such as Coverity, Fortify and Klocwork.
    – Peter Andersson
    Mar 28, 2013 at 15:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.