1

Suppose I was to search a file for dangerous C functions:

Assuming that we can perform a dissassembly, and that we cannot perform dynamic analysis is it possible to definitively identify a lack of bounds checking for a given buffer in a scriptable way? One reason why this may not be obvious is that jumps near the functions in question may optimized into positions which at first glance are not related to the original function. I also imagine that bounds checks may look different in compiler generated, programmer generated, and optimized forms.

The ultimate goal is to search the binary for exploitable functions, while reducing the need to hand check each function, or run noisy dynamic analysis tools.

I imagine this may come into play: http://en.wikipedia.org/wiki/Bounds-checking_elimination#In_natively_compiled_languages

The Way I See the Problem:

Although I would very much like to be able to verify this with a small python, or BASH script, I can see how this might be very complex. To fully verify that a function is bounds checked, or not, you might need to trace where its inputs are coming from up to their initial source, and insure that there are not any execution paths which circumvent the check. In that case, I imagine that the script in question would have to map the entire flow of execution of the whole program for this work.

I think my best hope is a way to search an IDA Pro database for this kind of relationship.

  • I think that indeed it's too much of a task for scripting. If you have the source code, there are numerous tools for statical analysis of C code. Otherwise I guess you'll end up having to fuzz/taint your binary. – Dillinur Feb 13 '15 at 9:39
  • I'm more interested in figuring out whether it is theoretically possible to even tell for sure for a given function via static analysis. – baordog Feb 13 '15 at 15:39
  • 1
    It requires constraint propagation, similar to what IDA's x86 processor module does for switch statements. This is closely related to emulation (a la ida-x86emu) and constant propagation, but fundamentally different in the way the ops are 'executed'. Think symbolic execution. – DarthGizka Feb 16 '15 at 14:37
  • That's an interesting direction, I hadn't thought of that way. Not sure how to apply that to my problem. – baordog Feb 16 '15 at 14:38
2

I remember a presentation by Halvar Flake about this topic. Unfortunately I cannot link it, but a Google search for "halvar automated bounds check" will lead you to a Blachat .ppt from 2001.

It contains IDC (IDA Scripting) code to do just that - automated analysis for locations where for example strcpy(), memcpy() and the likes are called.

Maybe this is helpful.

  • Indeed, this is a very nice lead. I will read the presentation and see if it answers my question. At any rate, I think you (or I) will need to edit this answer to reflect some iota of the actual answer (without plagiarizing Mr. Flake of course) – baordog Feb 16 '15 at 14:31
  • So I took a look at the presentation, and while it has added some helpful information, it doesn't really address how to fully verify the bounds checking of a given function. It does make some estimates that are local to the function, but doesn't even attempt to make a judgement. What I'm interested in is whether it is even possible to determine one way or the other the bounds-checked-ness of a function. – baordog Feb 16 '15 at 14:42
0

Yes, to some extent. A great example is from Halvar Flake, called BugScam (last updated in 2003).

Source code for the BugScam IDA plugin: http://sourceforge.net/projects/bugscam/

This project is also referenced in Chris Eagle's IDA Pro book (p 481).

  • 1
    I'm aware of this, but it's fuzzy to what extent you can be sure :( I'd like to see some more concrete info as to how all this works from a theoretical perspective. If I don't get that kind of answer in the next few days, I may accept one of the answers that refers to Halver's work. – baordog Feb 17 '15 at 3:04
0

For a short answer to this, what i will do is check for loops than inside these loops will check if there is any memory read write operation, you have to make a generic signature for that, find the variable that is increasing the address where the memory is been copied, and check that for any bound conditions then these conditions can be compared to signature to check whether it apply boundary checka or not.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.