Wei's Blog

[Tech] Binary Analysis

Posted on 2021-04-28 Edited on 2024-03-27

Protections Againest Exploitation

ASLR:

DEP: Data Execution Protection

Stack Canaries:

CFI: Control flow integrity

ROP: Return-oriented programming

Closed Source Memory Errors:

Resort to blackbox fuzzing: resulting in shallow coverage close to the provided test cases
Rely on dynamic binary translation: instrument the binary at prohibitively high runtime cost (e.g., 10x to 100x for AFL fuzzing in QEMU mode on LAVA-M)
Use unsound static rewriting based on heuristics

Question: The fundamental difficulty for static rewriting techniques is disambiguating reference and scalar constants

There are three fundamental techniques to rewrite binaries:

recompilation [14], which attempts to lift the code to an intermediate representation; Lifting code to IR for recompilation requires correctly recovering type information from binaries, which remains an open problem.
trampolines [15], [16], which relies on indirection to insert new code segments without changing the size of basic blocks; Trampolines may significantly increase code size, and the extra level of indirection increases performance overhead.
reassembleable assembly [12], [13], which creates an assembly file equivalent to what a compiler would emit, i.e., with relocation symbols for the linker to resolve. Consequently, we believe that resymbolizing binaries for reassembleable assembly is one the most promising technique for static binary rewriting.

[Tech] Binary Analysis

Posted on 2021-04-28 Edited on 2024-03-27

Protections Againest Exploitation

ASLR:

DEP: Data Execution Protection

Stack Canaries:

CFI: Control flow integrity

ROP: Return-oriented programming

Testing Distributed System

Posted on 2021-04-19 Edited on 2024-03-27

https://asatarin.github.io/testing-distributed-systems/

LLVM Asan Code

Posted on 2021-04-10 Edited on 2024-03-27

asan.module_ctor

works the same as __attribute__((constructor)), insert into section .init_array

asan.module_dtor

works the same as __attribute__ ((destructor)), insert into section .fini_array

.section	.init_array.1,"aw",@init_array
.p2align	3
.quad	asan.module_ctor

.section	.init_array,"aw",@init_array
.p2align	3
.quad	test

.section	.fini_array.1,"aw",@fini_array
.p2align	3
.quad	asan.module_dtor

But openark compiler doesn't support constructor and destructor.

Linux Program Startup

Posted on 2021-04-10 Edited on 2024-03-27

原文链接 https://luomuxiaoxiao.com/?p=516

本文介绍main函数如何被执行，并理解如何通过debug了解main函数启动前发生的事情

Rebuttal

Posted on 2021-04-04 Edited on 2024-03-27

I read this paper before (in about 5 mins or less). And like I mentioned to you, although I don't remember the technical details, but I remember 1) key idea is to ensemble multiple fuzzers together and boost the performance, that's new and should be appreciated, although, well, I wonder if we shall trust their reported results (we should believe unless we have concrete evidence), 2) it's very important to remember who published this paper, although it might be difficult to remember the "name", you at least need to remember the institute.