Visible to the public RetroWrite: Statically Instrumenting COTS Binaries for Fuzzing and Sanitization

TitleRetroWrite: Statically Instrumenting COTS Binaries for Fuzzing and Sanitization
Publication TypeConference Paper
Year of Publication2020
AuthorsDinesh, S., Burow, N., Xu, D., Payer, M.
Conference Name2020 IEEE Symposium on Security and Privacy (SP)
Date PublishedMay 2020
PublisherIEEE
ISBN Number978-1-7281-3497-0
KeywordsComputer bugs, fuzzing, Instruments, Libraries, pubcrawl, resilience, Resiliency, Runtime, Scalability, security, Security by Default, Tools
AbstractAnalyzing the security of closed source binaries is currently impractical for end-users, or even developers who rely on third-party libraries. Such analysis relies on automatic vulnerability discovery techniques, most notably fuzzing with sanitizers enabled. The current state of the art for applying fuzzing or sanitization to binaries is dynamic binary translation, which has prohibitive performance overhead. The alternate technique, static binary rewriting, cannot fully recover symbolization information and hence has difficulty modifying binaries to track code coverage for fuzzing or to add security checks for sanitizers.The ideal solution for binary security analysis would be a static rewriter that can intelligently add the required instrumentation as if it were inserted at compile time. Such instrumentation requires an analysis to statically disambiguate between references and scalars, a problem known to be undecidable in the general case. We show that recovering this information is possible in practice for the most common class of software and libraries: 64-bit, position independent code. Based on this observation, we develop RetroWrite, a binary-rewriting instrumentation to support American Fuzzy Lop (AFL) and Address Sanitizer (ASan), and show that it can achieve compiler-level performance while retaining precision. Binaries rewritten for coverage-guided fuzzing using RetroWrite are identical in performance to compiler-instrumented binaries and outperform the default QEMU-based instrumentation by 4.5x while triggering more bugs. Our implementation of binary-only Address Sanitizer is 3x faster than Valgrind's memcheck, the state-of-the-art binary-only memory checker, and detects 80% more bugs in our evaluation.
URLhttps://ieeexplore.ieee.org/document/9152762
DOI10.1109/SP40000.2020.00009
Citation Keydinesh_retrowrite_2020