Demystify Today's Binary Disassembling and How Modern ABI Makes it Easier

No ratings

Presented at BlackHat Asia 2020 by

Disassembling is the process of restoring instructions and structure information from binary code, forming the foundation of nearly all the solutions for binary security. Incentivized by both industry needs and government programs, binary disassembling gains remarkable advancement and incorporates "magical" techniques to handle complex constructs. In this talk, we will demystify the techniques armed by binary disassembling through a presentation on our study with 8 open-released tools (Ghidra, Angr, McSema, Dyninst, Radare2, Jakstab, Uroboros, and Objdump). We will also give a comprehensive (maybe partial) view of the advancement in binary disassembling across recent years.Going beyond the understanding, we will also present our intensive measurement on the above tools and on the most popular commercial tools (including IDA Pro and Binary Ninja). To support the evaluation, we extend the mainstream compilers (LLVM and GCC) and linker (GNU Gold Linker) to enable end-to-end collection of ground truth (which produce the highest level of completeness and accuracy). As we will detail in the talk, our evaluation separately measures individual techniques to understand their degree of use, utilities, and pitfalls. This evaluation leads to many understandings that are contrary to common beliefs but are expected to significantly facilitate the development of binary disassembling.In the last part, we will present a key finding from our study --- the development of Application Binary Interface (ABI) is making disassembling easier. In particular, ABI is mandating the availability of frame information for exception handling (e.g., System V x86-64 ABI). Such information makes it more reliable to collect function boundaries, function signatures, and local variables from binary code. We will demonstrate a tool that exploits exception handling information to achieve superior utility of disassembling.