DMCA
Unleashing Mayhem on Binary Code (2012)
Cached
Download Links
| Venue: | In Proceedings of the IEEE Symposium on Security and Privacy |
| Citations: | 28 - 4 self |
BibTeX
@INPROCEEDINGS{Cha12unleashingmayhem,
author = {Sang Kil Cha and Thanassis Avgerinos and Re Rebert and David Brumley},
title = {Unleashing Mayhem on Binary Code},
booktitle = {In Proceedings of the IEEE Symposium on Security and Privacy},
year = {2012},
pages = {380--394}
}
Share
 |
 |
 |
 |
||
OpenURL
Abstract
Abstract—In this paper we present MAYHEM, a new sys-tem for automatically finding exploitable bugs in binary (i.e., executable) programs. Every bug reported by MAYHEM is accompanied by a working shell-spawning exploit. The working exploits ensure soundness and that each bug report is security-critical and actionable. MAYHEM works on raw binary code without debugging information. To make exploit generation possible at the binary-level, MAYHEM addresses two major technical challenges: actively managing execution paths without exhausting memory, and reasoning about symbolic memory indices, where a load or a store address depends on user input. To this end, we propose two novel techniques: 1) hybrid symbolic execution for combining online and offline (concolic) execution to maximize the benefits of both techniques, and 2) index-based memory modeling, a technique that allows MAYHEM to efficiently reason about symbolic memory at the binary level. We used MAYHEM to find and demonstrate 29 exploitable vulnerabilities in both Linux and Windows programs, 2 of which were previously undocumented. Keywords-hybrid execution, symbolic memory, index-based memory modeling, exploit generation I.
Keyphrases
binary code index-based memory modeling symbolic memory exploit generation raw binary code store address hybrid symbolic execution binary level exploitable bug symbolic memory index window program novel technique new sys-tem major technical challenge execution path exploitable vulnerability keywords-hybrid execution shell-spawning exploit bug report user input
