Scholarlink

<p>Reverse engineering complex proprietary software is a tedious and time consuming task. A fair amount of the overall effort is usually devoted to locating those software components which are responsible for the functionality of interest (e.g., a proprietary encryption algorithm). To aid this process, several tools, available in the public domain, can be used, implementing sophisticated algorithms for control-flow recovery, stack frame recovery, data type inference, decompilation etc. However, the important problem of decomposing a binary executable to its constituent object files (or compile-units) has not been, in our opinion, sufficiently studied. In this paper we present novel techniques for estimating the number, as well as the boundaries, of compile-units in binary executables. We present algorithms which recover information that improves the precision degree in reverse engineering tasks. In addition, our algorithms can be used to reduce the effort of locating, recovering and understanding specific functionalities of closed-source software. We evaluate our algorithms on the public DeepBinDiff ELF dataset, consisting of <InlineEquation ID="IEq1"> <EquationSource Format="TEX">\(\approx\)</EquationSource> </InlineEquation> 2000 binaries, as well as two larger executables of GNU GDB, built for ARM and AArch64 and show that they consistently approach the ground-truth, with an average recovery precision close to 75%. Furthermore, we show how our research can aid in binary diffing applications, by comparing the recovered compile-unit structure of a pair of Microsoft Windows kernel images. We make our prototype implementation, written in Python and named <i>REcover</i>, publicly available for further evaluation by the reverse engineering community.</p>

错误：搜索内容不能为空，请输入英文关键词
错误：关键词超出字数限制，请精简
高级检索

REcover: towards recovering object files from stripped binary executables

  • 期刊论文

  • 出版模式：

    开放获取

  • 发表日期：

    2025年8月22日

查看全文
  • Chariton Karamitas,
  • Athanasios Kehagias

摘要

Reverse engineering complex proprietary software is a tedious and time consuming task. A fair amount of the overall effort is usually devoted to locating those software components which are responsible for the functionality of interest (e.g., a proprietary encryption algorithm). To aid this process, several tools, available in the public domain, can be used, implementing sophisticated algorithms for control-flow recovery, stack frame recovery, data type inference, decompilation etc. However, the important problem of decomposing a binary executable to its constituent object files (or compile-units) has not been, in our opinion, sufficiently studied. In this paper we present novel techniques for estimating the number, as well as the boundaries, of compile-units in binary executables. We present algorithms which recover information that improves the precision degree in reverse engineering tasks. In addition, our algorithms can be used to reduce the effort of locating, recovering and understanding specific functionalities of closed-source software. We evaluate our algorithms on the public DeepBinDiff ELF dataset, consisting of \(\approx\) 2000 binaries, as well as two larger executables of GNU GDB, built for ARM and AArch64 and show that they consistently approach the ground-truth, with an average recovery precision close to 75%. Furthermore, we show how our research can aid in binary diffing applications, by comparing the recovered compile-unit structure of a pair of Microsoft Windows kernel images. We make our prototype implementation, written in Python and named REcover, publicly available for further evaluation by the reverse engineering community.