Compiler-Assisted Binary Parsing

Transcription

1 Compiler-Assisted Binary Parsing Tugrul Ince PD Week March 2012

2 Parsing Binary Files Binary analysis is common for o Performance modeling o Computer security o Maintenance o Binary modification Parsing: first step in most binary analyses o Not straight-forward o Time consuming 2

3 Objective Improve parsing speed and accuracy Store more data in binary files o Basic block locations o Edge information (source, target, type) Binary analysis tools read this extra information o Create basic block, edge, and finally CFG abstractions 3

4 Difficulties in Parsing Distinguishing code and data Disassembly is tricky o Identifying functions o Finding instruction boundaries Variable-length instruction set architectures Building Control Flow Graphs o Identify Basic Block boundaries o Identify edges between basic blocks 4

5 Compiler Assistance for Parsing Developed new compilation mechanism o Wrappers for GNU compiler suite (gcc/g++) o Transparent to the end user Support most standard flags o Pass flags to underlying system compiler o Intercept output flags (-c, -S, -o, etc.) Augments binary files with tables o Basic Block Table o Edge Table 5

6 Compiler Infrastructure Analyze intermediate assembly files o Generate information about basic blocks and edges o Store in a section that is not loaded at runtime 6

7 Basic Block -Edge Tables 7

8 Assembly Modification Function Model o Block of code o o.size Modifications o Add Basic Block and Edge Tables o Add shadow symbol 8

9 Merge Duplicate Functions Weak functions are merged by linker o Functions included multiple times o Binary code might slightly differ o Only one weak function survives Tables cannot be merged o Need to uniquely match functions and tables o Use shadow symbol in function to extract file name o Use file name and function name to identify tables 9

10 Reconstruction Binary analysis tools operate on executables directly o No interaction with the compiler 10

11 Reconstruction Parsing a functions involves: o Finding the shadow symbol stored in the function File name is extracted o Locating Basic Block and Edge Tables with the function name and file name pair o Reading in the tables o Adding function start address to offsets o Creating basic block and edge abstractions No need to parse individual instructions 11

12 Benchmarks o SPEC CINT2006 o PETSc snes package o Firefox (v ) Systems Evaluation o 64-bit Linux machines o server: 24-core Intel Xeon, 48 GB total memory o laptop: AMD Turion, 2 GB total memory Methodology o Executed running time experiments 5 times o Reporting mean 12

13 Normalized Parsing Time SPEC CINT Benchmark GNU Tables astar bzip gcc gobmk h264ref hmmer Benchmark GNU Tables libquantum mcf omnetpp perlbench sjeng Xalan

14 Normalized Parsing Time PETScsnesPackage 1 Benchmark GNU Tables 0.9 ex ex ex ex1f ex ex ex ex ex Benchmark GNU Tables ex ex ex ex ex ex ex ex Benchmark GNU Tables ex34f ex ex ex ex5f ex5f ex ex

15 Normalized Parsing Time Firefox Version Benchmark GNU Tables firefox libbrowsercomps libdbusservice libfreebl libmozalloc libmozgnome libmozsqlite Benchmark GNU Tables libnkgnomevfs libnspr libnss libnssckbi libnssdbm libnssutil Benchmark GNU Tables libplc libplds libsmime libsoftokn libssl libxpcom

16 Build Time Metrics File Size Without Debug With Debug Compilation Time SPEC CINT x 1.38x 1.25x PETSc 1.50x 1.09x 1.32x Firefox 1.17x 1.21x 1.13x OVERALL 1.63x 1.23x 1.23x File size increase on disk o Not reflected to memory footprint Small increase in compilation time o One time cost o Not reflected to running time performance 16

17 Runtime Metrics Memory Footprint Running Time SPEC CINT x 0.97x PETSc 1.00x 0.95x Firefox 1.00x 0.94x OVERALL 1.00x 0.95x Virtually no change in runtime metrics o Memory requirement is almost constant o Change in running time is within noise Hard to measure Firefox running time o No workload o Use V8 Benchmark 17

18 V8 Benchmarks for Firefox V8 Benchmark Value Firefox with gcc Firefox with our mechanism V8: JavaScript benchmark o Higher scores are better o Cannot be converted to time No significant change in performance 18

19 Limitations / Future Work Hand-written assembly o When branches use offsets in assembly 2n more symbols (n: number of functions) Compilation takes 23% more time o Integrate compilation mechanism into gcc File size increases o Compress tables about 78% compression ratio 19

20 Conclusion Developed a new compilation mechanism o Creates Basic Block and Edge Tables o Transparent to end user Improved parsing speed o On average 73% decrease in parsing time o No memory or runtime overhead 20