Similarity of Binaries Across Optimization Levels and Obfuscation

Abstract

Binary code similarity evaluation has been widely applied in security. Unfortunately, the compiler optimization and obfuscation techniques exert challenges that have not been well addressed by existing approaches. In this paper, we propose a prototype, ImOpt, for re-optimizing code to boost similarity evaluation. The key contribution is an immediate SSA (static single-assignment) transforming algorithm to provide a very fast pointer analysis for re-optimizing more thoroughly. The algorithm transforms variables and even pointers into SSA form on the fly, so that the information on def-use and reachability can be maintained promptly. By utilizing the immediate SSA transforming algorithm, ImOpt canonicalizes and eliminates junk code to alleviate the perturbation from optimization and obfuscation.

We illustrate that ImOpt can improve the accuracy of a state-of-the-art approach on similarity evaluation by 22.7%. Our experiment results demonstrate that the bottleneck part of our SSA transforming algorithm runs 15.7x faster than one of the best similar methods. Furthermore, we show that ImOpt is robust to many obfuscation techniques that based on data dependency.

Appendices

A Appendix 1: Sparse Analysis for Backward Block

The ImSsaSparse procedure is quite similar to the ImSsa procedure, except it sparsely recomputes the visited but invalid block (line 4) to avoid unnecessary re-computation:

The SparseRecompute procedure is similar to the ProcessStatement procedure, except the former only process invalid statements. Another difference is SparseRecompute needs to propagate invalidation through the def-use chain.

B Appendix 2: Supplementary Proofs

1.1 B.1 Appended Proofs for Section 2.3

Proof

(Proof of Lemma 2). Let us assume that there is a backward definition $d \in b'$ reaching the forward block $b_i$, and all the blocks except $b_i$ on any path $p : b' \rightarrow b_i$ are in the SSA form. Then, there should be a back edge $e: b_j \rightarrow b_k$ on the path $p: b' \rightarrow b_i$. Note the block $b_k$ can not be the block $b_i$ since a forward block has no back edge pointing to itself. So, the block $b_k$ should be in SSA form. However, in SSA-form code, a back edge will introduce $\phi$-functions into the block $b_k$ that is at the target end of the edge for every definition that passes through the block $b_k$. These $\phi$-functions will prevent definition d reaching to the successor block $b_i$, which contradicts the assumption. Hence, a forward block has only forward definitions reaching itself in SSA-form code.

Proof

(Proof of Lemma 3). According to Condition 1, the first $i-1$ blocks have already been in SSA form. Then following Lemma 2, only forward definitions can reach block $b_i$. Recall that if a forward definition d can reach a block $b_i$, then there is no back edge on the reaching path $p : d\ \overrightarrow{rc}\ b_i$, which means that the block $b'$ which defines d is ahead of block $b_i$ in reverse post-order.

Proof

(Proof of Lemma 4). According to the definition of the BRG, it is trivial that $b' \in G_{BR}(b_i)$. If there is a path $p: b' \rightarrow b_i$, then $b_i$ is either an IDF of block $b'$ or dominated by an IDF. Besides, there should be a back edge on path p since $d\ \overleftarrow{rc}\ b_i$. If the back edge is in the middle of path p, then the $\phi$-function introduced by it will intercept definition d. That contradicts with the fact that definition d can reach block b. Hence, the back edge can only be the last edge on path p. It means the backward block b cannot be dominated by any block on path p. Therefore, the backward block b is an IDF of block $b'$.

1.2 B.2 Appended Proofs for Section 3.6

To prove Lemma 1, we first show that given Condition 1 the property is satisfied for the i-th block, no matter the block is a forward or backward one.

Lemma 5

Given Condition 1, if the i-th block $b_i$ is a forward block, then the ImSsa procedure also satisfies the invariants in Property 1 for block $b_i$.

Proof

(Proof Sketch of Lemma 5). Based on Lemma 3, all the reachable definitions can be visited before visiting the current block. Global invariant: the variables with dominating definition are linked by $E_{DOM(i)}$ directly, whose validation is confirmed by Condition 1; the other variables, which have multiple reachable definitions, have the $\phi$-functions being inserted in the front of the block when processing the blocks that define these definitions; Hence, the global invariant is held. Local invariant: E and C are well-defined at the beginning of local analysis since the global invariant is held; moreover, their invariants are preserved during the running of ProcessForwardBlock procedure. In conclusion, the local invariant is held.

Lemma 6

If the CFG contains only forward block, the ImSsa procedure satisfies the invariants in Property 1 for all the blocks in that graph.

Proof

This lemma simply follows Lemma 5.

Lemma 7

Given Condition 1, if the i-th block $b_i$ is a backward block, the ImSsa procedure also satisfies the invariants in Property 1. Furthermore, for each block in the BRG, the invariants in Property 1 are also satisfied.

Proof

(Proof Sketch of Lemma 7). Assume that all blocks except $b_i$ in the BRG are forward blocks. According to Lemma 4 and Lemma 6, the ImSsa procedure can propagate all the backward definitions back into block $b_i$ along with the IDF chain by processing $G_{BR}(b_i)$. Additionally, the following SparseRecompute procedure will reveal any new definitions caused by the re-computation and propagate them back, too. Hence, the global invariant is held. Recall that the invariants of E and C are also maintained during the sparse re-computations, therefore, the local invariant is also held. Furthermore, since the BRG $G_{BR}(b_i)$ contains only forward blocks, according to Lemma 6, these invariants are also satisfied for each block in the BRG. As for the case where the BRG contains backward blocks, it can be deductively reasoned from the previous case.

It follows that the ImSsa procedure satisfies Property 1:

Proof

(Proof Sketch of Lemma 1). It is reasonable to assume a forward entry block since we can always insert an empty forward block at the beginning of the CFG. Therefore, the first block satisfies the global invariant because of no reachable definition. Meanwhile, the local invariant is also satisfied according to Lemma 5. That is, the ImSsa procedure satisfies the invariants for the first block. Then the conclusion can be deductively reasoned from Lemma 5 and Lemma 7.