Comment by hoosieree
4 years ago
> Is there any new approach in the works? Maybe something ML-based for optimization?
I'm doing a PhD on this.
My goal is to detect known functions from obfuscated binaries.
The biggest challenge by far is building a good dataset. Unlike computer vision (millions of pictures with the label "dog") the number of training examples for a typical function is one. For now I'm focusing on C standard libraries, since there are a handful of real-world implementations plus some FOSS or students samples available for things like strlen and atoi.
If anyone wants to collaborate, feel free to message me.
I'm not sure I follow - wouldn't many statically linked programs have much of some version of libc within them? So you could take any program, change it to be statically linked and use that for training?
That said I assume I'm missing something here.
Could a best guess + fuzzing + compiling the decompiled code work towarda a heuristic?
Not sure exactly what you mean by "best guess + fuzzing", but I have compiled code that was first decompiled by Ghidra. The problem is there are lots of invalid identifiers in the decompiled output.
The worst are symbols that are used inconsistently within the same function, like a parameter which is passed in as a long and then used as a pointer to a struct or even as a function.
The Ghidra community basically says you should not expect the exported decompiled code to be valid [1,2]. Which is fine, since rount-trip compile-decompile-compile is not exactly Ghidra's purpose.
Maybe there's a setting to make Ghidra export asm literals when it can't figure out a valid disassembly, but I am pretty new to Ghidra so it could just be my own ignorance.
[1]: https://github.com/NationalSecurityAgency/ghidra/issues/236
[2]: https://github.com/NationalSecurityAgency/ghidra/issues/3553
> The worst are symbols that are used inconsistently within the same function, like a parameter which is passed in as a long and then used as a pointer to a struct or even as a function.
Split into new variable. Sounds like ghidra has trouble telling whether it is a reused stoarge location or actually the same variable.
Best guess = something that looks approxinately fitting for the relevant assembly
fuzzing = tweaking the source code to get what it compiles to closer to the actual assembly.
as in, generate a function, see how close its compilation resembles the assembly, tweak until you find a match
3 replies →