Automatically Mitigating Vulnerabilities in Binary Programs via Partially Recompilable Decompilation

TL;DR

This paper introduces Partially Recompilable Decompilation (PRD), an automated approach to locate, analyze, and patch vulnerabilities in binary programs by decompiling suspect functions, enabling effective vulnerability mitigation without source code.

Contribution

PRD is a novel method that successfully decompiles and recompiles individual binary functions without source code, facilitating automated vulnerability repair at the function level.

Findings

70-89% of individual functions are successfully decompiled and recompiled.

PRD produces test-equivalent binaries 92.9% of the time when decompilation succeeds.

PRD-enabled automated program repair achieves 85 mitigations out of 148 scenarios, comparable to source-level tools.

Abstract

Vulnerabilities are challenging to locate and repair, especially when source code is unavailable and binary patching is required. Manual methods are time-consuming, require significant expertise, and do not scale to the rate at which new vulnerabilities are discovered. Automated methods are an attractive alternative, and we propose Partially Recompilable Decompilation (PRD). PRD lifts suspect binary functions to source, available for analysis, revision, or review, and creates a patched binary using source- and binary-level techniques. Although decompilation and recompilation do not typically work on an entire binary, our approach succeeds because it is limited to a few functions, like those identified by our binary fault localization. We evaluate these assumptions and find that, without any grammar or compilation restrictions, 70-89% of individual functions are successfully decompiled and recompiled with sufficient type recovery. In comparison, only 1.7% of the full C-binaries succeed. When decompilation succeeds, PRD produces test-equivalent binaries 92.9% of the time. In addition, we evaluate PRD in two contexts: a fully automated process incorporating source-level Automated Program Repair (APR) methods; human-edited source-level repairs. When evaluated on DARPA Cyber Grand Challenge (CGC) binaries, we find that PRD-enabled APR tools, operating only on binaries, performs as well as, and sometimes better than full-source tools, collectively mitigating 85 of the 148 scenarios, a success rate consistent with these same tools operating with access to the entire source code. PRD achieves similar success rates as the winning CGC entries, sometimes finding higher-quality mitigations than those produced by top CGC teams. For generality, our evaluation includes two independently developed APR tools and C++, Rode0day, and real-world binaries.