Exceptional Interprocedural Control Flow Graphs for x86-64 Binaries

Joshua Bockenek; Freek Verbeek; Binoy Ravindran

doi:10.1007/978-3-031-64171-8_1

Exceptional Interprocedural Control Flow Graphs for x86-64 Binaries

Joshua Bockenek^*, Freek Verbeek, Binoy Ravindran

^*Corresponding author for this work

Research output: Chapter in Book/Report/Conference proceeding › Conference Article in proceeding › Academic › peer-review

Abstract

Standard control flow graphs (CFGs) extracted from binaries by state-of-the-art disassembly/decompilation tools do not include information about exception-related control flow. However, such information is useful when statically analyzing programs that utilize structured exceptions. To fill that gap, we propose the concept of Exceptional Interprocedural Control Flow Graphs (EICFGs). These graphs extend traditional CFGs by adding edges for stack unwinding, frame cleanup, and try/catch behavior caused by thrown exceptions. We provide an approach for generating EICFGs from x86-64 binaries featuring C++ exceptions. The approach is based on symbolically executing an abstract semantics that includes binary-level exception-related function calls. We validated our abstract semantics by generating concrete test cases that were then evaluated using real binaries. We applied an implementation of our approach to 341 off-the-shelf x86-64 binaries compiled from C++ as well as C and Fortran source code. From those binaries, we identified 2574 unique throws and successfully resolved the exceptional control flow for every one of them. We show that resolving throws leads to increased instruction reachability and uncovers edges not found by state-of-the-art tools such as Ghidra.

Original language	English
Title of host publication	Detection of Intrusions and Malware, and Vulnerability Assessment - 21st International Conference, DIMVA 2024, Proceedings
Editors	Federico Maggi, Manuel Egele, Mathias Payer, Michele Carminati
Publisher	Springer Science and Business Media Deutschland GmbH
Pages	3-22
Number of pages	20
ISBN (Print)	9783031641701
DOIs	https://doi.org/10.1007/978-3-031-64171-8_1
Publication status	Published - 2024
Event	21st International Conference on Detection of Intrusions and Malware, and Vulnerability Assessment, DIMVA 2024 - Lausanne, Switzerland Duration: 17 Jul 2024 → 19 Jul 2024 https://www.dimva.org/dimva2024/

Publication series

Series	Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
Volume	14828 LNCS
ISSN	0302-9743

Conference

Conference	21st International Conference on Detection of Intrusions and Malware, and Vulnerability Assessment, DIMVA 2024
Abbreviated title	DIMVA 2024
Country/Territory	Switzerland
City	Lausanne
Period	17/07/24 → 19/07/24
Internet address	https://www.dimva.org/dimva2024/

Keywords

Binary Analysis
C++ exceptions
Control Flow Graphs

Access to Document

10.1007/978-3-031-64171-8_1

Cite this

Bockenek, J., Verbeek, F., & Ravindran, B. (2024). Exceptional Interprocedural Control Flow Graphs for x86-64 Binaries. In F. Maggi, M. Egele, M. Payer, & M. Carminati (Eds.), Detection of Intrusions and Malware, and Vulnerability Assessment - 21st International Conference, DIMVA 2024, Proceedings (pp. 3-22). Springer Science and Business Media Deutschland GmbH. https://doi.org/10.1007/978-3-031-64171-8_1

Bockenek, Joshua ; Verbeek, Freek ; Ravindran, Binoy. / Exceptional Interprocedural Control Flow Graphs for x86-64 Binaries. Detection of Intrusions and Malware, and Vulnerability Assessment - 21st International Conference, DIMVA 2024, Proceedings. editor / Federico Maggi ; Manuel Egele ; Mathias Payer ; Michele Carminati. Springer Science and Business Media Deutschland GmbH, 2024. pp. 3-22 (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics), Vol. 14828 LNCS).

@inproceedings{34126dac6cd443b1bd257ae0db54f882,

title = "Exceptional Interprocedural Control Flow Graphs for x86-64 Binaries",

abstract = "Standard control flow graphs (CFGs) extracted from binaries by state-of-the-art disassembly/decompilation tools do not include information about exception-related control flow. However, such information is useful when statically analyzing programs that utilize structured exceptions. To fill that gap, we propose the concept of Exceptional Interprocedural Control Flow Graphs (EICFGs). These graphs extend traditional CFGs by adding edges for stack unwinding, frame cleanup, and try/catch behavior caused by thrown exceptions. We provide an approach for generating EICFGs from x86-64 binaries featuring C++ exceptions. The approach is based on symbolically executing an abstract semantics that includes binary-level exception-related function calls. We validated our abstract semantics by generating concrete test cases that were then evaluated using real binaries. We applied an implementation of our approach to 341 off-the-shelf x86-64 binaries compiled from C++ as well as C and Fortran source code. From those binaries, we identified 2574 unique throws and successfully resolved the exceptional control flow for every one of them. We show that resolving throws leads to increased instruction reachability and uncovers edges not found by state-of-the-art tools such as Ghidra.",

keywords = "Binary Analysis, C++ exceptions, Control Flow Graphs",

author = "Joshua Bockenek and Freek Verbeek and Binoy Ravindran",

note = "Publisher Copyright: {\textcopyright} The Author(s), under exclusive license to Springer Nature Switzerland AG 2024.; 21st International Conference on Detection of Intrusions and Malware, and Vulnerability Assessment, DIMVA 2024, DIMVA 2024 ; Conference date: 17-07-2024 Through 19-07-2024",

year = "2024",

doi = "10.1007/978-3-031-64171-8_1",

language = "English",

isbn = "9783031641701",

series = "Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)",

publisher = "Springer Science and Business Media Deutschland GmbH",

pages = "3--22",

editor = "Federico Maggi and Manuel Egele and Mathias Payer and Michele Carminati",

booktitle = "Detection of Intrusions and Malware, and Vulnerability Assessment - 21st International Conference, DIMVA 2024, Proceedings",

address = "Germany",

url = "https://www.dimva.org/dimva2024/",

}

Bockenek, J, Verbeek, F & Ravindran, B 2024, Exceptional Interprocedural Control Flow Graphs for x86-64 Binaries. in F Maggi, M Egele, M Payer & M Carminati (eds), Detection of Intrusions and Malware, and Vulnerability Assessment - 21st International Conference, DIMVA 2024, Proceedings. Springer Science and Business Media Deutschland GmbH, Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics), vol. 14828 LNCS, pp. 3-22, 21st International Conference on Detection of Intrusions and Malware, and Vulnerability Assessment, DIMVA 2024, Lausanne, Switzerland, 17/07/24. https://doi.org/10.1007/978-3-031-64171-8_1

Exceptional Interprocedural Control Flow Graphs for x86-64 Binaries. / Bockenek, Joshua; Verbeek, Freek; Ravindran, Binoy.
Detection of Intrusions and Malware, and Vulnerability Assessment - 21st International Conference, DIMVA 2024, Proceedings. ed. / Federico Maggi; Manuel Egele; Mathias Payer; Michele Carminati. Springer Science and Business Media Deutschland GmbH, 2024. p. 3-22 (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics), Vol. 14828 LNCS).

Research output: Chapter in Book/Report/Conference proceeding › Conference Article in proceeding › Academic › peer-review

TY - GEN

T1 - Exceptional Interprocedural Control Flow Graphs for x86-64 Binaries

AU - Bockenek, Joshua

AU - Verbeek, Freek

AU - Ravindran, Binoy

N1 - Publisher Copyright: © The Author(s), under exclusive license to Springer Nature Switzerland AG 2024.

PY - 2024

Y1 - 2024

N2 - Standard control flow graphs (CFGs) extracted from binaries by state-of-the-art disassembly/decompilation tools do not include information about exception-related control flow. However, such information is useful when statically analyzing programs that utilize structured exceptions. To fill that gap, we propose the concept of Exceptional Interprocedural Control Flow Graphs (EICFGs). These graphs extend traditional CFGs by adding edges for stack unwinding, frame cleanup, and try/catch behavior caused by thrown exceptions. We provide an approach for generating EICFGs from x86-64 binaries featuring C++ exceptions. The approach is based on symbolically executing an abstract semantics that includes binary-level exception-related function calls. We validated our abstract semantics by generating concrete test cases that were then evaluated using real binaries. We applied an implementation of our approach to 341 off-the-shelf x86-64 binaries compiled from C++ as well as C and Fortran source code. From those binaries, we identified 2574 unique throws and successfully resolved the exceptional control flow for every one of them. We show that resolving throws leads to increased instruction reachability and uncovers edges not found by state-of-the-art tools such as Ghidra.

AB - Standard control flow graphs (CFGs) extracted from binaries by state-of-the-art disassembly/decompilation tools do not include information about exception-related control flow. However, such information is useful when statically analyzing programs that utilize structured exceptions. To fill that gap, we propose the concept of Exceptional Interprocedural Control Flow Graphs (EICFGs). These graphs extend traditional CFGs by adding edges for stack unwinding, frame cleanup, and try/catch behavior caused by thrown exceptions. We provide an approach for generating EICFGs from x86-64 binaries featuring C++ exceptions. The approach is based on symbolically executing an abstract semantics that includes binary-level exception-related function calls. We validated our abstract semantics by generating concrete test cases that were then evaluated using real binaries. We applied an implementation of our approach to 341 off-the-shelf x86-64 binaries compiled from C++ as well as C and Fortran source code. From those binaries, we identified 2574 unique throws and successfully resolved the exceptional control flow for every one of them. We show that resolving throws leads to increased instruction reachability and uncovers edges not found by state-of-the-art tools such as Ghidra.

KW - Binary Analysis

KW - C++ exceptions

KW - Control Flow Graphs

U2 - 10.1007/978-3-031-64171-8_1

DO - 10.1007/978-3-031-64171-8_1

M3 - Conference Article in proceeding

AN - SCOPUS:85200697337

SN - 9783031641701

T3 - Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)

SP - 3

EP - 22

BT - Detection of Intrusions and Malware, and Vulnerability Assessment - 21st International Conference, DIMVA 2024, Proceedings

A2 - Maggi, Federico

A2 - Egele, Manuel

A2 - Payer, Mathias

A2 - Carminati, Michele

PB - Springer Science and Business Media Deutschland GmbH

T2 - 21st International Conference on Detection of Intrusions and Malware, and Vulnerability Assessment, DIMVA 2024

Y2 - 17 July 2024 through 19 July 2024

ER -

Bockenek J, Verbeek F, Ravindran B. Exceptional Interprocedural Control Flow Graphs for x86-64 Binaries. In Maggi F, Egele M, Payer M, Carminati M, editors, Detection of Intrusions and Malware, and Vulnerability Assessment - 21st International Conference, DIMVA 2024, Proceedings. Springer Science and Business Media Deutschland GmbH. 2024. p. 3-22. (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics), Vol. 14828 LNCS). doi: 10.1007/978-3-031-64171-8_1