Benefits Achieve more reliability. More software components can be verified. Circumvent problems caused by compiler. The verification target is most close to what is running on a CPU than the source code. Easy to verify. Binaries have more elegant syntax and well defined semantics than source code.
Challenges Instruction complexity. Lack of high level semantic information. Dynamic jump and call, no clear boundaries for “function”. How to specify properties for assembly code. Scalability. Assembly code is much longer than source code.
Design Goals Accuracy: Faithfully handle the complex instructions in some ISA. Extensibility: Easy extensible to handle different Instruction Set of various architecture. Ease of Use: Those who are not familiar with temporal logic or assembly language should also find it is useful. High Efficiency: Scalable to large programs.
Approach Overview (1) ELF Vine IL Vine Emulator Static Analyzer Model Checker User & Built in properties Properties Parser Counter Example
Approach Overview (2) Accuracy and Extensibility: Vine IL. Ease of Use: Built in properties, if source is available, link counter examples back to source. High Efficiency: property guided abstractions techniques for state space reduction; Function abstraction.
ILA @ PAT Vine IL Emulator Static Analyses Built in properties Example-buffer overflow checking
Vine IL Binary file Assembly VEX IR Vine IL Libbfd VineLibVex
Emulator(State builder) Emulator is used to generate the successor states based on the current state. A state consists of CPU registers, PC, memory. Separate global states from local states. Byte precision memory model.
Static Analyses for Space Reduction Stack Analysis Dead Variable Analysis. Value Set Analysis Interrupt Flag Analysis. Path Reduction
Built-in Properties Stack overflow checking Integer overflow checking Null pointer deference. Division by zero checking Uninitialized variable checking Data race checking
Example-Buffer Overflow Checking Buffer overflow in assembly level: write to a memory location beyond the boundaries of current stack frame. Identify instrumentation point: find write operations which have a variable d as its destination address. Assertion instrumentation: Add assertion d > %ebp && d < %esp before the write instruction. Model checking assertions.