Instrumentation - initial results Sung Kim, Jeff Perkins MIT

Front-endFront-end Running Program Front-end: Observe/record status of some interesting data in software Daikon Invariant Detector Instrumented code Daikon Input file

Windows front-end Based on DynamoRIO, a tool developed by determina ® Debug information Records function enter and exit points Records parameter values at function enter/exit points Currently it only supports Primitive data types String (char *)

Windows front-end DynamoRIO CALL RET Windows binary Windows Program database Symbol Table Debug Interface Access SDK Symbol Mapping & Value Fetching Logic Daikon Input file Instrumentation Instrumented Windows binary Symbol Data file

Simple Program (buffer.c*) void decode (char *request_data, char *user_id, char *password, char *hostid) { […] return; } main () { […] decode (data, "jhp“, "stata“,"\200\036\124\056"); […] } * From “Exploiting Software: How to Break Code” by Greg Hoglund, Gary McGrawGreg HoglundGary McGraw

Simple Program (buffer.exe) buffer!decode: push ebp mov ebp,esp [...] mov esp,ebp pop ebp ret

Simple Program (buffer.exe) buffer!decode: push ebp mov ebp,esp [...] mov esp,ebp pop ebp ret Add instrument code

Simple Program (buffer.exe) buffer!decode: push ebp mov ebp,esp [...] mov esp,ebp pop ebp ret push %esp call print [...] push %eax call print [...]

Daikon Input File (dtrace)..decode (char *, char *, char *, char *):::ENTER request_data "id=jhp0&pw=stata0" 1 user_id "" 1 password "" 1 hostid "€T." 1

Challenges - CALL address mismatch main: push x push y […] call (foo) […] jmp ad 0x mov eax,x add eax,y ret 0x400a0ad (real foo)

Challenges - CALL address mismatch main: push x push y […] call (foo) […] jmp ad 0x mov eax,x add eax,y ret 0x400a0ad (real foo) Check instr address after a CALL to find function

Challenges – CALL/RET pair mismatch 00INDIRECT 0x7c816fce to 0x7c90e stack: 0x7c816fd4 0xfffffffe 01 INDIRECT 0x7c90e64c to 0x7c915a65 01 stack: 0x7c90e64e 0x7c816fd4 01 0x7c90e64e to 0x7c816fd4 [...] 27 0x7c9132f3 to 0x7c90e3e1 27 stack: 0x000007e4 0x0012fe7c 28 INDIRECT 0x7c90e3eb to 0x stack: 0x7c90e3ed 0x7c9132f8 28 0x7c90e3ed to 0x7c9132f8 28 return value: 0x x7c91330f to 0x7c81cd91 27 return value: 0x INDIRECT 0x7c81cd94 to 0x7c90e88e 27 stack: 0x7c81cd96 0xffffffff 28 INDIRECT 0x7c90e stack: 0x7c90e89a 0x7c81cd96

Challenges – CALL/RET pair mismatch 00INDIRECT 0x7c816fce to 0x7c90e stack: 0x7c816fd4 0xfffffffe 01 INDIRECT 0x7c90e64c to 0x7c915a65 01 stack: 0x7c90e64e 0x7c816fd4 01 0x7c90e64e to 0x7c816fd4 [...] 27 0x7c9132f3 to 0x7c90e3e1 27 stack: 0x000007e4 0x0012fe7c 28 INDIRECT 0x7c90e3eb to 0x stack: 0x7c90e3ed 0x7c9132f8 28 0x7c90e3ed to 0x7c9132f8 28 return value: 0x x7c91330f to 0x7c81cd91 27 return value: 0x INDIRECT 0x7c81cd94 to 0x7c90e88e 27 stack: 0x7c81cd96 0xffffffff 28 INDIRECT 0x7c90e stack: 0x7c90e89a 0x7c81cd96

Challenges – CALL/RET pair mismatch CALL/RET address Table CALLRET Store the next instr address Check the return address

Challenges – Validity of pointers main () { char *ptr; // no initialization foo(ptr); } foo (char * ptr) { *ptr = ‘c’; }

Challenges – Validity of pointers main () { char *ptr; // no initialization foo(ptr); } foo (char * ptr) { *ptr = ‘c’; }

Challenges – Validity of pointers Problems: 1.At the foo enter point ptr is not initialized 2.Not clear if ptr is string (series of chars) or a single char pointer main () { char *ptr; // no initialization foo(ptr); } foo (char * ptr) { *ptr = ‘c’; }

Challenges – Validity of pointers Problems: 1.At the foo enter point ptr is not initialized 2.Not clear if ptr is string (series of chars) or a single char pointer main () { char *ptr; // no initialization foo(ptr); } foo (char * ptr) { *ptr = ‘c’; } Partial solutions: 1. 1.Check if a given address is valid 2. 2.If the pointer (char *) is NULL terminated in the MAX_STR_LEN range

Future Work Need to Support –global variables –arrays and pointers char *, char **, int [] –complex and typedef data types struct typedef char * string –C++ method calls and classes

Instrumentation - initial results Sung Kim, Jeff Perkins MIT