1. Instrumentation - initial results Sung Kim, Jeff Perkins MIT

2. Front-endFront-end Running Program Front-end: Observe/record status of some interesting data in software Daikon Invariant Detector Instrumented code Daikon Input file

3. Windows front-end Based on DynamoRIO, a tool developed by determina ® Debug information Records function enter and exit points Records parameter values at function enter/exit points Currently it only supports Primitive data types String (char *)

4. Windows front-end DynamoRIO CALL RET Windows binary Windows Program database Symbol Table Debug Interface Access SDK Symbol Mapping & Value Fetching Logic Daikon Input file Instrumentation Instrumented Windows binary Symbol Data file

5. Simple Program (buffer.c*) void decode (char *request_data, char *user_id, char *password, char *hostid) { […] return; } main () { […] decode (data, "jhp“, "stata“,"\200\036\124\056"); […] } * From “Exploiting Software: How to Break Code” by Greg Hoglund, Gary McGrawGreg HoglundGary McGraw

6. Simple Program (buffer.exe) buffer!decode: push ebp mov ebp,esp [...] mov esp,ebp pop ebp ret

7. Simple Program (buffer.exe) buffer!decode: push ebp mov ebp,esp [...] mov esp,ebp pop ebp ret Add instrument code

8. Simple Program (buffer.exe) buffer!decode: push ebp mov ebp,esp [...] mov esp,ebp pop ebp ret push %esp call print [...] push %eax call print [...]

9. Daikon Input File (dtrace)..decode (char *, char *, char *, char *):::ENTER request_data "id=jhp0&pw=stata0" 1 user_id "" 1 password "" 1 hostid "€T." 1

10. Challenges - CALL address mismatch main: push x push y […] call (foo) 00401005 […] jmp 004010ad 0x401005 mov eax,x add eax,y ret 0x400a0ad (real foo)

11. Challenges - CALL address mismatch main: push x push y […] call (foo) 00401005 […] jmp 004010ad 0x401005 mov eax,x add eax,y ret 0x400a0ad (real foo) Check instr address after a CALL to find function

12. Challenges – CALL/RET pair mismatch 00INDIRECT CALL @ 0x7c816fce to 0x7c90e642 00 stack: 0x7c816fd4 0xfffffffe 01 INDIRECT CALL @ 0x7c90e64c to 0x7c915a65 01 stack: 0x7c90e64e 0x7c816fd4 01 RETURN @ 0x7c90e64e to 0x7c816fd4 [...] 27 CALL @ 0x7c9132f3 to 0x7c90e3e1 27 stack: 0x000007e4 0x0012fe7c 28 INDIRECT CALL @ 0x7c90e3eb to 0x00300014 28 stack: 0x7c90e3ed 0x7c9132f8 28 RETURN @ 0x7c90e3ed to 0x7c9132f8 28 return value: 0x00000000 27 RETURN @ 0x7c91330f to 0x7c81cd91 27 return value: 0x00000000 27 INDIRECT CALL @ 0x7c81cd94 to 0x7c90e88e 27 stack: 0x7c81cd96 0xffffffff 28 INDIRECT CALL @ 0x7c90e898 28 stack: 0x7c90e89a 0x7c81cd96

13. Challenges – CALL/RET pair mismatch 00INDIRECT CALL @ 0x7c816fce to 0x7c90e642 00 stack: 0x7c816fd4 0xfffffffe 01 INDIRECT CALL @ 0x7c90e64c to 0x7c915a65 01 stack: 0x7c90e64e 0x7c816fd4 01 RETURN @ 0x7c90e64e to 0x7c816fd4 [...] 27 CALL @ 0x7c9132f3 to 0x7c90e3e1 27 stack: 0x000007e4 0x0012fe7c 28 INDIRECT CALL @ 0x7c90e3eb to 0x00300014 28 stack: 0x7c90e3ed 0x7c9132f8 28 RETURN @ 0x7c90e3ed to 0x7c9132f8 28 return value: 0x00000000 27 RETURN @ 0x7c91330f to 0x7c81cd91 27 return value: 0x00000000 27 INDIRECT CALL @ 0x7c81cd94 to 0x7c90e88e 27 stack: 0x7c81cd96 0xffffffff 28 INDIRECT CALL @ 0x7c90e898 28 stack: 0x7c90e89a 0x7c81cd96

14. Challenges – CALL/RET pair mismatch CALL/RET address Table CALLRET Store the next instr address Check the return address

15. Challenges – Validity of pointers main () { char *ptr; // no initialization foo(ptr); } foo (char * ptr) { *ptr = ‘c’; }

16. Challenges – Validity of pointers main () { char *ptr; // no initialization foo(ptr); } foo (char * ptr) { *ptr = ‘c’; }

17. Challenges – Validity of pointers Problems: 1.At the foo enter point ptr is not initialized 2.Not clear if ptr is string (series of chars) or a single char pointer main () { char *ptr; // no initialization foo(ptr); } foo (char * ptr) { *ptr = ‘c’; }

18. Challenges – Validity of pointers Problems: 1.At the foo enter point ptr is not initialized 2.Not clear if ptr is string (series of chars) or a single char pointer main () { char *ptr; // no initialization foo(ptr); } foo (char * ptr) { *ptr = ‘c’; } Partial solutions: 1. 1.Check if a given address is valid 2. 2.If the pointer (char *) is NULL terminated in the MAX_STR_LEN range

19. Future Work Need to Support –global variables –arrays and pointers char *, char **, int [] –complex and typedef data types struct typedef char * string –C++ method calls and classes

20. Instrumentation - initial results Sung Kim, Jeff Perkins MIT