Abstract:

During the development of computer software, the emergence of vulnerabilities can not be avoided. Thus, rapid identification of vulnerabilities is the key to protect the computer system. Most of the existing methods are based on source code, and the methods based on binary are only done on single instruction architecture. Because of the above problems, this paper proposes an efficient way to search vulnerabilities on binary level, which standardizes the assembly code of different instruction architecture, extracts features of vulnerabilities and binary executables, and finds the vulnerabilities of binary executables by using features matching algorithm. Experiments show that the method can accurately find the known vulnerabilities in the samples, such as the Heartbleed vulnerability in the OpenSSL library, the Rootkit vulnerabilities in the BusyBox and the back doors that exist in the router firmware.

Key words: binary matching, vulnerabilities searching, feature matching