Code Analysis Carpentry (or, how to avoid braining yourself when handed a SMT solving hammer)

Presented at Kiwicon 4: The four e:Sheep-persons of the Cyber Infopocalypse (2010), Nov. 27, 2010, 1:45 p.m. (30 minutes)

This talk will be one part "Oh look what we can do when we have a Python API for converting code into equations and solving them" and one part "Here's why the world falls apart when we try to attack every problem in this way". One popular method of automated reasoning in the past few years has been to build equational representations of code paths and then using an SMT solver resolve queries about their semantics. In this talk we will look at a number of problems that seem amenable to this type of analysis, including finding ROP gadgets, discovering variable ranges, searching for bugs resulting from arithmetic flaws, filtering valid paths, generating program inputs to trigger code and so on. At their core many of these problems appear similar when looked at down the barrel of an SMT solver. On closer examination certain quirks divide them into those which are perfectly suited to such an approach and those that have to be beaten into submission, often with only a certain subset of the problem being solvable. Our goal will be to discover what problem attributes place them in each class by walking through implemented solutions for many of the tasks. Along the way the capabilities and limitations of the modern crop of SMT solvers will become apparent. We will conclude by mentioning some other techniques from static analysis that can be used alongside a SMT solver to complement it's capabilities and alleviate some of the difficulties encountered.


Presenters:

  • Sean Heelan
    Sean is a security researcher with Immunity. His primary interests are in software verification/program analysis and it's applications to vulnerability detection, reverse engineering and exploit development. Before joining Immunity Sean was a student at Oxford University where his research focused on combining run-time dataflow analysis and decision procedures for exploit generation.

Links:

Similar Presentations: