Asia’s Surging Interest in Binary Analysis

Binary code analysis (binary analysis, for short) is a vital security approach for protecting commercial off-the-shelf (COTS) software and understanding malware, where there is no source code available. From the perspective of computer security, it is imperative to analyze binary code, as source-level scrutiny does not always reveal lurking software bugs due to compiler or interpreter misbehavior.

Since the late 1990s, there has been significant research interest worldwide on binary analysis. The BitBlaze project (by Carnegie Mellon University and University of California, Berkeley)¹⁴ is one of the few pioneering research prototypes that incorporates a variety of tools for binary analysis, such as VINE for static analysis, TEMU for dynamic analysis, and Rudder for symbolic execution. Following up on BitBlaze, BAP (by Carnegie Mellon University)³ provides a wealth of APIs that can be used to build a custom binary analyzer, while DECAF (by Syracuse University)⁷ provides efficient, platform-neutral support for dynamic binary analysis. Angr (by University of California, Santa Barbara)¹³ offers a user-friendly platform for common binary analysis tasks, such as disassembly, instrumentation, and symbolic execution that are utilized by an active user community.

In recent years, the expanding cyber infrastructure supporting governments and industry sectors in Asia has ignited strong interests in software security, leading to a surge of research activities in binary analysis in the region. Thanks to the broad international support, researchers have begun to drive new ideas and delve into various research topics in binary analysis, such as automatic exploit generation, vulnerability discovery, and automated reverse-engineering. This article outlines the key research developments and trends in binary analysis led by researchers in the East Asia and Oceania region.

Back to Top

Growing Research Interest in Vulnerability Discovery and Exploit Generation

Fuzzing is a popular technique to discover software vulnerabilities by randomly or semi-randomly generating inputs to tested software programs. It has been an area of focus for researchers from China, Korea, and Singapore. AFLFast (from the National University of Singapore)² is one noteworthy project used by many security practitioners today to find security vulnerabilities in software. It served as the catalyst for grey-box fuzzing research: many research papers on grey-box fuzzing came out after its release.¹² CollAFL (by Tsinghua University, China)⁶ and Eclipser (by the Korea Advanced Institute of Science and Technology, or KAIST)⁴ are examples of regional efforts in improving fuzzing efficiency.

Another research focus is on new types of memory vulnerabilities and exploits. Data-oriented exploitation (by National University of Singapore)^8,9 is a new type of memory error exploit that works by manipulating non-control data of the program without hijacking the control flow of a target program, which brings the expressiveness of data-oriented exploits to a new level.

Automatic Exploit Generation (AEG, by Carnegie Mellon University)¹ is a pioneering work of automatically finding and exploiting the vulnerabilities of a program, which incorporates analysis techniques such as symbolic execution and fuzzing. AEG is important for software security, as one can apply the technique to discover vulnerabilities and quickly fix security-relevant vulnerabilities prior to the release of software products. AEG typically requires binary code, as it is not possible to figure out the exact memory layout by simply looking at the source code. The importance of AEG was realized by the Cyber Grand Challenge (CGC), the first hacking competition between machines hosted by DARPA in 2016. To expedite the AEG process, one needs to search for exploitable states in program paths diverging from crashing inputs found by fuzzing. Revery (by the Univerity of Chinese Academy of Sciences and Tsinghua University, China)¹⁵ tackles this challenge by adopting a control-flow stitching technique.

Since the CGC, several Asian countries have started to organize similar competitions. Korea ran the AI-based Automated Vulnerability Discovery Challenge in 2018, and Japan also hosted the Automatic Cyber Hacking Challenge at the Code Blue Conference in 2018. Both competitions were focused on attacks, that is, binary-level exploitation, rather than defenses, unlike CGC, where binary patching played a crucial role. However, the Korean Ministry of Science, ICT, and Future Planning (MSIT) have announced this year's competition would include both attacks and defenses.

Back to Top

Efforts in Building Scalable Binary Analysis Frameworks

Binary analysis faces a constant challenge due to the ever-increasing demands of researchers and cybersecurity responders. The dramatic increase of binary analysis tasks calls for frameworks that reduce human effort and boost productivity, which can be scaled to meet real-world demands. Based on the common abstractions used in binary analysis, such as intermediate representation (IR), instruction semantics, data flow, control flow, and others, research in the region aims to develop automatic methods to generate abstractions and optimize analysis processes, as well as enabling analysis by various tools to inter-operate.

---

The expanding cyberinfrastructure supporting governments and industry sectors in Asia has ignited strong interests in software security, leading to a surge of research activities in binary analysis in the region.

---

Many of the efforts carried out in the Asia region aim to produce solid building blocks for scalable binary analysis frameworks. For example, writing the specification of instructions from scratch is largely an error-prone task; instruction-set manuals typically comprise thousands of pages of descriptions written in natural language. To write a binary analysis front-end, which translates binary code into an IR, one should carefully read the manuals and implement the logic. This process requires tremendous engineering effort and thus, many researchers consider it too costly to investigate. TaintInduce (by the National University of Singapore and the Chinese Academy of Sciences)⁵ is a project to automatically generate taint rules (or data-flow properties) without manual specifications; it infers taint rules based on observations of instruction executions. In addition, TaintInduce proposes a common definition and API for taint rules, enabling follow-up work to be built on a common knowledge base.

In 2019, researchers from KAIST made public their binary analysis framework, called B2R2.¹⁰ This was the first attempt to build a binary analysis framework in this region. It focused on optimizing the performance and accuracy of a binary analysis front end, which was often neglected by binary analysis researchers, as the front end had been regarded as a simple translation module. However, they presented various optimization techniques, including parallel lifting and big-integer splitting, that achieve an order-of-magnitude improvement in the performance of the front end. The same research team published a novel technique for finding semantic bugs that appeared in IRs for binary analysis, which can benefit any binary analysis framework available today.¹¹

Back to Top

Concluding Remarks

Binary analysis has been gaining popularity in Asia. Built on the momentum of vulnerability discovery and exploit generation, as well as the foundational work to build scalable platforms for binary analysis, we hope to see more active regional research collaboration in the field. With extended collaborative effort, we believe researchers in this region will trigger major technological breakthroughs in the future.