REPICA: Rewriting Position Independent Code of ARM
Dong-Soo Ha, Wenhui Jin, Heekuck Oh · IEEE Access · 2018
Binary rewriting techniques are widely used in program vulnerability fixing, obfuscation, security-oriented transforming, and otherpurposes, such as binary profiling and optimization. Over the past decade, most binary instrumentation techniques have been studied on$\times 86$architecture, specifically focusing onthe challenges of instrumenting non-PIC. In contrast, ARM architecture has received little attention, and statically instrumenting PIC has not been studied in depth. In ARM, owing to its fixed-length instructions, addresses are frequently computed via multiple stages, making it difficult to handle all relative addresses, especially the relative address ofbase-plus-offsetandbase-plus-index addressing. In this paper, we presentREPICA, a static binary instrumentation technique which can rewrite ARM binaries compiled in a position-independent fashion.REPICAcan instrument at anywhere without symbolic information. With the aim of identifying andprocessing relative-addresses accurately, we designed a value-set analysis specialized for PIC of which the domain is in symbolic format. We also identified a new challenge for situations all relative addresses cannot be corrected in an optimized way and solvedthis problem efficiently by the stepwise correction of each relative address. We implemented a prototype ofREPICAand experimented with approximately 1200 COTS binaries and SPECint2006 benchmarks. The experiment showed that all binaries rewritten byREPICAmaintain relative addresses correctly with negligible execution and space overhead. Finally, we exhibit the effectiveness ofREPICAby using it to implement a shadow stack.