Automatic Stub Generation for Dynamic Symbolic Execution of ARM binary
Anh T. V. Nguyen, Mizuhito Ogawa · 2022
Recently, dynamic symbolic execution (DSE) tools for binary codes (mostly for x86) have been developed, e.g., McVeto, CoDisasm, MAYHEM, KLEE-MC, BE-PUM, angr, BINSEC and CORANA. When a process stays in the uniform context, DSE simply obeys the formal semantics of an instruction set. Practical binary code like malware often uses system functions, which are beyond the user-level context, which requires stubs to simulate them. This paper proposed an automatic generation of Linux API Stub from the C function interface, which extends the DSE tool CORANA for ARM. The API stub is an under-approximation of a system function call by spawning its execution in the real Linux environment, and its Hoare logic deduction rule is defined and justified in terms of awareness. We implement CORANA/API and its experiments on real-world IoT malware, such as Mirai, is reported.