Cross-Architecture Bug Search in Binary Executables

### Overview This talk presents a method for cross-architecture bug search in binary executables without requiring source code or symbols. Motivated by developers copying and pasting code across projects—and consequently replicating vulnerabilities across platforms—the approach enables an analyst to take a known bug signature from one architecture (such as x86) and search for identical or similar vulnerabilities in binaries compiled for another architecture (such as ARM or MIPS).

### Key Topics - **Cross-Architecture Code Similarity:** Comparing binary code across disparate instruction set architectures (x86, ARM, and MIPS), compilers, and optimization levels. - **Sub-Function Granularity:** Searching for localized bug patterns rather than full-function matches, allowing bugs to be detected across different function implementations. - **Semantic and Structural Matching:** Abstracting architecture-specific idioms by analyzing basic block semantics through input/output sampling rather than relying on strict symbolic matching or ASTs.

### Technical Details - **VEX IR & Formula Simplification:** The system takes unstripped binary code and translates it into VEX Intermediate Representation (IR), which was heavily modified to abstract away architecture-specific idioms. For each basic block, the cumulative effect on registers and memory is compiled into expressions and simplified using the Z3 SMT solver. - **I/O Sampling & Locality-Sensitive Hashing (LSH):** Rather than evaluating formula equality, the system uses random input vectors (empirically sampled between -1000 and 1000) to execute each basic block, collecting input-output pairs that represent its pointwise semantics. To avoid expensive set comparisons (like Jaccard index calculations), these pairs are compressed into Locality-Sensitive Hashes (LSH), allowing basic block similarity to be determined via a single hash comparison. - **Search Algorithm (Best-Match Broadening):** A bug signature is defined as a piece of code containing the bug and minimal discriminatory context. The engine finds starting points by matching single basic blocks between the signature and target binary, then performs "best-match broadening"—a greedy, locally optimal expansion that incrementally adds neighboring matched blocks until the full signature is matched. - **Evaluation:** Evaluated on real-world cases, including the OpenSSL Heartbleed vulnerability (TLS and DTLS functions), BusyBox vulnerabilities, and the Sercomm backdoor in closed-source router firmware across x86, ARM, and MIPS binaries.

### Takeaways - The approach successfully ranks known vulnerable functions at or near the top of candidate matches, even across different CPU architectures and compiler optimization settings. - Because the tool measures localized code similarity, it produces similarity rankings rather than proof of exploitability; it cannot verify path constraints or preconditions. - To differentiate between vulnerable code and patched code (which often wraps vulnerable logic in conditional guards), analysts can compare code against both patched and unpatched signatures to see which version it resembles more closely.