A Platform for Secure Static Binary Instrumentation
Mingwei Zhang Rui Qiao Niranjan Hasabnis R. Sekar
Stony Brook University
-
PSI combines SBI performance with DBI flexibility using GTT/MTT
and on-demand instrumentation for dynamic libraries.
Its dual-layered API and redirection mechanism prevent instrumentation bypass while significantly simplifying secure tool development.
Experimental results show PSI achieves 10x-200x lower overhead
than leading DBIs. -
Limitations
-
Vulnerability to Intermixed Code and Data
PSI can misinterpret embedded data as instructions, leading to
an incomplete CFG and the accidental blocking of legitimate control transfers. -
Fragility against Advanced Obfuscation and Anti-Analysis
Since PSI requires a complete CFG for instrumentation,
sophisticated obfuscation can break its static disassembly,
leading to legitimate program failures or denial of service -
Performance Disadvantage against Hardware-assisted Security
Software-based GTT/MTT checks are becoming redundant and less efficient compared to nowdays hardware-accelerated CFI features which offer near-zero overhead protection.
-
