Assembler is a critical component of the compiler toolchain, which has been less tested than the other components. Unfortunately, current grammar-based fuzzing techniques suffer from several challenges when testing assemblers. First, each different assembler accepts different grammar rules and syntaxes, and there are no existing assembly grammar specifications. Second, not every assembler is open-source, which makes it difficult to extract grammar rules from the source code. While existing black-box grammar inference approaches are applicable to such closed-source assemblers, they suffer from the scalability issue, which renders them impractical for testing assemblers. To address these challenges, we propose a novel way to test assemblers by automatically inferring their grammar rules with only a few queries to the target assemblers by leveraging their error messages. The key insight is that assembly error messages often deliver useful information to infer the underlying grammar rules. We have implemented our technique in a tool named AsFuzzer, and evaluated it on 4 real-world assemblers including Clang-integrated assembler (Clang), GNU assembler (GAS), Intel’s assembler (ICC), and Microsoft macro assembler (MASM). With AsFuzzer, we have successfully found 497 buggy instruction opcodes for six popular architectures, and reported them to the developers.

Current function identification techniques have been mostly focused on a specific set of binaries compiled for a specific CPU architecture. While recent deep-learning-based approaches theoretically can handle binaries from different architectures, they require significant computation resources for training and inference, making their use less practical. Furthermore, due to the lack of interpretability of such models, it is fundamentally difficult to gain insight from them. Hence, in this paper, we propose FunProbe, an efficient system for identifying functions from binaries using probabilistic inference. In particular, we identify 16 architecture-neutral hints for function identification, and devise an effective method to combine them in a probabilistic framework. We evaluate our tool on a large dataset consisting of 19,872 real-world binaries compiled for six major CPU architectures. The results are promising. FunProbe shows the best accuracy compared to five state-of-the-art tools we tested, while it takes only 6 seconds on average to analyze a single binary. Notably, FunProbe is 6× faster on average in identifying functions than XDA, a state-of-the-art deep-learning tool that leverages GPU in its inference phase.

As CPU vendors introduce various hardware-assisted security features, modern compilers have started to produce binaries containing security-related instructions. Interestingly, such instructions tend to alter the shape of resulting binaries, which can potentially affect the effectiveness of binary analysis. This paper presents the first systematic study on the implication of the Intel CET (Control-flow Enforcement Technology) instructions on function identification. Our study finds that CET-relevant instructions provide useful, although limited, hints for function entries. Therefore, we devise a novel function identification algorithm that utilizes the usage patterns of CET instructions, and demonstrate a tool named FunSeeker that implements the idea. Our evaluation shows that FunSeeker significantly outperforms current state-of-the-art function identification tools in terms of both correctness and speed.

One of the important challenges in the Internet of Things (IoT) is how to acquire the physical context of things. IP-based wireless sensor networks (IP-WSNs) could be a promising approach to collecting the physical context of things and to integrating WSNs to the Internet. However, realizing IP-WSNs in IoT exposes two major challenges. One is how to embed the Internet Protocol (IP) in resource-constrained sensor nodes. The other is how to achieve real-world deployment of WSNs and its integration with the Internet on the fly and on the cheap. In this paper, we present the SNAIL (Sensor Networks for All-IP World) project and introduce a new type of IP-WSN gateway, which supports dual wireless access points for WiFi and IP-WSN, enabling deployment of SNAIL nodes in an easy and rapid manner as for the solution. To show the proof-of-concept, we implement a new SNAIL platform from tiny sensor nodes to a gateway.

Tree-based routing protocols in low-rate wireless mesh networks usually have the detour problem in return for the no route discovery overhead. In this paper, we propose a novel algorithm, named Incremental Path Reduction (IPR), which incrementally shortens inefficient detoured path as more data packets are delivered. In IPR, data packets are delivered along the tree route in use by using 1-hop broadcast, enabling neighbor nodes to learn about the data packets' hop count. Using the hop counts, each node estimates their residual hop count to destination. As a result, each forwarder selects next hop node that has small residual hop count. In this way, IPR incrementally shortens the detoured route as more data packets are delivered. To verify our algorithm, we applied IPR to the representative tree routing protocols, and evaluated the path stretch and packet delivery ratio as well as control packet overhead. Simulation results show that IPR significantly enhances the overall routing metrics for any types of tree-based routing protocols.