Constructing precise and sound control flow graphs (CFGs) is critical for enforcing control flow integrity (CFI) defense against control-flow hijacking related exploits. One major challenge of constructing such CFGs is to infer the targets of indirect calls, which suffers extra difficulty on commercial off-the-shelf (COTS) binaries due to the absence of source-level information. One classic direction is to use points-to analysis, but it often suffers from scalability issues. Thus, signature-matching based approaches are employed to mitigate the scalability issues. However, existing binary-level signatures are coarse-grained and the paired matching policy must be conservative to pursue soundness, resulting in CFG precision decrease. In this paper, we present BinType, a new signature-matching approach that relies on type inference to improve the signature granularity. Methodology-wise, BinType identifies storage locations of high-confidence types, generates type equivalence relations between storage locations, and propagates types to callsite arguments and function parameters by following the type equivalence relations. Our evaluations show that BinType achieves >20% higher precision than the previous arity-based technique. Moreover, BinType shows comparable precision against the state-of-the-art points-to analysis based approach, while significantly improving the efficiency.

Binary-level pointer analysis is critical to binary-level applications such as reverse engineering and binary debloating. In this paper, we propose BinPointer, a new binary-level interprocedural pointer analysis that relies on an offset-sensitive value-tracking analysis to achieve high precision. We also propose a soundness and precision evaluation methodology based on runtime memory accesses triggered by reference input data. Our experimental results demonstrate that BinPointer has higher precision over prior work, while maintaining acceptable scalability. The soundness of BinPointer is also validated through runtime data.

Summary Functional programming languages play an important role in the development of correct software systems. As embedded devices become pervasive and perform critical tasks in our lives, their reliability becomes paramount. This presents a natural opportunity to explore the application of functional programming languages to systems that demand highly predictable behavior. In this paper, we explore existing functional programming language compilers and their applicability to real‐time embedded systems. We do this by defining important characteristics needed by a real‐time programming language and survey how well existing languages meet these characteristics. We conduct empirical analysis of language runtimes in order to assess the impact of dynamic memory management on predictability and performance. Lastly, we review different programming models for expressing real‐time considerations in applications.