A static binary rewriter that does not use heuristics | Hacker News Reader

A static binary rewriter that does not use heuristics

github.com

56 pointsadulau15 comments

I read the readme. I still don't know what is "rewriting" a binary or why one would want to do it. Can someone explain?

Have a look at the example icount.py: It rewrites binaries to count the number of instructions executed.

Therefore it seems the rewriter can modify already existing binaries corresponding to some rules in Python files by inserting additional instructions.

Take a binary and make changes to it (without breaking anything unintentionally). E.g. add hooks for performance measurements, add additional security checks, make it use/not use specific CPU instructions.

This is the paper referenced in the README: http://web.cse.ohio-state.edu/~lin.3021/file/NDSS18a.pdf

Could this tool be used to produce eg a statically-linked version of `curl` that would work the same on any Linux, without needing to build curl from sources?

It does not appear that "static binary rewriter" in this context means that it turns dynamically linked binaries into statically linked binaries, so probably not.

So, what does the word “static” mean in this context, that the binary’s behavior does not change?

I imagine it means that it takes the binary file, generates a new binary file, and is done, as opposed to rewriting things at runtime or needing profiling information from a prior run of the binary.

This is correct. Specifically, there's a category of tool called "dynamic binary translators" (including Pin, DynamoRIO, Valgrind, and QEMU) that translate binary code one block at a time, just before it's executed.

Same meaning as in a "static analyzer" for code quality: it works without executing the target program. (whereas a dynamic rewriter could run the application under debugger control, observe its behavior, extract additional meaning from that and make changes on-the-fly)

Just in case you haven't considered it, and it's applicable for your situation, one can use docker for that purpose:

    docker run --rm -v $PWD:/something some-image-with-curl curl -o /something/destination http://example.com/something

I think you should look at https://github.com/intoli/exodus

> Painless relocation of Linux binaries–and all of their dependencies–without containers.

> Exodus handles bundling all of the binary's dependencies, compiling a statically linked wrapper for the executable that invokes the relocated linker directly.

I was not aware about this project. Noted!

It came up here on HN just a week or two ago.

Is this for antivirus signature evasion? If so, wouldn't it need to work on itself?

Reply on news.ycombinator.com