SELF: a transparent security extension for ELF binaries

The ability to analyze and modify binaries is often very useful from a security viewpoint. Security operations one would like to perform on binaries include the ability to extract models of program behavior and insert inline reference monitors. Unfortunately, the existing manner in which binary code is packaged prevents even the simplest of analyses, such as distinguishing code from data, from succeeding 100 percent of the time. In this paper, we propose SELF, a security-enhanced ELF (Executable and Linking Format), which is simply ELF with an extra section added. The extra section contains information about (among other things) the address, size, and alignment requirements of each code and static data item in the program. This information is somewhat similar to traditional debugging information, but contains additional information specifically needed for binary analysis. It is also smaller, compatible with optimization, and less likely to facilitate reverse engineering, which we beli...

• Type: Conference
• Year: 2003
• Where: NSPW
• Authors: Daniel C. DuVarney, V. N. Venkatakrishnan, Sandeep Bhatkar
• Keywords: Binary Code, Data Items, Extra Section, NSPW 2003