Removing the Kitchen Sink from Software

ABSTRACT

We would all benefit if software were slimmer, thinner, and generally only did what we needed and nothing more. To this end, our research team has been exploring methods for removing unused and undesirable features from compiled programs. Our primary goal is to improve software security by removing rarely used features in order to decrease a pro- gram's attack surface. We describe two different approaches for "thinning" binary images of compiled programs. The first approach removes specific program features using dynamic tracing as a guide. This approach is safer than many alterna- tives, but is limited to removing code which is reachable in a trace when an undesirable feature is enabled. The second ap- proach uses a genetic algorithm (GA) to mutate a program until a suitable variant is found. Our GA-based approach can potentially remove any code that is not strictly required for proper execution, but may break program semantics in unpredictable ways. We show results of these approaches on a simple program and real-world software and explore some of the implications for software security.

References

1. G. Dabah. distorm - powerful disassembler library for x86/amd64. URL: https://code.google.com/p/distorm/, January 2015.
2. C. Le Goues, T. Nguyen, S. Forrest, and W. Weimer. Genprog: A generic method for automatic software repair. IEEE Trans. Softw. Eng., 38(1):54--72, Jan. 2012.
3. E. Schulte, J. DiLorenzo, W. Weimer, and S. Forrest. Automated repair of binary and assembly programs for cooperating embedded devices. In Proceedings of the Eighteenth International Conference on Architectural Support for Programming Languages and Operating Systems, ASPLOS '13, pages 317--328, New York, NY, USA, 2013. ACM.
4. E. Schulte, J. Dorn, S. Harding, S. Forrest, and W. Weimer. Post-compiler software optimization for reducing energy. SIGARCH Comput. Archit. News, 42(1):639--652, Feb. 2014.
5. E. Schulte, Z. P. Fry, E. Fast, W. Weimer, and S. Forrest. Software mutational robustness. Genetic Programming and Evolvable Machines, 15(3):281--312, Sept. 2014.
6. S. Sethumadhavan, S. J. Stolfo, A. Keromytis, J. Yang, and D. August. The sparchs project: Hardware support for software security. In Proceedings of the 2011 First SysSec Workshop, SYSSEC '11, pages 119--122, Washington, DC, USA, 2011. IEEE Computer Society.
7. M. Velez, D. Qiu, Y. Zhou, E. T. Barr, and Z. Su. A study of "wheat" and "chaff" in source code. CoRR, abs/1502.01410, 2015.
8. G. Wagner, A. Gal, and M. Franz.textquotedblleftSlimming\textquotedblright a Java virtual machine by way of cold code removal and optimistic partial program loading. Science of Computer Programming, 76(11):1037--1053, Nov. 2011.
9. A. Zeller and R. Hildebrandt. Simplifying and isolating failure-inducing input. IEEE Trans. Softw. Eng., 28(2):183--200, Feb. 2002.

Index Terms

• Information systems

  • Information systems applications

• Software and its engineering

  • Software creation and management

    • Software verification and validation

      • Software defect analysis

        • Software testing and debugging