论文标题
不安全的背叛：通过机器学习滥用二进制反向工程的不安全生锈
Unsafe's Betrayal: Abusing Unsafe Rust in Binary Reverse Engineering via Machine Learning
论文作者
论文摘要
内存安全错误引入了关键的软件安全问题。 RUST提供了内存安全的机制，以避免编程中的内存安全错误，同时仍然允许通过不安全的代码允许不安全的逃生舱口。但是，增强生锈可用性的不安全代码为在Rust源代码中查找内存安全错误提供了清晰的位置。在本文中，我们声称这些不安全的斑点仍然可以通过机器学习在Rust Binary代码中识别，并可以利用寻找内存安全错误。为了支持我们的主张，我们提出了工具TextTrustSpot，该工具使逆向工程能够学习不安全的分类器，该分类器提出了Rust Binaries中的功能列表以进行下游分析。我们从经验上表明，textTtrustSpot的功能提案可以召回$ 92.92 \％的内存安全错误，而它仅覆盖整个二进制代码的$ 16.79 \％$。作为一个应用程序，我们证明了该功能提案用于针对生锈软件包的靶向模糊，这有助于减少与非目标模糊的模糊时间。
Memory-safety bugs introduce critical software-security issues. Rust provides memory-safe mechanisms to avoid memory-safety bugs in programming, while still allowing unsafe escape hatches via unsafe code. However, the unsafe code that enhances the usability of Rust provides clear spots for finding memory-safety bugs in Rust source code. In this paper, we claim that these unsafe spots can still be identifiable in Rust binary code via machine learning and be leveraged for finding memory-safety bugs. To support our claim, we propose the tool textttrustspot, that enables reverse engineering to learn an unsafe classifier that proposes a list of functions in Rust binaries for downstream analysis. We empirically show that the function proposals by textttrustspot can recall $92.92\%$ of memory-safety bugs, while it covers only $16.79\%$ of the entire binary code. As an application, we demonstrate that the function proposals are used in targeted fuzzing on Rust packages, which contribute to reducing the fuzzing time compared to non-targeted fuzzing.
