2020 · Conference paper
BinRec: Dynamic Binary Lifting and Recompilation
BinRec lifts an executable to LLVM IR from dynamic traces instead of static disassembly, then lowers the IR back to a recovered binary, so compiler passes can optimize, harden or otherwise transform it. Tracing runs the binary under S²E, which translates the executed code through QEMU into LLVM IR; BinRec removes the emulation instrumentation, merges traces from several inputs into one program, and adds optimizations such as register de-aliasing and promotion of emulated state to locals. When the recovered binary reaches a path that was not traced, a configurable handler stops it, falls back to the original code, or lifts the new path incrementally. The authors report recovering all SPEC CINT2006 benchmarks, including C++ programs, and apply it to reoptimization, control-flow integrity, AddressSanitizer and SafeStack hardening, and partial deobfuscation of virtualization-obfuscated code.
Scope and limitations
The prototype handles only single-threaded 32-bit x86 Linux ELF binaries and does not support self-modifying code. A recovered binary supports only control-flow paths observed during lifting, so behavior on untraced inputs depends on the chosen miss handler and on input coverage. Lifting through S²E is slow, and floating-point instructions are emulated in lifted code; across the SPEC benchmarks, recovered binaries ran at a geometric-mean 0.98x the time of unoptimized inputs and 1.29x that of optimized inputs. BinRec does not map stack slots to variables. The deobfuscation case uses two small programs obfuscated with the authors' own virtualizer, not commercial obfuscators. The McSema and rev.ng comparisons reflect 2020 versions.
Why it fits this collection
Adds dynamic lifting of executables to compiler IR and recompilation back to working binaries, complementing the collection's decompilation research, which recovers source-level code rather than a rebuildable IR.
Publication and review details
- Venue
- EuroSys 2020
- Status
- Conference paper
- Publication / posting date
- April 15, 2020
- Date source
- ACM-deposited Crossref print-publication date; the online-publication date is recorded separately in metadata notes. The April 27–30 conference dates are not used.
- DOI
- 10.1145/3342195.3387550
ACM metadata records print publication on 2020-04-15 and online publication on 2020-04-17, pages 1–16; Crossref lists the title as “BinRec” with the subtitle “dynamic binary lifting and recompilation”, and the twelve-author order shown here, the first three marked as equal-contribution joint first authors. The VUSec-hosted PDF is the 16-page ACM-formatted version created on 2020-03-30. The paper gives github.com/securesystemslab/BinRec, whose README (2022-11-29) now says the source is available at trailofbits/binrec-tob. The reviewed Trail of Bits commit (2022-11-22; the repository was last pushed 2023-09-18) carries an MIT license with an ONR DFARS acknowledgment and documents Ubuntu 20.04.03 or Debian 11.3, LLVM 14, Python 3.9 and s2e-env at 4bd6a45, with x86 Linux as the only supported environment. This later release is not shown to reproduce the paper’s SPEC results. Nothing was built or run.
Sources reviewed
Source review only; experiments were not rerun for this collection. Cite the original authors using the linked paper or BibTeX.
Primary sources
- https://dl.acm.org/doi/10.1145/3342195.3387550
- https://api.crossref.org/works/10.1145/3342195.3387550
- https://download.vusec.net/papers/binrec_eurosys20.pdf
- README.md GitHub · securesystemslab/BinRec · Revision 96b9315
- README.md GitHub · trailofbits/binrec-tob · Revision e1ceeaa
- LICENSE GitHub · trailofbits/binrec-tob · Revision e1ceeaa