AwesomeREA.org

2023 · Conference paper

Lifting Network Protocol Implementation to Precise Format Specification with Security Applications

Qingkai Shi; Junyang Shao; Yapeng Ye; Mingwei Zheng; Xiangyu Zhang

NetLifter statically lifts source-available C protocol parsers into BNF-style message grammars and first-order constraints between packet fields. It analyzes annotated LLVM bitcode using abstract format graphs, localized path-sensitive analysis, unfolding and reordering. The resulting field boundaries, constraints and names can support packet generation and parser construction.

Scope and limitations

Requires source/LLVM IR and packet-buffer/length annotations; it is not closed-binary or traffic-only recovery. The paper targets common top-down C parsers and does not support C++, inline assembly or libraries without available code. Pointer/loop analysis remains approximate; checksum fields can be identified while some checksum constraints are omitted, and fields ignored by an implementation may be missed. Precision/recall was manually checked on ten selected protocols. The reported fuzzing evaluation used three-hour runs repeated twenty times and bypassed checksum checks. It infers formats, not protocol state machines or proof of implementation equivalence.

Why it fits this collection

Adds source-to-format inference with cross-field constraints, complementing traffic-based and binary-assisted protocol reconstruction research.

Publication and review details

Venue
ACM CCS 2023
Status
Conference paper
Publication / posting date
November 15, 2023
Date source
ACM’s Crossref deposit records published/print publication on 2023-11-15 and a separate online/publication-history date of 2023-11-21. This entry uses the published/print date, not the November 26–30 conference dates.
First arXiv submission
May 19, 2023
arXiv
2305.11781
Reviewed arXiv version
v1
DOI
10.1145/3576915.3616614

The final author PDF and Crossref establish the five-author order, CCS 2023 DOI and pages. The 19-page arXiv v1 retains an old CCS 2022 submission template and placeholder DOI; publication identity follows the final 15-page paper. The repository calls its prototype Popeye and warns of rough edges. Its reviewed 2025-04-21 snapshot declares AGPL-3.0-or-later in source headers. CMake requires 3.10+, LLVM 12.x and Z3>=4.8.12; README recommends LLVM 12.0.1 and the author’s modified Z3 4.8.12-popeye branch. Vectorized IR is unsupported: README documents -fno-vectorize and -fno-slp-vectorize, and recommends debug information and removal of optimization flags for field naming. This later artifact snapshot is not an independently reproduced 2023 environment; dependencies and target code retain separate terms. Source files were inspected without running upstream code, downloading benchmark inputs or reproducing experiments.

Sources reviewed

Source review only; experiments were not rerun for this collection. Cite the original authors using the linked paper or BibTeX.

Primary sources

  1. https://dl.acm.org/doi/10.1145/3576915.3616614
  2. https://api.crossref.org/works/10.1145/3576915.3616614
  3. https://qingkaishi.github.io/public_pdfs/CCS23.pdf
  4. https://arxiv.org/abs/2305.11781
  5. https://arxiv.org/pdf/2305.11781v1
  6. README.md GitHub · qingkaishi/netlifter · Revision 362fe1e
  7. LICENSE.txt GitHub · qingkaishi/netlifter · Revision 362fe1e
  8. CMakeLists.txt GitHub · qingkaishi/netlifter · Revision 362fe1e
  9. tools/popeye/popeye.cpp GitHub · qingkaishi/netlifter · Revision 362fe1e
  10. tools/popeye/LiftingPass.cpp GitHub · qingkaishi/netlifter · Revision 362fe1e
  11. benchmarks/popeye/readme.txt GitHub · qingkaishi/netlifter · Revision 362fe1e
  12. benchmarks/popeye/regression.sh GitHub · qingkaishi/netlifter · Revision 362fe1e
  13. README-CMake.md GitHub · qingkaishi/z3 · Revision b42b2d6
  14. LICENSE.txt GitHub · qingkaishi/z3 · Revision b42b2d6