2020 · Conference paper
RetroWrite: Statically Instrumenting COTS Binaries for Fuzzing and Sanitization
RetroWrite statically rewrites 64-bit position-independent Linux binaries by generating reassembleable assembly, so instrumentation can be inserted as if at compile time. Instead of heuristics, it symbolizes references from the binary's own metadata: control-flow operands, PC-relative addressing that position-independent code must use, and data relocations become assembler labels, which separates references from scalars. On this base the authors build AFL coverage instrumentation and a binary-only AddressSanitizer. They report fuzzing throughput matching compiler instrumentation and 4.5x faster than AFL's QEMU mode, with more bugs found on LAVA-M, and binary ASan that runs 3x faster than Valgrind memcheck on SPEC CPU2006 and detects 80% more bugs in their evaluation, whose coverage tests use Juliet memory-corruption cases.
Scope and limitations
The method depends on position-independent code; the paper's implementation targets Linux x86-64 and uses the symbol table for function starts and sizes, so stripped binaries need function boundaries from another tool. It cannot safely rewrite C++ binaries with exception handling, because the DWARF unwind information is not symbolized, and it does not address obfuscated or adversarial binaries. Binary ASan instruments the stack only at stack-frame granularity and adds no redzones around globals, so it misses some overflows that compiler ASan catches, and it remains slower than compiler ASan. Results are from 2019–2020 tool versions on the authors' benchmarks. The repository's later aarch64 rewriter, described in a separate thesis, uses a different algorithm, and the paper's x86-64 results do not apply to it.
Why it fits this collection
Adds static binary rewriting through reassembleable assembly, which reconstructs symbolized assembly so new code can be inserted without source, complementing the collection's decompilation and binary-recovery research.
Publication and review details
- Venue
- IEEE S&P 2020
- Status
- Conference paper
- Publication / posting date
- May 2020
- Date source
- IEEE’s Crossref deposit and the IEEE Xplore record give only May 2020 as the publication date. Xplore separately records insertion on 30 July 2020, and the May 18–21 symposium dates are not used to assert a day.
- DOI
- 10.1109/SP40000.2020.00009
Crossref gives the four-author order, pages 1497–1511 and May 2020; IEEE Xplore, read through a Wayback Machine capture because the live page served a bot challenge, gives the same pages and month and a 30 July 2020 insertion date. The 15-page HexHive PDF is byte-identical to the nebelwelt.net copy that the repository README links; it lacks IEEE page numbers and is used as the author-hosted copy. The paper names github.com/HexHive/retrowrite and says its results can be reproduced with the repository’s Docker image. At the reviewed 2025-04-26 commit, the repository has an MIT LICENSE file, though GitHub reports no recognized license, and the README lists Python 3.6 with pyelftools and capstone. Its feature table marks stripped binaries, non-PIE binaries and C++ as unsupported for the x64 rewriter and points to a separate thesis for the aarch64 version. The repository is already in the automated scan index and links to this entry through code_url. Nothing was installed or run.
Sources reviewed
Source review only; experiments were not rerun for this collection. Cite the original authors using the linked paper or BibTeX.
Primary sources
- https://ieeexplore.ieee.org/document/9152762
- https://api.crossref.org/works/10.1109/SP40000.2020.00009
- https://web.archive.org/web/20220803033228/https://ieeexplore.ieee.org/document/9152762
- https://hexhive.epfl.ch/publications/files/20Oakland.pdf
- https://nebelwelt.net/publications/files/20Oakland.pdf
- README.md GitHub · HexHive/retrowrite · Revision 3b1e366
- LICENSE GitHub · HexHive/retrowrite · Revision 3b1e366