A practical, comprehensive and accessible binary framework for security

Securing binaries is a critical challenge in an ever-evolving security landscape, particularly with vulnerable legacy and third-party software. Existing frameworks retrofit security through static rewriting or dynamic run-time modification. Static approaches struggle with precise control flow recovery, leading to unsound binaries or limited binary support. Dynamic approaches, while more comprehensive, incur high performance costs. Additionally, complexities of binary frameworks hinder swift development of security solutions. Effective solutions must balance sound and comprehensive code coverage with high performance to ensure practical viability, while enabling developer productivity. To address these, I first introduce Janitizer, a hybrid static-dynamic binary framework that overcomes the limitations of static and dynamic-only techniques. It optimises dynamic modification using static analysis to enforce security policies and generate sound binaries, while employing lightweight dynamic analysis for statically unavailable code for full coverage. Janitizer distinguishes between statically analysed and unanalysed code to avoid redundant run-time analysis and supports both position-dependent and positionindependent code. I demonstrate, through a memory sanitiser and a control-flow integrity scheme, that Janitizer achieves performance overheads comparable to static techniques while delivering full coverage previously only achievable with dynamic techniques. Second, I present Cinnamon, a domain-specific language for binary profiling and monitoring. Cinnamon simplifies development by providing high-level abstractions for control flow, data and types, enabling efficient development of such tools. Its programming model mirrors the typical flow of binary profiling and monitoring tools —control flow traversal, filtering and instrumentation specification. Cinnamon significantly reduces code length and complexity by abstracting framework-specific details, while supporting multiple binary frameworks, ensuring flexibility across static, dynamic and hybrid environments. Finally, I extend Cinnamon with features that optimise code generation, enable modifications and improve integration with Janitizer. A memory sanitiser implementation via Cinnamon highlights how these features enable real-world security techniques and better integration with Janitizer, achieving performance and coverage comparable to a native Janitizer version. This contribution concludes in an accessible, end-to-end binary framework ensuring comprehensive and sound code coverage with low performance overhead.

Name dc:type.qualificationname

Doctor of Philosophy (PhD)

Level dc:type.qualificationlevel

Doctoral

Grantor dc:publisher.institution

University of Cambridge

Year dc:date.issued

2025

Author dc:creator

• Arif, Mahwish

Advisor dc:contributor.advisor

• Jones, Timothy

• binary analysis
• binary transformation
• binary security

Licence

• https://www.repository.cam.ac.uk/bitstreams/5750bb7e-252b-4bff-8b46-dde4064f727b/download
• http://purl.org/NET/rdflicense/allrightsreserved

Language dc:language

eng

DOI dc:identifier.doi

https://doi.org/10.17863/CAM.122629

OAI identifier oai:identifier

oai:www.repository.cam.ac.uk:1810/391516