Control Flow Graph Recovery for Dynamically Loaded Code via Symbolic Library Resolution

Technical Summary: Control Flow Graph Recovery for Dynamically Loaded Code via Symbolic Library Resolution

Problem Statement
Modern software analysis faces a critical limitation when dealing with dynamically loaded code. While Control Flow Graphs (CFGs) are fundamental for both static and dynamic analysis, techniques such as dynamic code loading allow programs to evade static detection. Protected software and malware increasingly utilize runtime dynamic linking, indirect calls, and system-level evasion mechanisms (e.g., fileless execution, manual ELF parsing, and encrypted library names) to hide their true execution paths.

Existing tools fail to address this holistically:

• Static Disassemblers (e.g., IDA Pro, Ghidra) cannot analyze code that does not exist at the time of analysis.
• Dynamic Instrumentation (e.g., PIN, Frida) requires executing the binary, which poses safety risks for malware analysis and is limited to executed paths.
• Symbolic Execution Frameworks (e.g., Angr) typically treat dynamic loading APIs as symbolic values, losing concrete information about which libraries are loaded and where their symbols resolve.

The core challenge is that dynamic loading operates at two interacting levels—loading the code and resolving symbols to indirect transfers—which existing tools analyze in isolation, resulting in incomplete CFGs.

Methodology
The paper proposes a safe analysis module that recovers complete CFGs by combining symbolic execution with speculative library preloading. The system operates entirely within a symbolic execution environment (using the Angr framework) to avoid executing potentially malicious code.

The architecture employs a two-level approach within a single symbolic state:

1. Level 1: API-Level Interception (Symbolic Library Resolution)

   • The system installs 42 custom SimProcedures (Python abstractions) to intercept specific system calls and library functions.
   • Categories of Interception:
     • Dynamic Loading: Intercepts dlopen, dlsym, dlclose, and internal glibc functions to resolve library paths and symbol addresses.
     • Memory Operations: Detects executable memory mapping via mmap, mprotect, and fileless execution via memfd_create.
     • Process Execution & Security: Tracks process replacement (execve), threading (clone), and anti-debugging mechanisms (ptrace).
     • Network & File Operations: Intercepts socket operations to handle network-triggered loading and file operations to map file descriptors to paths.
   • Unified String Extraction: To handle symbolic arguments (e.g., encrypted or computed paths), the system uses an SMT solver (Z3 via Claripy) to concretize symbolic pointers against a set of known candidate strings or by scanning the binary for references.

2. Level 2: Instruction-Level Tracking

   • Operating on the VEX Intermediate Representation, this level monitors indirect control flow transfers.
   • It registers breakpoints for calls, jumps, and returns.
   • When an indirect transfer targets a symbolic address, the system constrains the target to fall within known executable regions (populated by Level 1). If satisfiable, the solver concretizes the address, linking the indirect call to a specific function.

3. Correlation Engine

   • This engine links events across both levels, mapping file descriptors to paths, library handles to loaded objects, and resolved symbol addresses to their call sites.
   • It performs taint tracking to trace data flow from external inputs (e.g., network sockets) to library loading arguments.
   • It includes algorithms to detect control flow flattening, Self-Modifying Code (SMC), and Return-Oriented Programming (ROP) chains.

Key Contributions

• Safe Analysis: The methodology enables the analysis of potentially malicious code without execution by performing all library loading and resolution symbolically.
• Two-Level Architecture: It uniquely correlates high-level API interception with low-level instruction tracking to reconstruct the full chain from library loading to indirect invocation.
• Handling Evasion: The system addresses advanced evasion techniques, including encrypted library names, environment-derived paths, multi-stage decryption, and manual ELF parsing.
• Validation: The approach validates symbolic findings against ground truth using independent Frida-based dynamic instrumentation.

Results
The module was evaluated on a suite of 16 synthetic benchmarks designed to simulate various obfuscation and evasion techniques (e.g., XOR encryption, stack strings, multi-stage loading, and fileless execution).

• Library Detection: The module achieved 100% precision and 100% recall in detecting dynamically loaded libraries across all benchmarks.
• CFG Improvement: Compared to static analysis baselines, the recovered CFGs contained:
  • 29.8% more nodes.
  • 26.5% more edges.
  • 41.6% more functions.
• Performance: Analysis times were measured in seconds (ranging from 0.21s to 0.97s per benchmark), with all discoveries independently verified by Frida.

Significance and Limitations
The paper claims to demonstrate the feasibility of recovering CFGs from binaries where code identity is determined only at runtime. By combining symbolic execution with comprehensive API interception, the system constructs CFGs that reflect the true program structure, including edges invisible to static analysis.

The authors maintain a modest stance regarding future implications:

• Limitations: The current implementation does not reverse obfuscation transformations (it flags them but does not undo them). Taint tracking currently ignores implicit information flows (e.g., through cryptographic operations). Platform support is limited to Linux ELF binaries on x86-64 and ARM64.
• Future Work: The authors suggest that future iterations could integrate automatic deobfuscation, extend platform support, and incorporate machine learning for identifying novel evasion techniques.

The work establishes a technical foundation for future research in binary analysis, malware detection, and software hardening, proving that symbolic execution can be effectively extended to handle dynamic loading scenarios safely.