Binary analysis research

Binary analysis, also called binary code analysis, is the examination of compiled software, such as executables, libraries and firmware, without access to its source code. An analyst or a tool reads the machine code that actually runs, either statically, without running the program, or dynamically, while it runs. Binary analysis serves two different jobs: finding the third-party components and known vulnerabilities inside software, and working out what a program's own code does.

The work starts from what the file itself records: its format, such as PE on Windows or ELF on Linux, the processor it targets, the libraries and functions it imports, its readable strings and identifiable machine code. A binary carries no comments, and a stripped binary has lost most of its function and variable names too, so the analyst rebuilds meaning from what the code does.

Software composition analysis is one job binary analysis can do, not another name for it. Software composition analysis (SCA) identifies the open-source and third-party components and dependencies in software, including compiled binaries, can list them in a software bill of materials (SBOM) and checks them for risks such as known vulnerabilities. Security vendors often use “binary analysis” to mean this kind of supply-chain scan.

Reverse engineering uses binary analysis for the other job: working out what the program's own code does. That can be how a file format or protocol is parsed, what a legacy component computes, or what a malware sample does once it runs, which is what Devirt's malware analysis service reports for protected and ordinary samples. No component database answers that question, because the logic belongs to that one program.

Devirt Research covers the reverse engineering side, and protected executables in particular.

Binary analysis usually moves from identifying the file's format, architecture and any protector, to reading the code statically, to running it under observation where that is safe, and then to recovering and checking the logic that matters. Static and dynamic analysis are complementary ways to analyze a program, and most real analyses combine them.

Binary analysis tools fall into three groups. Disassemblers and decompilers such as IDA Pro, Ghidra and Binary Ninja turn machine code into assembly and C-like pseudocode; the NSA released Ghidra as open source in 2019. Debuggers, emulators such as QEMU and instrumentation frameworks such as Intel Pin and DynamoRIO run a program under observation. Frameworks such as the angr platform script both kinds of analysis, including symbolic execution, which treats inputs as unknowns and explores which inputs can reach different paths.

Static binary analysis examines a program without running it; dynamic binary analysis observes the program while it runs. Static analysis can cover the whole file, including paths a test run never takes, but it has to infer values that only exist at run time. Dynamic analysis sees real values, such as memory contents and the targets of indirect jumps, but only on the paths a given run takes.

Running unknown code is a risk in itself, so analysts run untrusted files in a controlled, isolated environment, such as a virtual machine with no access to production systems.

A protected binary is a program that a software protector has packed, obfuscated or virtualized to resist analysis. Packing compresses or encrypts the code until the program starts, so static tools see packed data and the small stub that unpacks it. Obfuscation rewrites code into equivalent but harder sequences. Virtualization, used by protectors such as VMProtect and Themida, translates selected code into bytecode for a private virtual machine built into the file.

Virtualization goes further than packing: the bytecode never turns back into native code. A decompiler shows the virtual machine's interpreter instead of the function, and a memory dump taken after unpacking still holds bytecode. Recovering that logic is called devirtualization, and Devirt's VMProtect research shows what it involves for one protector. For files you are authorized to analyze, Devirt's protected binary analysis service recovers that logic and reports every function in scope in a coverage ledger.

MITRE ATT&CK lists software packing, including virtual machine software protection, as technique T1027.002: malware authors use the same protectors that developers use to guard license checks. A protected file is not malicious by default; the protection only shows that someone wanted its code to be hard to read.