Finding Semantically-Equivalent Binary Code By Synthesizing Adaptors

Independently developed codebases typically contain many segments of code that perform the same or closely related operations (semantic clones). Finding functionally equivalent segments enables applications like replacing a segment by a more efficient or more secure alternative. Such related segments often have different interfaces, so some glue code (an adaptor) is needed to replace one with the other. We present an algorithm that searches for replaceable code segments at the function level by attempting to synthesize an adaptor between them from some family of adaptors; it terminates if it finds no possible adaptor. We implement our technique using (1) concrete adaptor enumeration based on Intel's Pin framework and (2) binary symbolic execution, and explore the relation between size of adaptor search space and total search time. We present examples of applying adaptor synthesis for improving security and efficiency of binary functions, deobfuscating binary functions, and switching between binary implementations of RC4. For large-scale evaluation, we run adaptor synthesis on more than 13,000 function pairs from the Linux C library. Our results confirm that several instances of adaptably equivalent binary functions exist in real-world code, and suggest that these functions can be used to construct cleaner, less buggy, more efficient programs.