BinPro: A Tool for Binary Backdoor Accountability in Code Audits

Highly security sensitive organizations often perform source code audits on software they use. However, after the audit is performed, they must still perform a binary code audit to ensure the binary provided to them matches the source code that was audited. BinPro seeks to reduce the manual effort required to perform the binary audit by accounting for the binary versions of functions in a given source code. To do this, BinPro combines static analysis, graph matching and machine learning. Over a corpus of 10 applications, BinPro is able to match 74% of binary functions with their source code counterparts, and thus determine that they are free of malicious backdoors if their source code version is. When evaluated on applications that backdoors inserted into their binaries, BinPro detects that they do not match any function in the source code.M.A.S