Cyber Risks · Trail of Bits Blog

Rewriting Functions in Compiled Binaries

Summary: A Trail of Bits summer intern built Fennec, a tool that replaces function calls in compiled binaries by lifting them to LLVM bitcode with McSema, running an LLVM pass to swap in a new C function, and recompiling a new binary. The demonstration target was a static initialization vector in AES-CBC mode, where a fixed IV causes identical plaintext blocks to produce identical ciphertexts; after Fennec ran, the new binary produced a unique ciphertext on each run of the same plaintext.

Bottom line: The tool is aimed at legacy software where source code is unavailable, so a cryptographic flaw like a static IV can be fixed without rebuilding from source. For a security leader, that means the binaries running in production without source access are not necessarily out of reach when a vulnerability is found.

Read the original at Trail of Bits Blog ↗