How argXtract works

Jump to bottom

projectbtle edited this page Jun 7, 2021 · 2 revisions

argXtract performs 6 main functions:

Disassembles a stripped binary (technically, argXtract doesn't do this; it uses Capstone to obtain the disassembly).
Identifies the application code base. This enables absolute addressing to work properly.
Identifies inline data. This prevents incorrect traces due to data being identified as code.
Estimates function boundaries. We use the estimated functions for the tracing step and for function pattern matching.
Determines locations within the disassembly of API calls of interest and generates call chains.
Traces through code and processes arguments.

Further details can be found in our paper: argXtract: Deriving IoT Security Configurations via Automated Static Analysis of Stripped ARM Binaries (link to preprint).