Robust Sandboxing and Lifting of ELF Binaries

Software and hardware flaws can be exploited to make programs perform unintended computations or leak sensitive data. We propose to counter these threats by isolating libraries and other program units inside a single process. Software developers will control how the code and data of an application gets mapped to compartments and declare how applications are intended to interact with one another. We will use virtual memory management features of modern x86 processors to make switches between compartments faster than context switches between processes while providing comparable isolation and security properties. Since not all applications can be built from sources, we will also investigate lifting of legacy binaries. This will involve design of suitable intermediate representations which can represent high-level semantics recovered via binary analysis and verified via formal methods. Finally, we will use the proposed lifting capability to investigate compartmentalization of legacy binaries.