BREW: Binary Rewriting Evolution Workbench

GrammaTech proposes to develop a Binary Rewriting Evolution Workbench (BREW). BREW will enable the programmatic evolution of diverse populations of software binary and firmware. These populations may be used to automatically diversify software for improved security, and to improve malware detection techniques and excise embedded malware. The threat posed by malware delivered through the software supply chain has become a point of urgent concern. The growing number of Internet of Things (IoT) devices increases the software volume needing to be secured, while often packaging this software in relatively opaque compiled binaries and firmware. BREW composes insights from diverse research communities to achieve the efficiency and automation required to meet the rapidly growing threat of binary supply chain security. From the genetic programming (GP) community BREW adopts long studied software representations optimized to enable efficient and open-ended evolutionary search. From the reverse engineering (RE) community BREW applies newly emerging binary analysis and rewriting techniques to lift binary software and firmware into these evolvable software representations and then compile modified variants of the original software back to efficient binary executables and firmware. BREW will build on a variety of GrammaTech tools and expertise to enable the ambitious goals of this research and development effort. GrammaTech is an industry leader in both the automated evolutionary improvement of software and in binary reverse engineering and rewriting. Specifically, BREW will build on GrammaTech’s existing award winning reassembleable disassembly, binary type analysis, and custom intermediate representations supporting binary rewriting. These will be extended with novel register machine to stack machine transformations to generate evolvable representations of binary supply chain software and firmware. BREW will leverage GrammaTech’s existing tooling for automated software evolution to generate the tests and invariants required to guide the evolution of this software and then to evolve these new representations to diversify software populations and to identify and remove embedded malware. The BREW system will be largely automated, but will leverage GrammaTech’s existing VSCode user interface for binary analysis and rewriting to enable a user to observe and guide the evolutionary process.