2026-09-18T20:59:46Z https://drops.dagstuhl.de/oai

oai:drops-oai.dagstuhl.de:25920 2026-09-05T19:32:07Z ddc:004 open_access

Discovering and Repairing Flaws in C Binaries Without Requiring Codebase and Instrumentation Ferreira, Diogo Medeiros, Ibéria Buffer Overflow Vulnerabilities Binary Patching Reverse Engineering Static Analysis Software Security Industrial and embedded software systems frequently integrate various third-party components sourced from diverse providers into their codebases. These systems are commonly developed in C, a language known for its lack of variable bounds checking, making it vulnerable to Buffer Overflows (BOs), which, when exploited, can cause severe damage. Consequently, the binary code resulting from vulnerable C programs is also vulnerable and remains so in the final products. Fixing these software systems is challenging because only binary code is available. This paper presents PatchBin, a binary patching tool to automatically fix BO vulnerabilities and validate the effectiveness of fixes while ensuring no new flaws are introduced. The approach involves a combination of fuzzing, reverse static analysis and static rewriting techniques to, respectively, (i) identify possible malicious inputs that can trigger BOs, (ii) find their root cause by employing reverse data flow analysis, and (iii) remove them by rewriting the binary code with effective validation, thus generating a new binary without the original flaws and new ones. Experimental evaluations with synthetic and real-world applications demonstrated that PatchBin detects and fixes BO in binary programs without introducing new vulnerabilities. The results showed that PatchBin is an important aid for industrial partners, enabling them to test and fix their products, including third-party components, without access to source code, but only to binary code. Schloss Dagstuhl – Leibniz-Zentrum für Informatik Diogo Ferreira and Ibéria Medeiros 2026 Is Part Of OASIcs, Volume 143, 30th Ada-Europe International Conference on Reliable Software Technologies (AEiC 2026) InProceedings Text doc-type:ResearchArticle publishedVersion application/pdf doi:10.4230/OASIcs.AEiC.2026.2 urn:nbn:de:0030-drops-259209 https://drops.dagstuhl.de/entities/document/10.4230/OASIcs.AEiC.2026.2 eng https://creativecommons.org/licenses/by/4.0/legalcode