This August, Aarno Labs had the privilege of presenting at Black Hat USA 2024 in Las Vegas. During the Arsenal session, our team showcased the CodeHawk Binary Patcher (CBP), an innovative platform designed to drastically reduce the cost and complexity of patching stripped binaries, while delivering unmatched assurance in the security and correctness of the patches.  Dr. Henny Sipma and Dr. Ben Karel led the presentation and demo, highlighting how CBP is reshaping the landscape of binary patching for legacy and end-of-life (EoL) systems.

Addressing the Challenges of Binary Patching

The talk began by framing organizations' challenges when dealing with legacy and EoL software. From automotive and military systems to IoT devices, these binaries often lack source code, debugging environments, or build systems, making traditional patching methods expensive, time-consuming, and error-prone. The CodeHawk Binary Patcher addresses these pain points by enabling analysts to create and validate high-assurance micropatches without requiring deep reverse engineering expertise nor the support of the original vendor. With CBP, even small teams can quickly remediate vulnerabilities, ensuring security without compromising functionality or requiring complete system re-certifications.

Innovations in Binary Patching

The CBP platform leverages advanced techniques, including:

• Human-Guided and Automated Patching: CBP lifts binaries into editable C-like code, enabling analysts to make targeted modifications or apply automated fixes based on vulnerability templates.
• Minimally-Invasive Modifications: By avoiding recompilation, CBP ensures that patches introduce the smallest possible changes to the binary, maintaining system integrity and reducing the risk of unintended consequences.
• Assurance Artifacts: The platform produces an extensive portfolio of artifacts, including proofs of correctness, invariant-based behavior changes, and validations that ensure the patched binary behaves as intended while effectively mitigating vulnerabilities.

A Revolutionary Workflow

The CodeHawk Binary Patcher integrates seamlessly with the Binary Ninja interface, providing a user-friendly environment for patching and validation. During the demo, Dr. Sipma and Dr. Karel showcased how CBP supports automated and manual workflows, allowing analysts to modify high-level C-like code and seamlessly apply those changes to the binary. The system's validation pipeline ensures that patches of memory vulnerabilities are provably correct, verifying the patch fixes the vulnerability and preserves both the original binary's functionality.

Presentation

This work on CBP is funded by DARPA (via AMP) and ARPA-H (via DIGIHEALS) through a subcontract with STR.

By democratizing access to high-assurance tools, Aarno Labs is empowering organizations to secure their legacy systems with confidence.

If you'd like to learn more,feel free to reach out at [email protected].