Search

Software debloating tools seek to improve program security and performance by removing unnecessary code, called bloat. While many techniques have been proposed, several barriers to their adoption have emerged. Namely, debloating tools are highly specialized, making it difficult for adopters to find the right type of tool for their needs. This is further hindered by a lack of established metrics and comparative evaluations between tools. To close this information gap, we surveyed 10 years of debloating literature and several tools currently under commercial development to taxonomize knowledge about the debloating ecosystem. We then conducted a broad comparative evaluation of 10 debloating tools to determine their relative strengths and weaknesses. Our evaluation, conducted on a diverse set of 20 benchmark programs, measures tools across 12 performance, security, and correctness metrics. Our evaluation surfaces several concerning findings that contradict the prevailing narrative in the debloating literature. First, debloating tools lack the maturity required to be used on real-world software, evidenced by a slim 22% overall success rate for creating passable debloated versions of medium- and high-complexity benchmarks. Second, debloating tools struggle to produce sound and robust programs. Using our novel differential fuzzing tool, DIFFER, we discovered that only 13% of our debloating attempts produced a sound and robust debloated program. Finally, our results indicate that debloating tools typically do not improve the performance or security posture of debloated programs by a significant degree according to our evaluation metrics. We believe that our contributions in this paper will help potential adopters better understand the landscape of tools and will motivate future research and development of more capable debloating tools., Comment: 17 pages, 8 tables

The superconductor Nb$_3$Sn has a high critical temperature and high critical field, widely used for high-field superconducting magnets. In this work we investigate its microscopic electronic structure with $^{93}$Nb nuclear magnetic resonance (NMR). The high-quality Nb$_3$Sn powder sample was studied in both 3.2T and 7T magnetic fields in the temperature range from 1.5K to 300K. From measurement of the spectrum and its theoretical analysis, we find evidence for anisotropy despite its cubic crystal structure. This anisotropy is manifest in alignment of powder grains under certain temperature and field cycling conditions. The Knight shift and spin-lattice relaxation rate, $T_1^{-1}$, were measured in the normal state. Additionally, $T_1^{-1}$ was measured in the superconducting state and compared with BCS theory revealing a weak field dependence, with an energy gap $\Delta(0)=2.0\pm0.08k_B T_c$ at 3.2T and $\Delta(0)=1.73\pm0.08k_B T_c$ at 7T, indicating suppression of the order parameter by magnetic field.

Four-dimensional ultrasound imaging of complex biological systems such as the brain is technically challenging because of the spatiotemporal sampling requirements. We present computational ultrasound imaging (cUSi), a new imaging method that uses complex ultrasound fields that can be generated with simple hardware and a physical wave prediction model to alleviate the sampling constraints. cUSi allows for high-resolution four-dimensional imaging of brain haemodynamics in awake and anesthetized mice.

Advances in additive manufacturing have enabled the realisation of inexpensive, scalable, diffractive acoustic lenses that can be used to generate complex acoustic fields via phase and/or amplitude modulation. However, the design of these holograms relies on a thin-element approximation adapted from optics which can severely limit the fidelity of the realised acoustic field. Here, we introduce physics-based acoustic holograms with a complex internal structure. The structures are designed using a differentiable acoustic model with manufacturing constraints via optimisation of the acoustic property distribution within the hologram. The holograms can be fabricated simply and inexpensively using contemporary 3D printers. Experimental measurements demonstrate a significant improvement compared to conventional thin-element holograms.

Fast imaging methods are needed to promote widespread clinical adoption of Ultrasound Tomography (UST), and more widely available UST hardware could support the experimental validation of new measurement configurations. In this work, an open-source 256-element transducer ring array was developed (morganjroberts.github.io/open-UST) and manufactured using rapid prototyping, for only {\pounds}2k. Novel manufacturing techniques were used, resulting in a 1.17$^{\circ}$ mean beam axis skew angle, a 104 $\mu$m mean element position error, and a $\pm$13.6 $\mu$m deviation in matching layer thickness. The nominal acoustic performance was measured using hydrophone scans and watershot data, and the 61.2 dB SNR, 55.4$^{\circ}$ opening angle, 16.3 mm beamwidth and 54% transmit-receive bandwidth (-12 dB), were found to be similar to existing systems, and compatible with full waveform inversion reconstruction methods. The inter-element variation in acoustic performance was typically <10% without using normalisation, meaning that the elements can be modelled identically during image reconstruction, removing the need for individual source definitions based on hydrophone measurements. Finally, data from a phantom experiment was successfully reconstructed. These results demonstrate that the open-UST system is accessible for users, and suitable for UST imaging research., Comment: 16 pages, 12 figures

In recent years high-resolution 3D printing has enabled a diverse range of new, low-cost, methods for ultrasonic wave-front shaping. Acoustic holograms, particularly, allow for the generation of arbitrary, diffraction limited, acoustic fields at MHz frequencies from single element transducers. These are phase plates that function as direct acoustic analogues to thin optical holograms. In this work it is shown that, by using multiple polymer 3D printing, acoustic analogues to 'thick' or volume optical holograms can also be generated. First, an analytic approach for designing a volume hologram that diffracts a set of input fields onto a desired set of output fields is briefly summarised. Next, a greedy optimisation approach based on random downhill binary search able to account for the constraints imposed by the chosen fabrication method is introduced. Finally, an experimental test-case designed to diffract the field generated by a 2.54 cm, planar, PZT transducer onto 8 distinct patterns dependent on the direction of the incident field is used to validate the approach and the design method. Field scans of the 8 target fields demonstrate that acoustic analogues of optical volume holograms can be generated using multi-polymer printing and that these allow the multiplexing of distinct fields onto different incident field directions., Comment: 9 pages, journal article

Binary rewriting is a rapidly-maturing technique for modifying software for instrumentation, customization, optimization, and hardening without access to source code. Unfortunately, the practical applications of binary rewriting tools are often unclear to users because their limitations are glossed over in the literature. This, among other challenges, has prohibited the widespread adoption of these tools. To address this shortcoming, we collect ten popular binary rewriters and assess their generality across a broad range of input binary classes and the functional reliability of the resulting rewritten binaries. Additionally, we evaluate the performance of the rewriters themselves as well as the rewritten binaries they produce. The goal of this broad evaluation is to establish a shared context for future research and development of binary rewriting tools by providing a state of the practice for their capabilities. To support potential binary rewriter users, we also identify input binary features that are predictive of tool success and show that a simple decision tree model can accurately predict whether a particular tool can rewrite a target binary. The binary rewriters, our corpus of 3344 sample binaries, and the evaluation infrastructure itself are all freely available as open-source software., Comment: 16 pages, 14 tables, 5 figures

Despite extensive testing and correctness certification of their functional semantics, a number of compiler optimizations have been shown to violate security guarantees implemented in source code. While prior work has shed light on how such optimizations may introduce semantic security weaknesses into programs, there remains a significant knowledge gap concerning the impacts of compiler optimizations on non-semantic properties with security implications. In particular, little is currently known about how code generation and optimization decisions made by the compiler affect the availability and utility of reusable code segments called gadgets required for implementing code reuse attack methods such as return-oriented programming. In this paper, we bridge this gap through a study of the impacts of compiler optimization on code reuse gadget sets. We analyze and compare 1,187 variants of 20 different benchmark programs built with two production compilers (GCC and Clang) to determine how their optimization behaviors affect the code reuse gadget sets present in program variants with respect to both quantitative and qualitative metrics. Our study exposes an important and unexpected problem; compiler optimizations introduce new gadgets at a high rate and produce code containing gadget sets that are generally more useful to an attacker than those in unoptimized code. Using differential binary analysis, we identify several undesirable behaviors at the root of this phenomenon. In turn, we propose and evaluate several strategies to mitigate these behaviors. In particular, we show that post-production binary recompilation can effectively mitigate these behaviors with negligible performance impacts, resulting in optimized code with significantly smaller and less useful gadget sets., Comment: 30 pages, 7 figures, 9 tables

Software debloating is an emerging field of study aimed at improving the security and performance of software by removing excess library code and features that are not needed by the end user (called bloat). Software bloat is pervasive, and several debloating techniques have been proposed to address this problem. While these techniques are effective at reducing bloat, they are not practical for the average user, risk creating unsound programs and introducing vulnerabilities, and are not well suited for debloating complex software such as network protocol implementations. In this paper, we propose CARVE, a simple yet effective security-focused debloating technique that overcomes these limitations. CARVE employs static source code annotation to map software features source code, eliminating the need for advanced software analysis during debloating and reducing the overall level of technical sophistication required by the user. CARVE surpasses existing techniques by introducing debloating with replacement, a technique capable of preserving software interoperability and mitigating the risk of creating an unsound program or introducing a vulnerability. We evaluate CARVE in 12 debloating scenarios and demonstrate security and performance improvements that meet or exceed those of existing techniques., Comment: 8 pages, 4 figures, 2 tables, 1 appendix

Nearly all modern software suffers from bloat that negatively impacts its performance and security. To combat this problem, several automated techniques have been proposed to debloat software. A key metric used in many of these works to demonstrate improved security is code reuse gadget count reduction. The use of this metric is based on the prevailing idea that reducing the number of gadgets available in a software package reduces its attack surface and makes mounting a gadget-based code reuse exploit such as return-oriented programming (ROP) more difficult for an attacker. In this paper, we challenge this idea and show through a variety of realistic debloating scenarios the flaws inherent to the gadget count reduction metric. Specifically, we demonstrate that software debloating can achieve high gadget count reduction rates, yet fail to limit an attacker's ability to construct an exploit. Worse yet, in some scenarios high gadget count reduction rates conceal instances in which software debloating makes security worse by introducing new, useful gadgets. To address these issues, we propose a set of four new metrics for measuring security improvements realized through software debloating that are quality-oriented rather than quantity-oriented. We show that these metrics can identify when debloating negatively impacts security and be efficiently calculated using our static binary analysis tool, the Gadget Set Analyzer. Finally, we demonstrate the utility of these metrics in two realistic case studies: iterative debloating and debloater evaluation., Comment: 16 pages, 3 figures, 11 tables, 2 appendices