Reasons for failure?

[AndrewJohnson150]

Hello,

I have been using cwe_checker as part of my research, but I am running into issues with it. I have been applying it to a variety of different binaries with mixed results - on most binaries it runs successfully and gives findings. However, there appear to be some binaries that the tool fails to run on. I have not been able to identify any common factors in these binaries or causes for the tool to fail to run. I am happy to provide output, binaries, source code, or anything else that might be helpful in determining why the tool fails to run.

Primarily, I wanted to ask if there are any known reasons for failure in the tool as of right now?

Thank you.

[Enkelmann]

When you say "fails to run on" I assume you mean that the cwe_checker aborts with an error message. There are some known reasons for such failures:

• Right now only Linux ELF binaries are fully supported. The experimental support for other types of binaries (Windows PE files, bare-metal binaries) is very experimental and not tested that well, so I would assume more cases of crashes for these types of binaries.
• Linux kernel objects (.ko files) are not supported at the moment. Although I would love to adapt the analysis to be able to handle parts of the Linux kernel, we do not have enough people working on the cwe_checker right now to tackle that endeavor. So at least for the near future we won't be able to support them.
• Broken/corrupted ELF files. If you use tools like binwalk you will encounter them frequently, because these tools sometimes unpack only parts of an ELF file instead of the complete ELF file. Unfortunately, the cwe_checker does not yet generate a clear error message for these cases, so you may have to check with other tools (e.g. Ghidra) whether the ELF file itself is damaged. There are no plans to support analysis of broken binary files in the future, since the cwe_checker is not meant to be used for stuff like malware analysis anyway.

All other crashes are usually bugs in the cwe_checker and I am grateful for every issue that is opened for them! Preferably with the cwe_checker output and an example binary that triggers the crash.

I am also happy to hear of other people using the cwe_checker as part of their research! :-) The cwe_checker is itself still a research project in somewhat early development, so I am always happy to help other people with dealing with its shortcomings.

[AndrewJohnson150]

Thanks for the in depth reply! I think cwe_checker has a lot of potential and it has been a great resource for automated static binary analysis.

I've been trying to do some analysis on some TI MSP430 ELF binaries that have been failing, but that makes sense if the support of other architectures is still experimental. I've primarily been using binaries from Kali Linux 2021.2 (because Kali has a large set of binaries in the /bin directory).

I will gather some of those binaries that have been failing for an unknown reason, get output for them, and open an issue with the details.