Skip to content
Sujan Ghimire
Research
Ongoing research

Binary Rewriting and ARM Pointer Authentication

Retrofitting control-flow protection into compiled AArch64 software using binary rewriting and ARM Pointer Authentication.

  • Research

Problem

Much of the software running on ARM devices is distributed only in compiled form and was built without modern control-flow protections. Recompiling it is often impossible, yet the AArch64 architecture now offers hardware Pointer Authentication that such binaries never use.

Technical approach

  1. 01Recover the program structure required for safe transformation from compiled AArch64 binaries.
  2. 02Rewrite the binary to sign and authenticate code pointers using ARM Pointer Authentication instructions.
  3. 03Enforce control-flow integrity policies on returns and indirect branches in the rewritten program.
  4. 04Validate that hardened binaries remain functionally correct and measure overhead.

  1. 01

    Compiled binary

    AArch64 executable

  2. 02

    Analysis

    Disassembly & control-flow recovery

  3. 03

    Instrumentation

    PAC signing / CFI checks

  4. 04

    Hardened binary

    Reassembled & validated

Figure. Conceptual overview of the Binary Rewriting and ARM Pointer Authentication workflow. Illustrative only; not a description of results.

Associated publications

This research is ongoing; no publications are associated with it yet.