[Paper Review] Fine-Grained Library Customization

Linhai Song, Xinyu Xing|arXiv (Cornell University)|Oct 25, 2018

Advanced Malware Detection Techniques10 references4 citations

TL;DR

This paper proposes a fine-grained library customization technique that identifies and removes resultless code in statically linked libraries by analyzing unused fields in data structures. Using dependence analysis and pattern matching on LLVM IR, the approach reduces library code size by 50.83% (367 out of 722 instructions), demonstrating significant potential for minimizing attack surface and improving performance through targeted code trimming.

ABSTRACT

Code bloat widely exists in production-run software. Left untackled, it not only degrades software performance but also increases its attack surface. In this work, we conduct a case study to understand this issue in statically linked libraries. To be specific, we analyze midilib, a software package enclosing statically linked libraries. We show that it is possible to leverage dependence analysis to trim the resultless code statements re- siding in a target library. With this observation, we believe it is possible to build a tool to automatically cut off code pertaining to resultless operations.

Motivation & Objective

• To investigate the prevalence of resultless code in statically linked libraries, particularly in unused fields of returned data structures.
• To address code bloat that increases attack surface, memory pressure, and network overhead.
• To develop a proof-of-concept technique for fine-grained removal of computation that does not affect the application's output.
• To demonstrate that field-level usage analysis can enable precise, safe code trimming beyond coarse-grained methods.

Proposed method

• Perform static analysis on a C library (midilib) to identify fields in the MIDI message struct (MIDI_MSG) that are not accessed by the application.
• Use data dependence analysis to trace and identify LLVM IR instructions tied to unused fields, marking them as resultless and removable.
• Implement two proof-of-concept tools: one based on pattern matching of unused field assignments and another using dependence analysis to locate dependent statements.
• Combine results from both tools to identify overlapping and complementary sets of removable instructions.
• Apply the combined approach to the midifile.c library, measuring reduction in LLVM instructions and source code lines.
• Validate the safety of removals by ensuring no impact on the application’s observable behavior.

Experimental results

Research questions

• RQ1 To what extent do unused fields in returned data structures contribute to code bloat in statically linked libraries?
• RQ2 Can dependence analysis effectively identify and remove code that computes values not used by the application?
• RQ3 How much code bloat can be eliminated through fine-grained, field-level analysis compared to coarse-grained techniques?
• RQ4 What is the impact of combining pattern matching and dependence analysis on the effectiveness of code trimming?

Key findings

• The study found that only 9 out of 44 primitive fields in the MIDI_MSG struct are used by the m2rtttl application, indicating significant unused computation.
• Using pattern matching, 33 resultless field assignment instructions were identified as safe for removal.
• Dependence analysis identified an additional 322 instructions tied to resultless assignments, bringing the total to 355 removable instructions.
• The combined approach removed 367 out of 722 LLVM instructions, representing a 50.83% reduction in code size.
• This corresponds to approximately 39.63% reduction in source code lines, demonstrating substantial potential for library debloating.
• The results confirm that fine-grained trimming based on field usage and dependence analysis can safely eliminate large portions of unused code.