arXiv subjects

Zhibo Liu

Publications and source records attributed to Zhibo Liu.

30 records · Page 2Linked to original sources

arXiv2023

Refining Decompiled C Code with Large Language Models

A C decompiler converts an executable into source code. The recovered C source code, once re-compiled, is expected to produce an executable with the same functionality as the original executable. With over twenty years of development, C decompilers have been widely used in production to support reverse engineering applications. Despite the prosperous development of C decompilers, it is widely acknowledged that decompiler outputs are mainly used for human consumption, and are not suitable for automatic recompilation. Often, a substantial amount of manual effort is required to fix the decompiler outputs before they can be recompiled and executed properly. This paper is motived by the recent success of large language models (LLMs) in comprehending dense corpus of natural language. To alleviate the tedious, costly and often error-prone manual effort in fixing decompiler outputs, we investigate the feasibility of using LLMs to augment decompiler outputs, thus delivering recompilable decompilation. Note that different from previous efforts that focus on augmenting decompiler outputs with higher readability (e.g., recovering type/variable names), we focus on augmenting decompiler outputs with recompilability, meaning to generate code that can be recompiled into an executable with the same functionality as the original executable. We conduct a pilot study to characterize the obstacles in recompiling the outputs of the de facto commercial C decompiler -- IDA-Pro. We then propose a two-step, hybrid approach to augmenting decompiler outputs with LLMs. We evaluate our approach on a set of popular C test cases, and show that our approach can deliver a high recompilation success rate to over 75% with moderate effort, whereas none of the IDA-Pro's original outputs can be recompiled. We conclude with a discussion on the limitations of our approach and promising future research directions.

cs.SE↗

arXiv2023

PHYFU: Fuzzing Modern Physics Simulation Engines

A physical simulation engine (PSE) is a software system that simulates physical environments and objects. Modern PSEs feature both forward and backward simulations, where the forward phase predicts the behavior of a simulated system, and the backward phase provides gradients (guidance) for learning-based control tasks, such as a robot arm learning to fetch items. This way, modern PSEs show promising support for learning-based control methods. To date, PSEs have been largely used in various high-profitable, commercial applications, such as games, movies, virtual reality (VR), and robotics. Despite the prosperous development and usage of PSEs by academia and industrial manufacturers such as Google and NVIDIA, PSEs may produce incorrect simulations, which may lead to negative results, from poor user experience in entertainment to accidents in robotics-involved manufacturing and surgical operations. This paper introduces PHYFU, a fuzzing framework designed specifically for PSEs to uncover errors in both forward and backward simulation phases. PHYFU mutates initial states and asserts if the PSE under test behaves consistently with respect to basic Physics Laws (PLs). We further use feedback-driven test input scheduling to guide and accelerate the search for errors. Our study of four PSEs covers mainstream industrial vendors (Google and NVIDIA) as well as academic products. We successfully uncover over 5K error-triggering inputs that generate incorrect simulation results spanning across the whole software stack of PSEs.

cs.SE↗

arXiv2023

CCTEST: Testing and Repairing Code Completion Systems

Code completion, a highly valuable topic in the software development domain, has been increasingly promoted for use by recent advances in large language models (LLMs). To date, visible LLM-based code completion frameworks such as GitHub Copilot and GPT are trained using deep learning over vast quantities of unstructured text and open source code. As the paramount component and the cornerstone in daily programming tasks, code completion has largely boosted professionals' efficiency in building real-world software systems. In contrast to this flourishing market, we find that code completion systems often output suspicious results, and to date, an automated testing and enhancement framework for code completion systems is not available. This research proposes CCTEST, a framework to test and repair code completion systems in blackbox settings. CCTEST features a set of novel mutation strategies, namely program structure-correlated (PSC) mutations, to generate mutated code completion inputs. Then, it detects inconsistent outputs, representing possibly erroneous cases, from all the completed code cases. Moreover, CCTEST repairs the code completion outputs by selecting the output that mostly reflects the "average" appearance of all output cases, as the final output of the code completion systems. We detected a total of 33,540 inputs (with a true positive rate of 86%) that can trigger erroneous cases from eight popular LLM-based code completion systems. With repairing, we show that the accuracy of code completion systems is notably increased by 40% and 67% with respect to BLEU score and Levenshtein edit similarity.

cs.SE↗

arXiv2022

Cache Refinement Type for Side-Channel Detection of Cryptographic Software

Cache side-channel attacks exhibit severe threats to software security and privacy, especially for cryptosystems. In this paper, we propose CaType, a novel refinement type-based tool for detecting cache side channels in crypto software. Compared to previous works, CaType provides the following advantages: (1) For the first time CaType analyzes cache side channels using refinement type over x86 assembly code. It reveals several significant and effective enhancements with refined types, including bit-level granularity tracking, distinguishing different effects of variables, precise type inferences, and high scalability. (2) CaType is the first static analyzer for crypto libraries in consideration of blinding-based defenses. (3) From the perspective of implementation, CaType uses cache layouts of potential vulnerable control-flow branches rather than cache states to suppress false positives. We evaluate CaType in identifying side channel vulnerabilities in real-world crypto software, including RSA, ElGamal, and (EC)DSA from OpenSSL and Libgcrypt. CaType captures all known defects, detects previously-unknown vulnerabilities, and reveals several false positives of previous tools. In terms of performance, CaType is 16X faster than CacheD and 131X faster than CacheS when analyzing the same libraries. These evaluation results confirm the capability of CaType in identifying side channel defects with great precision, efficiency, and scalability.

cs.CR↗

arXiv2022

Decompiling x86 Deep Neural Network Executables

Due to their widespread use on heterogeneous hardware devices, deep learning (DL) models are compiled into executables by DL compilers to fully leverage low-level hardware primitives. This approach allows DL computations to be undertaken at low cost across a variety of computing platforms, including CPUs, GPUs, and various hardware accelerators. We present BTD (Bin to DNN), a decompiler for deep neural network (DNN) executables. BTD takes DNN executables and outputs full model specifications, including types of DNN operators, network topology, dimensions, and parameters that are (nearly) identical to those of the input models. BTD delivers a practical framework to process DNN executables compiled by different DL compilers and with full optimizations enabled on x86 platforms. It employs learning-based techniques to infer DNN operators, dynamic analysis to reveal network architectures, and symbolic execution to facilitate inferring dimensions and parameters of DNN operators. Our evaluation reveals that BTD enables accurate recovery of full specifications of complex DNNs with millions of parameters (e.g., ResNet). The recovered DNN specifications can be re-compiled into a new DNN executable exhibiting identical behavior to the input executable. We show that BTD can boost two representative attacks, adversarial example generation and knowledge stealing, against DNN executables. We also demonstrate cross-architecture legacy code reuse using BTD, and envision BTD being used for other critical downstream tasks like DNN security hardening and patching.

cs.CR↗

arXiv2022

CacheQL: Quantifying and Localizing Cache Side-Channel Vulnerabilities in Production Software

Cache side-channel attacks extract secrets by examining how victim software accesses cache. To date, practical attacks on cryptosystems and media libraries are demonstrated under different scenarios, inferring secret keys and reconstructing private media data such as images. This work first presents eight criteria for designing a full-fledged detector for cache side-channel vulnerabilities. Then, we propose CacheQL, a novel detector that meets all of these criteria. CacheQL precisely quantifies information leaks of binary code, by characterizing the distinguishability of logged side channel traces. Moreover, CacheQL models leakage as a cooperative game, allowing information leakage to be precisely distributed to program points vulnerable to cache side channels. CacheQL is meticulously optimized to analyze whole side channel traces logged from production software (where each trace can have millions of records), and it alleviates randomness introduced by cryptographic blinding, ORAM, or real-world noises. Our evaluation quantifies side-channel leaks of production cryptographic and media software. We further localize vulnerabilities reported by previous detectors and also identify a few hundred new leakage sites in recent OpenSSL (ver. 3.0.0), MbedTLS (ver. 3.0.0), Libgcrypt (ver. 1.9.4). Many of our localized program points are within the pre-processing modules of cryptosystems, which are not analyzed by existing works due to scalability. We also localize vulnerabilities in Libjpeg (ver. 2.1.2) that leak privacy about input images.

cs.CR↗

arXiv2022

Elastic pion-proton and pion-pion scattering at high energies in holographic QCD

The total and differential cross sections of high energy pion-proton and pion-pion scattering are investigated in a holographic QCD model, focusing on the Regge regime in which the Pomeron exchange gives the dominant contribution to those cross sections. The Pomeron is described by the Reggeized spin-2 particle propagator, and the hadron-Pomeron couplings are given by gravitational form factors of the hadrons, which are obtained from the bottom-up AdS/QCD models. Since the parameters, which characterize the Pomeron trajectory, have been determined in a preceding study of the proton-proton scattering, the pion-proton cross sections can be expressed with a single adjustable parameter. Once this parameter is determined by the experimental data of the pion-proton total cross section, its differential cross section and the pion-pion cross sections can be calculated without any additional parameter. Although the currently available data are limited, it is found that our calculation is consistent with those. Our predictions are explicitly shown, and the present model can be tested at the future experimental facilities.

hep-ph↗

arXiv2022

Team formation and team performance: The balance between team freshness and repeat collaboration

Incorporating fresh members in teams is considered a pathway to team creativity. However, whether freshness improves team performance or not remains unclear, as well as the optimal involvement of fresh members for team performance. This study uses a group of authors on the byline of a publication as a proxy for a scientific team. We extend an indicator, i.e., team freshness, to measure the extent to which a scientific team incorporates new members, by calculating the fraction of new collaboration relations established within the team. Based on more than 43 million scientific publications covering more than a half-century of research from Microsoft Academic Graph, this study provides a holistic picture of the current development of team freshness by outlining the temporal evolution of freshness, and its disciplinary distribution. Subsequently, using a multivariable regression approach, we examine the association between team freshness and papers'short-term and long-term citations.The major findings are as follows: (1)team freshness in scientific teams has been increasing in the past half-century; (2)there exists an inverted-U-shaped association between team freshness and papers' citations in all the disciplines and in different periods;(3)the inverted-U-shaped relationship between team freshness and papers' citations is only found in small teams, while, in large teams, team freshness is significantly positively related to papers' citations.

cs.DL↗

arXiv2022

A Ta-TaS2 monolithic catalyst with robust and metallic interface for superior hydrogen evolution

The use of highly active and robust catalysts is crucial for producing green hydrogen by water electrolysis as we strive to achieve global carbon neutrality. Noble metals like platinum are currently used in industry for the hydrogen evolution reaction (HER), but suffer from scarcity, high price and unsatisfied performance and stability at large current density, restricting their large scale implementations. Here we report the synthesis of a new type of monolithic catalyst (MC) consisting of a metal disulfide (e.g., TaS2) catalyst vertically bonded to a conductive substrate of the same metal by strong covalent bonds. These features give the MC a mechanically robust and electrically near zero resistance interface, leading to an outstanding HER performance including rapid charge transfer and excellent durability, together with a low overpotential of 398 mV to achieve a current density of 2,000 mA cm-2 as required by industry. The Ta TaS2 MC has a negligible performance decay after 200 h operation at large current densities. In light of its unique interface and the various choice of metal elements giving the same structure, such monolithic materials may have broad uses besides catalysis.

cond-mat.mtrl-sci↗

arXiv2021

A durable and efficient electrocatalyst for saline water splitting with current density exceeding 2000 mA cm -2

Water electrolysis is promising for industrial hydrogen production to achieve a sustainable and green hydrogen economy, but the high cost of the technology limits its market share. Developing efficient yet economic electrocatalysts is crucial to decrease the cost of electricity and electrolytic cell. Meanwhile, electrolysis in seawater electrolyte can further reduce feedstock cost. Here we synthesize a type of electrocatalyst where trace precious metals are strongly anchored on corrosion-resistive matrix. As an example, the produced Pt/Ni-Mo electrocatalyst only needs an overpotential of 113 mV to reach an ultrahigh current density of 2000 mA cm-2 in saline-alkaline electrolyte, standing as the best performance so far. It shows high activity and long durability in various electrolytes and under harsh conditions, including strong alkaline and simulated seawater electrolytes, and under elevated temperatures up to 80 degree Celsius). This electrocatalyst is produced on a large scale at low cost and shows good performance in a commercial membrane electrode assembly stack, demonstrating its feasibility for practical water electrolysis

physics.chem-ph↗

arXiv2021

Stabilized Hydroxide Mediated Nickel-Based Electrocatalysts for High Current Density Hydrogen Evolution in Alkaline Media

Large scale production of hydrogen by electrochemical water splitting is considered as a promising technology to address critical energy challenges caused by the extensive use of fossil fuels. Although nonprecious nickel-based catalysts work well at low current densities, they need large overpotentials at high current densities that hinders their potential applications in practical industry. Here we report a hydroxide-mediated nickel based electrocatalyst for high current density hydrogen evolution, which delivers a current density of 1000 mA cm-2 at an overpotential of 98 mV. Combined X-ray absorption spectroscopy and high resolution X-ray photoelectron spectroscopy results show charge redistribution of nickel sites caused by Mo and surface FeOx clusters, which can stabilize the surface nickel hydroxide at high current densities for promoting water dissociation step. Such catalyst is synthesized at the metre scale and shows a current density of 500 mA cm-2 at 1.56 V in the overall water splitting, which demonstrate its potential for practical use. This work highlights a charge-engineering strategy for rational design of catalysts that work well at high current densities.

physics.chem-ph↗

arXiv2020

A Generative Adversarial Network for AI-Aided Chair Design

We present a method for improving human design of chairs. The goal of the method is generating enormous chair candidates in order to facilitate human designer by creating sketches and 3d models accordingly based on the generated chair design. It consists of an image synthesis module, which learns the underlying distribution of training dataset, a super-resolution module, which improve quality of generated image and human involvements. Finally, we manually pick one of the generated candidates to create a real life chair for illustration.

cs.CV↗