IRENE: A Toolchain for High-level Micropatching through Recompilable Sub-function Regions

Devices with long life-cycles extend the duration of a software product’s exposure. Vulnerabilities in the device’s software may be discovered after the toolchain for building software for that device has been deprecated, the source-code for the program that is running on the device is unavailable, or both. Current solutions for patching these latent vulnerabilities are insufficient, either requiring deep technical expertise and manual effort or producing a large set of changes to the target binary. The large number of changes in the target program makes validating the patch difficult.We present IRENE, a decompiler that produces recompilable decompilation for patching. IRENE decompiles sub-function regions of a binary program to separate recompilable regions of code. The IRENE compiler replaces the original binary region with recompiled assembly, representing the user’s patch. IRENE allows developers to compose patches by modifying a high-level representation of the target program, but produces targeted micropatches. We evaluate the size of IRENE produced micropatches against patches produced both by recompilation and manual assembly patching in a case study. This evaluation shows a patch size reduction of 4x compared with recompilation and a 21x size reduction when compared with recompiling the patch with a newer toolchain version.