{
  "added_at": "2026-11-02",
  "arxiv_id": null,
  "arxiv_version_reviewed": null,
  "authors": [
    "Gregory J. Duck",
    "Xiang Gao",
    "Abhik Roychoudhury"
  ],
  "bibtex_url": "https://awesomerea.org/papers/citations/paper-e9patch.bib",
  "code_url": "https://github.com/GJDuck/e9patch",
  "date_basis": "ACM’s Crossref deposit records print and online publication on 2020-06-11, and an archived copy of the ACM article page shows the same date. The June 15–20 PLDI dates printed in the paper are not substituted.",
  "date_basis_zh": "ACM 提交的 Crossref 元数据将印刷与在线出版日期均记为 2020-06-11，ACM 论文页面的存档副本显示相同日期。本条目不以论文所印 6 月 15–20 日的 PLDI 会议日期替代。",
  "date_precision": "day",
  "description_en": "E9Patch statically rewrites x86-64 binaries by inserting jumps to trampolines without moving any other instruction, so the original set of jump targets is preserved and control-flow recovery, symbolization and debug information are not needed. Where a five-byte jump does not fit, instruction punning, padding and successor or neighbor eviction overlap the jump with existing bytes or relocate neighboring instructions into their own trampolines; physical page grouping reduces the memory and file-size cost of scattered trampolines. Instruction locations come from a separate frontend, a basic linear disassembler in the evaluation. The authors evaluate SPEC2006, Ubuntu 16.04 system binaries, and Chrome and Firefox builds over 100 MB, and demonstrate binary repair and heap-write hardening with low fat pointers.",
  "description_zh": "E9Patch 对 x86-64 二进制进行静态重写：插入跳转到跳板代码的指令，而不移动其他任何指令，从而保留原有跳转目标集合，无需控制流恢复、符号化或调试信息。当五字节跳转放不下时，它通过指令双关、填充以及后继或邻近指令驱逐，使跳转与已有字节重叠，或把邻近指令移入各自的跳板；物理页分组则降低分散跳板带来的内存与文件体积开销。指令位置由独立的前端提供，评测中使用的是基础线性反汇编器。作者评测了 SPEC2006、Ubuntu 16.04 系统二进制以及超过 100 MB 的 Chrome 与 Firefox，并演示了二进制修复和基于低胖指针的堆写加固。",
  "doi": "10.1145/3385412.3385972",
  "entry_url": "https://awesomerea.org/papers/paper-e9patch/",
  "entry_url_zh": "https://awesomerea.org/zh/papers/paper-e9patch/",
  "evidence_urls": [
    "https://dl.acm.org/doi/10.1145/3385412.3385972",
    "https://web.archive.org/web/20251215175156/https://dl.acm.org/doi/10.1145/3385412.3385972",
    "https://api.crossref.org/works/10.1145/3385412.3385972",
    "https://comp.nus.edu.sg/~gregory/papers/e9patch.pdf",
    "https://github.com/GJDuck/e9patch/blob/682ab1f7f0480aa45edf1fd94457e5ee2dd01043/README.md",
    "https://github.com/GJDuck/e9patch/blob/682ab1f7f0480aa45edf1fd94457e5ee2dd01043/LICENSE"
  ],
  "first_arxiv_date": null,
  "id": "paper-e9patch",
  "json_url": "https://awesomerea.org/papers/paper-e9patch/record.json",
  "kind": "research",
  "markdown_url": "https://awesomerea.org/papers/paper-e9patch/index.md",
  "markdown_url_zh": "https://awesomerea.org/zh/papers/paper-e9patch/index.md",
  "metadata_notes": "Crossref and the archived ACM page give the three authors, the PLDI 2020 proceedings and pages 151–163; ACM metadata uses sentence case. The PDF is the 13-page author’s version on Gregory J. Duck’s NUS page, linked from the repository README, and the ACM page holds the version of record. The reviewed 2026-06-28 repository commit describes x86_64 Linux ELF executables and shared objects, GPL-3.0 with some MIT-licensed files, and states that the current version is significantly improved over the prototype evaluated in the PLDI paper, with new optimizations, improved physical page grouping and slightly higher coverage.",
  "metadata_notes_zh": "Crossref 与 ACM 页面存档给出三位作者、PLDI 2020 论文集及第 151–163 页；ACM 元数据采用句首大写。PDF 为 Gregory J. Duck 在 NUS 页面上提供的 13 页作者版本，仓库 README 亦链接此文件，版本记录以 ACM 页面为准。所审阅的 2026-06-28 仓库提交说明其适用于 x86_64 Linux ELF 可执行文件与共享库，采用 GPL-3.0，部分文件采用 MIT 许可，并说明当前版本相较 PLDI 论文评测的原型有显著改进，包括新的优化、改进的物理页分组以及略有提高的覆盖率。",
  "pdf_url": "https://comp.nus.edu.sg/~gregory/papers/e9patch.pdf",
  "project_url": null,
  "publication_date": "2020-06-11",
  "publication_status": "conference-paper",
  "record_type": "paper",
  "runtime_tested": false,
  "scope_limitations_en": "This is static binary rewriting and instrumentation, not decompilation or source recovery. It relies on the frontend’s instruction locations and sizes being correct, assumes patched code is not read as data or self-modified, and assumes the input does not already use overlapping instructions. Each tactic can fail: 1,098 of about 10.5 million patch locations were not patched, baseline coverage alone was 72.79% for jumps and 81.63% for heap writes, and non-PIE binaries are harder than PIE ones. Chrome’s mixed code and data required starting disassembly after ChromeMain, and Firefox’s code was patched in libxul.so. Reported overheads, such as about 113% for Chrome and 46% for Firefox on Dromaeo DOM benchmarks with heap-write instrumentation, were measured with the PLDI prototype, with SPEC2006 compiled by GCC in non-PIE mode; they do not describe the current release.",
  "scope_limitations_zh": "这是静态二进制重写与插桩，而非反编译或源码恢复。它依赖前端提供正确的指令位置与长度，假定被修补的代码不会被当作数据读取或自修改，并假定输入本身未使用重叠指令。各项策略都可能失败：约 1,050 万个修补位置中有 1,098 个未能修补；仅用基线方法时，跳转指令覆盖率为 72.79%，堆写指令为 81.63%；非 PIE 二进制比 PIE 更难处理。由于 Chrome 的代码段混有数据，需从 ChromeMain 之后开始反汇编；Firefox 的代码则在 libxul.so 中修补。报告的开销（例如对堆写指令插桩后，在 Dromaeo DOM 基准上 Chrome 约 113%、Firefox 约 46%）是用 PLDI 原型测得的，SPEC2006 以 GCC 非 PIE 模式编译；这些数据不代表当前版本。",
  "targets": [
    "binary"
  ],
  "title": "Binary Rewriting without Control Flow Recovery",
  "title_zh": "无需控制流恢复的二进制重写",
  "url": "https://dl.acm.org/doi/10.1145/3385412.3385972",
  "venue": "PLDI 2020",
  "verification": "source-reviewed",
  "verified_at": "2026-10-19",
  "why_fits_en": "Adds a control-flow-agnostic static rewriting technique for stripped x86-64 binaries, a foundation for patching and instrumenting binaries whose structure has not been recovered, complementing the section’s lifting and decompilation research.",
  "why_fits_zh": "补充一种不依赖控制流的剥离符号 x86-64 二进制静态重写技术，可用于修补与插桩尚未恢复结构的二进制，与本节的提升及反编译研究互补。",
  "year": 2020
}