System and methods for live debugging of transformed binaries

A non-transitory computer-readable storage medium comprising instructions that, when executed by a processing device, cause the processing device to:

• establish an interactive debugging session by calling an executable code component corresponding to a packed binary file, the executable code component including machine code that corresponds to blocks of original source code, wherein the calling causes the executable code component and a function randomization library corresponding to the blocks of original source code to be loaded into memory for execution;
• in response to a request for executing the executable code component, generate a randomly reorganized layout of the machine code corresponding to the blocks of the original source code in the memory based on subjecting the executable code component to a transformation defined in the function randomization library;
• in response to generating the randomly reorganized layout,
• create an in-memory object file by using a debug data component corresponding to the packed binary file, the debug data component including symbol table information to debug the blocks of the original source code that is generated prior to the randomly reorganized layout, and
• update symbol table information in the debug data component based on the randomly reorganized layout of the machine code;
• and
• load the in-memory object file with the updated symbol information to debug the blocks of the original source code.

A system to debug software that is reorganized in memory, the system comprising:

• a memory;
• and
• a processing device, operatively coupled with the memory component, to:
• establish an interactive debugging session by calling an executable code component corresponding to a packed binary file, the executable code component including machine code that corresponds to blocks of original source code, wherein the calling causes the executable code component and a function randomization library corresponding to the blocks of original source code to be loaded into the memory for execution,
• in response to a request for executing the executable code component, generate a randomly reorganized layout of the machine code corresponding to the blocks of the original source code in the memory based on subjecting the executable code component to a transformation defined in the function randomization library,
• in response to generating the randomly reorganized layout,
• create an in-memory object file by using a debug data component corresponding to the packed binary file, the debug data component including symbol table information to debug the blocks of the original source code that is generated prior to the randomly reorganized layout, and
• update symbol table information in the debug data component based on the randomly reorganized layout of the machine code, and
• load the in-memory object file with the updated symbol information to debug the blocks of the original source code.