purseclab/dnd

A decompiler to automatically reverse-engineer the DNN semantics from its compiled binary using program analysis

DnD: A Cross-Architecture Deep Neural Network Decompiler

DND is a deep neural network (DNN) decompiler capable of reverse engineering DNN models from compiled binaries.

Environment

1. Create a Python virtual environment
2. pip install -r ./angr_env/requirements.txt
3. Move ./angr_env/base.py to overwrite the counterpart in the virtual environment claripy (usually in $USERNAME/.virtualenvs/$VIRTUALENVNAME/lib/python$VERSION/site-packages/claripy/ast/base.py)

Docker container

We provide a docker container. To use it, just run:

docker build . -t dnd
docker run -it dnd

Usage

• Run python decompiler.py <model_binary> <model_onnx> to decompile a binary sample (<model_binary>) and export it into an ONNX file (<model_onnx>).For instance:

python ./decompiler.py binary_samples/evkbimxrt1050_glow_lenet_mnist_release.axf onnx_models/mnist.onnx
python ./decompiler.py binary_samples/evkbimxrt1050_glow_cifar10.axf onnx_models/resnet.onnx

• Two samples are provided:
  ./binary_samples/evkbimxrt1050_glow_lenet_mnist_release.axf: a MNIST binary on NXP imrt1050-evk board
  ./binary_samples/evkbimxrt1050_glow_cifar10.axf: a Resnet binary on NXP imrt1050-evk board

• The folder onnx_models containes ONNX models exported by DND for the binaries in binary_samples.

• The folder patches showcases how to patch binaries implementing DNNs.

• Please check decompiler.py for more details.

Citing this work

  title={$\{$DnD$\}$: A $\{$Cross-Architecture$\}$ deep neural network decompiler},
  author={Wu, Ruoyu and Kim, Taegyu and Tian, Dave Jing and Bianchi, Antonio and Xu, Dongyan},
  booktitle={31st USENIX Security Symposium (USENIX Security 22)},
  pages={2135--2152},
  year={2022}
}

dnd's Issues

run the code

Hi @wuruoyu,
If it is convenient for you to tell me how do I run this code？

A problem

Traceback (most recent call last):
File "decompiler.py", line 175, in
decompile(sys.argv[1], sys.argv[2])
File "decompiler.py", line 138, in decompile
lifted_ast = lift_func_to_ast(proj, f)
File "decompiler.py", line 62, in lift_func_to_ast
lifted_ast = lift(proj, mem_write_dict, solver)
File "/home/Newdisk2/jianghaiqi/DnD/src/lifter.py", line 759, in lift
lifted_ast = lift_mem_write(proj, new_mem_write_dict, solver)
File "/home/Newdisk2/jianghaiqi/DnD/src/lifter.py", line 557, in lift_mem_write
outer_loop = list(mem_write_dict.values())[0].outer_loop

IndexError: list index out of range

How to get self .axf file

I have compiled a alexnet model by TVM, and get 3 outputs (mod.json, mod.prams, and mod.so). How can I get sample .axf file from this 3 outputs?