Practical and Lightweight Hardening for x86-64 COTS Binaries

Abstract

As edge computing nodes and platform-class devices such as industrial gateways become increasingly prevalent, the x86-64 architecture is widely used in these deployments, making memory-safety protection against vulnerabilities in x86-64 commercial off-the-shelf (COTS) binaries a critical security requirement. However, existing mitigation techniques often rely on source code availability or specific compiler/OS support; furthermore, the protection scope of a single mechanism is typically limited, frequently necessitating the combined deployment of multiple defenses. Such superposition of multiple mechanisms tends to introduce significant runtime overhead and compatibility risks, thereby limiting their practical application in resource-constrained scenarios. To address this, we propose FEATHER, a lightweight, multidimensional memory-space hardening framework for x86-64 COTS binaries, designed to effectively harden COTS binaries without requiring source code support. FEATHER employs a program-aware, cross-layer memory-layout hardening strategy that composes application-level binary rewriting with runtime-library-level glibc hardening, covering the target program’s stack, global offset table (GOT), heap, code segments, and glibc. By jointly reinforcing both the application and its dependencies, it significantly reduces the predictability of the runtime memory space. We systematically evaluate FEATHER in terms of security, file size expansion, and performance overhead using Nginx, Redis, SQLite, and 20 representative Coreutils/Binutils programs, while constructing three representative application scenarios to analyze its applicability under different workloads and attack models. The experimental results show that FEATHER reduces the reliability of the evaluated exploitation paths while incurring modest overhead for most tested workloads. Its performance overhead is comparable to that of commonly used secure-compilation options and secure heap allocators.