  Vulnerabilities are challenging to locate and repair, especially when source
code is unavailable and binary patching is required. Manual methods are
time-consuming, require significant expertise, and do not scale to the rate at
which new vulnerabilities are discovered. Automated methods are an attractive
alternative, and we propose Partially Recompilable Decompilation (PRD). PRD
lifts suspect binary functions to source, available for analysis, revision, or
review, and creates a patched binary using source- and binary-level techniques.
Although decompilation and recompilation do not typically work on an entire
binary, our approach succeeds because it is limited to a few functions, like
those identified by our binary fault localization.
  We evaluate these assumptions and find that, without any grammar or
compilation restrictions, 70-89% of individual functions are successfully
decompiled and recompiled with sufficient type recovery. In comparison, only
1.7% of the full C-binaries succeed. When decompilation succeeds, PRD produces
test-equivalent binaries 92.9% of the time.
  In addition, we evaluate PRD in two contexts: a fully automated process
incorporating source-level Automated Program Repair (APR) methods; human-edited
source-level repairs. When evaluated on DARPA Cyber Grand Challenge (CGC)
binaries, we find that PRD-enabled APR tools, operating only on binaries,
performs as well as, and sometimes better than full-source tools, collectively
mitigating 85 of the 148 scenarios, a success rate consistent with these same
tools operating with access to the entire source code. PRD achieves similar
success rates as the winning CGC entries, sometimes finding higher-quality
mitigations than those produced by top CGC teams. For generality, our
evaluation includes two independently developed APR tools and C++, Rode0day,
and real-world binaries.
