Neural Reverse Engineering of Stripped Binaries using Augmented Control Flow Graphs
summary
Procedure name prediction for stripped binaries using a prototype called Nero that reconstructs CFGs, stitches paths, and builds augmented call sites with concrete or four abstract argument tags. Models tested: LSTM, Transformer and a GNN model; dataset is GNU packages with an 8:1:1 package-wise split. Results: GNN tops others, beating vanilla text models ~80% on average and the best competing system ~30%, call-site augmentation alone yields ~50% F1 gain, obfuscation hurts but GNN still leads.
AI-written summary · about
chapters (18)
- 0:00Intro
- 0:14Great Progress Using ML on Source Code
- 0:29Source code in a high-level language
- 0:55Disassembled Binary Code
- 1:42Key Idea: Use Binary Program Analysis to Create a Compact & Rich Representation
- 2:12Helping Reverse Engineers
- 2:31Un-Stripping Procedure Names
- 2:52Extract Paths From the CFG
- 3:36Augmenting Call Sites
- 4:15Using Concrete or Abstracted Values
- 5:24Pointer-Aware Slicing of Call Site Arguments
- 6:34Augmenting Call Site Arguments
- 7:32Augmented Control Flow Graph
- 8:11Evaluation Corpus
- 9:19Evaluation Results
- 10:43Ablation Study
- 11:41Qualitive Evaluation
- 13:50Takeaway Messages
related talks
24mBTD: Unleashing the Power of Decompilation for x86 Deep Neural Network Executables
32mDnD: Decompiling Deep Neural Network Compiled Binary
18mEvaluating the effectiveness of Deep Learning Models for Foundational Program Analysis(…)
54mLost and Found in Translation
21mAutomatic Recovery of Fine-grained Compiler Artifacts at the Binary Level
28mAutomated transpilation of imperative to functional code using neural-guided program synthe
51mReverse Engineering Binaries
29mNeural Nets Can Learn Function Type Signatures From Binaries