Neural Reverse Engineering of Stripped Binaries using Augmented Control Flow Graphs

Abstract

We address the problem of reverse engineering of stripped executables, which contain no debug information. This is a challenging problem because of the low amount of syntactic information available in stripped executables, and the diverse assembly code patterns arising from compiler optimizations. We present a novel approach for predicting procedure names in stripped executables. Our approach combines static analysis with neural models. The main idea is to use static analysis to obtain augmented representations of call sites; encode the structure of these call sites using the control-flow graph (CFG) and finally, generate a target name while attending to these call sites. We use our representation to drive graph-based, LSTM-based and Transformer-based architectures. Our evaluation shows that our models produce predictions that are difficult and time consuming for humans, while improving on existing methods by 28% and by 100% over state-of-the-art neural textual models that do not use any static analysis. Code and data for this evaluation are available at https://github.com/tech-srl/Nero .

References in corpus (14)

• Adam: A Method for Stochastic Optimization
• Neural Machine Translation by Jointly Learning to Align and Translate
• Sequence to Sequence Learning with Neural Networks
• Semi-Supervised Classification with Graph Convolutional Networks
• Learning Phrase Representations using RNN Encoder-Decoder for Statistical Machine Translation
• Bidirectional Attention Flow for Machine Comprehension
• Recurrent Models of Visual Attention
• Multiple Object Recognition with Visual Attention
• Neural Network-based Graph Embedding for Cross-Platform Binary Code Similarity Detection
• Structured Neural Summarization
• Structured Generative Models of Natural Source Code
• Generative Code Modeling with Graphs
• Context2Name: A Deep Learning-Based Approach to Infer Natural Variable Names from Usage Contexts
• Data-Driven Program Completion

Cited by in corpus (10)

• DOBF: A Deobfuscation Pre-Training Objective for Programming Languages
• In Nomine Function: Naming Functions in Stripped Binaries with Neural Networks
• Learning to Find Usages of Library Functions in Optimized Binaries
• Augmenting Decompiler Output with Learned Variable Names and Types
• NeuDep: Neural Binary Memory Dependence Analysis
• Variable Name Recovery in Decompiled Binary Code using Constrained Masked Language Modeling
• Enhancing Function Name Prediction using Votes-Based Name Tokenization and Multi-Task Learning
• How could Neural Networks understand Programs?
• Pretraining on Call Graphs: When Binary Analysis Tasks Profit From Context
• Adabot: Fault-Tolerant Java Decompiler