2022 · Conference paper
DeepDi: Learning a Relational Graph Convolutional Network Model on Instructions for Fast and Accurate Disassembly
DeepDi disassembles x86 and x64 binaries by decoding a superset of candidate instructions, linking them in an Instruction Flow Graph of forward, backward and overlap relations, and classifying true instructions with a Relational Graph Convolutional Network; heuristics and a small classifier then recover function entry points. On BAP corpora, LLVM 11 built with MSVC on Windows, and SPEC CPU2006 and CPU2017, the authors report accuracy comparable or superior to IDA Pro, Binary Ninja, Ghidra, Datalog Disassembly and XDA, robustness on Linn–Debray and Hikari obfuscated binaries, single-core CPU throughput of 146 KB/s (about twice IDA Pro) and GPU throughput of 24.5 MB/s (about 350 times IDA Pro).
Scope and limitations
Covers x86 and x64 ELF and PE binaries only. ELF ground truth assumes no data in code sections and uses linear disassembly plus symbol tables; PE ground truth comes from PDB files, with data lengths estimated because PDBs give only data addresses. Results are the authors’ 2022 comparisons against Binary Ninja 2.2, IDA Pro 7.2 and Ghidra 9.1.2 on their datasets and hardware, with one GTX 2080Ti GPU; Datalog Disassembly supports only x64 ELF and so covers part of the evaluation. Obfuscation tests use Linn–Debray samples and Hikari-built binaries; the authors note that a strong adversary using the model’s gradients could construct adversarial examples, which they leave to future work. The malware case reports 10-fold cross-validation accuracy on training data and log loss from the challenge’s online judge, because test labels are not public. Disassembly accuracy does not establish correct function boundaries in every case, decompilation or source recovery.
Why it fits this collection
Adds learned disassembly, the step whose errors several similarity and decompilation records list as a threat to validity, complementing IDA Pro-dependent pipelines such as jTrans.
Publication and review details
- Venue
- USENIX Security 2022
- Status
- Conference paper
- Publication / posting date
- August 2022
- Date source
- Publication month from the official USENIX BibTeX (month = aug) and the final PDF cover for the 31st USENIX Security Symposium, August 10–12, 2022; no exact publication day is asserted.
No paper DOI or arXiv identifier was verified; the record uses the reviewed USENIX Security presentation-page and sec22-yu-sheng.pdf profile. The USENIX BibTeX gives the 31st USENIX Security Symposium, pages 2709–2725, USENIX Association and month August; the presentation page also links a prepublication PDF and an abstract PDF. The paper describes a binary release. At reviewed commit e308252 (2026-05-01), the repository ships the model core as a prebuilt DeepDiCore.so under the DeepDi Trial Period Software Demonstration License Agreement, and license.txt applies MIT only to the other code, a Python wrapper, API notes and Dockerfiles; the GitHub API reports NOASSERTION, and the linked license PDF returned HTTP 404 when checked. The README calls this a community edition for non-commercial use, requires Docker and a free key from Deepbits, and supports optional CUDA GPUs. The model and training pipeline are not open source. Nothing was downloaded beyond documentation files, and no code was run.
Sources reviewed
Source review only; experiments were not rerun for this collection. Cite the original authors using the linked paper or BibTeX.
Primary sources
- https://www.usenix.org/conference/usenixsecurity22/presentation/yu-sheng
- https://www.usenix.org/system/files/sec22-yu-sheng.pdf
- README.md GitHub · DeepBitsTechnology/DeepDi · Revision e308252
- license.txt GitHub · DeepBitsTechnology/DeepDi · Revision e308252
- Dockerfile GitHub · DeepBitsTechnology/DeepDi · Revision e308252