2025 · Conference paper
Lares: LLM-driven Code Slice Semantic Search for Patch Presence Testing
Lares tests whether a known 1-day vulnerability fix is present in a target binary function without recompiling the project. Its inputs are the target binary, the project source and the patch commit diff. A patch-enhancement step adds data- and control-flow context from the source (via Tree-sitter and Joern) to patches with few changed statements. An LLM then locates the pseudocode slice in the IDA Pro decompilation of the target function that corresponds to each patch slice. Finally, matched slices are normalized into equations and checked for equivalence with the Z3 SMT solver, and the LLM judges the cases Z3 cannot model, deciding whether the function matches the pre-patch or the patched version. On 4,480 test cases from 73 CVEs in OpenSSL, FreeType, tcpdump and libxml2, compiled with GCC 9.4.0 and Clang 6 at O0–O3 for x86, x64 and ARM, the authors report an average F1 of 0.77 on x86 with Claude 3.5 Sonnet, against 0.67 for Robin and 0.68 for PS3, and F1 from 0.71 to 0.77 across five compiler–architecture settings.
Scope and limitations
Lares answers a narrow question: given a specific CVE patch diff, the project source with its history and a candidate function, is that function pre-patch or patched? It needs both the patch diff and the project source, and assumes a separate binary code similarity tool (the paper names BinaryAI as an example) has already located the candidate function. It does not find vulnerable functions, discover new vulnerabilities or diff arbitrary binaries. Its judgments rest on an LLM plus SMT reasoning over decompiler pseudocode: Z3 handles only about 21% of test cases (Z3-only verification has recall 0.221), so most decisions come from the LLM, and the authors list hallucinated comparisons, stealthy edit-type patches and repeated patch statements as failure modes. Results use IDA Pro 7.5 and a commercial model at about $0.20 per case; GPT-3.5-Turbo and DeepSeek-Coder score lower. The evaluation covers four C projects, 73 CVEs and binaries the authors compiled themselves, plus 20 vulnerabilities disclosed after October 2024 (400 cases) to check training-data contamination; firmware, other languages and real vendor builds are not evaluated. The repository has no license file, so no reuse terms are granted.
Why it fits this collection
Adds binary patch presence testing, using LLM-located slices of decompiled pseudocode, to the decompilation and binary-analysis research; it complements the curated BinDiff diffing tool rather than replacing it.
Publication and review details
- Venue
- ASE 2025
- Status
- Conference paper
- Publication / posting date
- 2025 (exact date not verified)
- Date source
- Publication year from IEEE's Crossref deposit for the 2025 ASE proceedings. Its only date, 2025-11-16, is the first day of the November 16–20 conference, so no publication month or day is asserted; the arXiv date is not substituted.
- First arXiv submission
- November 3, 2025
- arXiv
- 2511.01252
- Reviewed arXiv version
- v1
- DOI
- 10.1109/ASE63991.2025.00081
IEEE's Crossref deposit gives the 2025 40th IEEE/ACM ASE proceedings, pages 919–931, and the same ten authors in order; the DOI resolves to IEEE Xplore document 11334274, which refused automated requests, so the review relied on Crossref and the arXiv PDF. arXiv v1 (2025-11-03) is the only version and carries no venue comment, so it may differ from the IEEE version. The abstract links Siyuan-Li201/Lares; at the reviewed 2025-09-16 commit the repository has no license file, and its README gives the inputs as the binary, the project source path and the patch diff file. The repository commits IDA databases for stripped OpenSSL test builds, zipped tcpdump, FreeType and libxml2 sources and patch files, links the evaluation binaries on Google Drive, and requires an IDA Pro 7.5 path and an LLM API key in settings.py; settings.py preconfigures a third-party API relay with an author-supplied test key, which this record does not reproduce. No code or experiments were run.
Sources reviewed
Source review only; experiments were not rerun for this collection. Cite the original authors using the linked paper or BibTeX.
Primary sources
- https://ieeexplore.ieee.org/document/11334274
- https://api.crossref.org/works/10.1109/ASE63991.2025.00081
- https://arxiv.org/abs/2511.01252
- https://arxiv.org/pdf/2511.01252v1
- README.md GitHub · Siyuan-Li201/Lares · Revision b6ca631
- code GitHub · Siyuan-Li201/Lares · Revision b6ca631
- patch GitHub · Siyuan-Li201/Lares · Revision b6ca631