AwesomeREA.org

2020 · Journal article

Neural reverse engineering of stripped binaries using augmented control flow graphs

Yaniv David; Uri Alon; Eran Yahav

Nero predicts names for procedures in stripped x86-64 Linux executables; it does not produce decompiled code. Static analysis reconstructs call sites, including imported API names, and augments their arguments with concrete and abstract values along control-flow paths. LSTM, Transformer and graph neural network encoders over the resulting augmented call-site graph feed a decoder that generates the name as subtokens. On a GNU-package test set the authors report 45.53 F1 for Nero-GNN, against 35.52 for an adapted DIRE and 33.66 for Debin.

Scope and limitations

Evaluation uses 67,246 procedures from C-only GNU packages built as x86-64 Linux executables, split by package into 60,403/2,034/4,809 examples after removing C++ executables, tests, statically linked packages and duplicate package versions. Labels come from names present before stripping, and F1 is measured over name subtokens, so outputs are learned suggestions rather than recovered original symbols. Simulated API-name obfuscation, which zeroes the .dynstr section, lowers Nero-GNN to 38.83 F1; packers and heavier obfuscation are not addressed. A procedure needs at least one statically detectable call site, and inlined procedures cannot be named. Data generation relied on a licensed IDA Pro (tested with 6.95) for procedure boundaries and export, plus angr and LLVM 10, and the model code uses TensorFlow 1.13.1; no claim is made about compatibility with current tool versions.

Why it fits this collection

Adds learned procedure-name prediction for stripped binaries driven by static call-site analysis, complementing the variable-name and type-recovery papers in this section.

Publication and review details

Venue
Proceedings of the ACM on Programming Languages (OOPSLA 2020)
Status
Journal article
Publication / posting date
November 13, 2020
Date source
ACM’s Crossref deposit gives print and online publication on 2020-11-13, and an archived copy of the ACM article page shows the same publication date. The OOPSLA conference dates and the arXiv versions are not substituted.
First arXiv submission
February 25, 2019
arXiv
1902.09122
Reviewed arXiv version
v4
DOI
10.1145/3428293

ACM metadata in Crossref and in an Internet Archive copy of the ACM article page (the live page served a browser check during review) give the sentence-case title, volume 4, issue OOPSLA, article 225, pages 1–28; arXiv and the paper PDF capitalise it as 'Neural Reverse Engineering of Stripped Binaries using Augmented Control Flow Graphs'. Crossref records a CC BY-NC-SA 4.0 licence for the article. arXiv has four versions, v1 of 2019-02-25 to v4 of 2020-10-16, and links the DOI; v4 was reviewed and serves as the PDF because the ACM-hosted PDF was not retrieved. The README calls the repository the official Nero-GNN implementation; the reviewed 2021-05-10 commit carries GPL-3.0. Data generation targets Ubuntu 20 with Python 3.8, LLVM 10, angr and a licensed IDA Pro (IDAPython 2.7 scripts tested with 6.95); the model uses Python 3.6 and TensorFlow 1.13.1. The README warns that regenerated representations may differ slightly from the Zenodo copies after a Python 3 port. Zenodo (concept DOI 10.5281/zenodo.4081641) hosts the binaries, procedure representations and a trained GNN model under a CC-BY-4.0 record label. No archives were downloaded and no code or experiments were run.

Sources reviewed

Source review only; experiments were not rerun for this collection. Cite the original authors using the linked paper or BibTeX.

Primary sources

  1. https://dl.acm.org/doi/10.1145/3428293
  2. https://web.archive.org/web/20250415223553/https://dl.acm.org/doi/10.1145/3428293
  3. https://api.crossref.org/works/10.1145/3428293
  4. https://arxiv.org/abs/1902.09122
  5. https://arxiv.org/pdf/1902.09122v4
  6. README.md GitHub · tech-srl/Nero · Revision 7dac9f5
  7. LICENSE GitHub · tech-srl/Nero · Revision 7dac9f5
  8. requirements.txt GitHub · tech-srl/Nero · Revision 7dac9f5
  9. https://zenodo.org/api/records/4099685
  10. https://zenodo.org/api/records/4095276