AwesomeREA.org

2026 · Preprint

Locate, Then Reason: End-to-End Patch Presence Testing in Stripped Binaries

Huaijin Wang; Tongda Wang; Zhibo Liu; Yue Zhang; Shuai Wang; Pengfei Hu; Jianzhong Liu; Fangtian Zhong; Shaohua Wang

Locates patch-relevant code in stripped binaries using instruction-aligned retrieval and caller/callee context, then uses an LLM to screen candidate matches and compare patch-specific behavior with vulnerable and patched references.

Scope and limitations

Requires the known source patch and vulnerable/patched reference binaries; it is not source recovery or undisclosed-vulnerability discovery. Evaluation covers 62 CVEs from four C/C++ projects, 124 reference and 496 target binaries, restricted to x86-64, GCC/Clang configurations and one reported reasoning model. Balanced labels do not reproduce deployment prevalence; public patches may be in training data. Uncertain and missing-localization outcomes are reported separately, but binary metrics map them to vulnerable and negative outcomes, respectively; selected accuracy excludes both.

Why it fits this collection

Studies evidence-guided localization and semantic comparison of binary code, including the limits of decompiler-inferred types when judging small fixes.

Publication and review details

Venue
arXiv
Status
Preprint
Publication / posting date
October 18, 2026
Date source
First arXiv v1 submission; no formal venue publication was verified.
First arXiv submission
October 18, 2026
arXiv
2610.25071
Reviewed arXiv version
v1
DOI
10.48550/arxiv.2610.25071

Reviewed the nine-author v1 abstract and full text. The article uses the arXiv non-exclusive license. Its data-availability section promises code, models, data and instructions upon publication; no paper-specific public artifact or artifact license was verified in the reviewed text and focused search. Cited baseline tools are not the PatchAlign release. DataCite registered the matching arXiv DOI on 2026-10-20, despite the abstract page still saying pending. No binary, model or experiment was executed.

Sources reviewed

Source review only; experiments were not rerun for this collection. Cite the original authors using the linked paper or BibTeX.

Primary sources

  1. https://arxiv.org/abs/2610.25071
  2. https://arxiv.org/html/2610.25071v1
  3. https://api.datacite.org/dois/10.48550/arxiv.2610.25071