2022 · Conference paper
SymLM: Predicting Function Names in Stripped Binaries via Context-Sensitive Execution-Aware Code Embeddings
SymLM predicts function names for stripped binaries as sets of name words. It encodes each function’s instructions with a Trex model pretrained on micro-execution traces, fuses them with embeddings of callers, internal callees and external library calls taken from Ghidra’s interprocedural CFG, and scores words from a fixed vocabulary with an MLP decoder; name preprocessing and a word-embedding module, CodeWordNet, handle abbreviations and synonyms. On 1,431,169 functions from 16,027 binaries of 27 projects across x86, x64, ARM and MIPS, O0–O3 and four Hikari obfuscations, the authors report weighted average precision 0.634, recall 0.677 and F1 0.655, plus a firmware case study.
Scope and limitations
Names are predicted as unordered word sets from a fixed training vocabulary and scored with word-level precision, recall and F1, with CodeWordNet counting semantically similar words as matches. This is not exact source-name recovery, and out-of-vocabulary words cannot be produced. Binaries were built with GCC 7.5 for Linux and split by binary within the same 27 projects. On 540 binaries from 12 unseen projects, overall performance remains lower, which the authors partly attribute to vocabulary mismatch; a later NDSS 2025 comparison on deduplicated data reports SymLM’s average F1 at 0.105. NFRE comparisons are x64-only, and NERO comparisons use NERO’s dataset. Obfuscation covers four Hikari passes, not packing or encryption. In the firmware case study, 172 of 1,061 functions in eight 32-bit ARM firmware images received partially correct names.
Why it fits this collection
Adds execution-aware, calling-context function-name prediction for stripped binaries, evaluated across architectures, optimizations and obfuscations, complementing variable-name, type and data-structure recovery research.
Publication and review details
- Venue
- ACM CCS 2022
- Status
- Conference paper
- Publication / posting date
- November 7, 2022
- Date source
- The ACM article page and the publisher’s Crossref deposit both give publication on 2022-11-07, which is also the first day of the November 7–11 conference; the publisher-stated date is recorded.
- DOI
- 10.1145/3548606.3560612
Crossref truncates the title to “SymLM”; the full title follows the ACM page and the author-hosted PDF, which carries the CCS ’22 header and DOI. ACM and Crossref agree on the four-author order and pages 1631–1645, and ACM marks the article free to read. An arXiv title search found no preprint. The reviewed 2025-07-06 repository snapshot is MIT-licensed and includes a vendored fairseq, dataset-generation scripts, a sample x64 dataset, training, prediction and evaluation scripts, and CodeWordNet training code. Its README sets up Python 3.8 with CUDA 11.3 PyTorch and pinned requirements such as transformers 4.16.2 and gensim 3.8.1; training needs a December 2021 Trex checkpoint and CodeWordNet models from Google Drive links, and it warns that newer Trex checkpoints may be incompatible. The full dataset is Zenodo record 8306055 (about 9.4 GB; CC BY 4.0 in its metadata), which is registered under the paper’s DOI rather than a separate dataset DOI. The paper reports 8 days of training on top of the Trex pretraining. Nothing was run or downloaded.
Sources reviewed
Source review only; experiments were not rerun for this collection. Cite the original authors using the linked paper or BibTeX.
Primary sources
- https://dl.acm.org/doi/10.1145/3548606.3560612
- https://api.crossref.org/works/10.1145/3548606.3560612
- https://xinjin95.github.io/assets/pdf/SymLM_ccs2022_paper.pdf
- README.md GitHub · OSUSecLab/SymLM · Revision 89a4815
- LICENSE GitHub · OSUSecLab/SymLM · Revision 89a4815
- requirements.txt GitHub · OSUSecLab/SymLM · Revision 89a4815
- https://zenodo.org/records/8306055
- https://zenodo.org/api/records/8306055
- https://www.ndss-symposium.org/wp-content/uploads/2025-797-paper.pdf