Identifying functions in binary code with reverse extended control flow graphs

Abstract

In binary code analysis, current function identification approaches are challenged by functions without explicit call sites and handcrafted assembly without standard prologues/epilogues. We propose a new function representation called a reverse extended control flow graph (RECFG) and a RECFG-based method for identifying functions in stripped binary code. A function has at least one return instruction (an instruction that makes the control flow leave a function). Therefore, return instructions are more reliable than the function prologues and epilogues used by traditional methods. We first build RECFGs from any values that can be interpreted as return instructions in a code range. Then, for each independent RECFG, the multiple-decision method chooses a subgraph as the control flow graph of a function. A prototype tool is developed for evaluation on seven open source applications, 138 binaries in MASM32 code examples, and 292 binaries in Windows XP SP3. Experimental results show that the proposed method can identify functions that cannot be identified by current methods with high precision and stable recall.

Return Instruction Identification in Binary Code with Machine Learning

“…For functions without classic prologue/epilogue, the above techniques may fail to identify these functions. The only one that identifies functions using the return instructions is reference [4]. Qiu et al identified functions by scanning all possible return instructions and then building reverse extended control flow graphs (RECFG) from return instructions.…”

“…Based on the result, the range of each function in a binary code will be partitioned. Finally, for each identified function return instruction, a reverse extended control graph will be used to identify the function entry point [4] and finally finish the function identification work.…”