OSPREY: Recovery of Variable and Data Structure via Probabilistic Analysis for Stripped Binary

Zhang, Zhuo; Ye, Yapeng; You, Wei; Tao, Guanhong; Lee, Wen‐Chuan; Kwon, Yonghwi; Aafer, Yousra; Zhang, Xiangyu

doi:10.1109/sp40001.2021.00051

Cited by 10 publications

(2 citation statements)

References 42 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…It generates the type constraints, which are solved later for type recovery. OSPREY [68] defines deterministic reasoning rules for the hints collected by BDA [69], which serves for the following probabilistic inference to recover the variable types and data structures.…”

Section: Related Workmentioning

confidence: 99%

DeGPT: Optimizing Decompiler Output with LLM

Hu,

Liang,

Chen

2024

Proceedings 2024 Network and Distributed System Security Symposium

View full text Add to dashboard Cite

Reverse engineering is essential in malware analysis, vulnerability discovery, etc. Decompilers assist the reverse engineers by lifting the assembly to the high-level programming language, which highly boosts binary comprehension. However, decompilers suffer from problems such as meaningless variable names, redundant variables, and lacking comments describing the purpose of the code. Previous studies have shown promising performance in refining the decompiler output by training the models with huge datasets containing various decompiler outputs. However, even datasets that take much time to construct cover limited binaries in the real world. The performance degrades severely facing the binary migration.In this paper, we present DeGPT, an end-to-end framework aiming to optimize the decompiler output to improve its readability and simplicity and further assist the reverse engineers in understanding the binaries better. The Large Language Model (LLM) can mitigate performance degradation with its extraordinary ability endowed by large model size and training set containing rich multi-modal data. However, its potential is difficult to unlock through one-shot use. Thus, we propose the three-role mechanism, which includes referee (R_ref), advisor (R_adv), and operator (R_ope), to adapt the LLM to our optimization tasks. Specifically, R_ref provides the optimization scheme for the target decompiler output, while R_adv gives the rectification measures based on the scheme, and R_ope inspects whether the optimization changes the original function semantics and concludes the final verdict about whether to accept the optimizations. We evaluate DeGPT on the datasets containing decompiler outputs of various software, such as the practical command line tools, malware, a library for audio processing, and implementations of algorithms. The experimental results show that even on the output of the current top-level decompiler (Ghidra), DeGPT can achieve 24.4% reduction in the cognitive burden of understanding the decompiler outputs and provide comments of which 62.9% can provide practical semantics for the reverse engineers to help the understanding of binaries. Our user surveys also show that the optimizations can significantly simplify the code and add helpful semantic information (variable names and comments), facilitating a quick and accurate understanding of the binary.1 We use semantic in two categories of meaning. When it is used for "semantic information", it refers to the semantics of information like comments and variable names. When it is used for "function/code semantics", it refers to the behaviors of the function/code.

show abstract

Section: Related Workmentioning

confidence: 99%

DeGPT: Optimizing Decompiler Output with LLM

Hu,

Liang,

Chen

2024

Proceedings 2024 Network and Distributed System Security Symposium

View full text Add to dashboard Cite

show abstract

“…There has also been work on type recovery apart from any particular binary analysis framework. These techniques include static [35], [2] and dynamic [31], [22] approaches.…”

Section: Related Workmentioning

confidence: 99%

Blaze: A Framework for Interprocedural Binary Analysis

Revelle¹,

Parker²,

Orr³

2023

Proceedings 2023 Workshop on Binary Analysis Research

View full text Add to dashboard Cite

Blaze is an open-source binary analysis framework that supports the construction and manipulation of interprocedural control-flow graphs (ICFGs) and type checking on a lifted representation of program binaries. All analyses in Blaze are implemented in terms of a typed intermediate language-Path Intermediate Language (PIL). Blaze includes a unification-based type checker for PIL which is used to support the generation of SMT formulas and type inference. Blaze has been used to develop tools for reverse engineering and vulnerability discovery and provides a foundation for exploring the use of type systems and higher-level abstractions in the analysis of program binaries. This paper provides an overview of Blaze's implementation, capabilities, and applications.This material is based upon work supported by the Defense Advanced Research Projects Agency (DARPA) and the Naval Information Warfare Center (NIWC) under Contract No. N66001-22-C-4018. Any opinions, findings, and conclusions or recommendations expressed in this material are those of the author(s) and do not necessarily reflect the views of DARPA and NIWC. Distribution A (approved for public release, distribution unlimited).

show abstract