XDA: Accurate, Robust Disassembly with Transfer Learning

Abstract

Accurate and robust disassembly of stripped binaries is challenging. The root of the difficulty is that highlevel structures, such as instruction and function boundaries, are absent in stripped binaries and must be recovered based on incomplete information. Current disassembly approaches rely on heuristics or simple pattern matching to approximate the recovery, but these methods are often inaccurate and brittle, especially across different compiler optimizations.We present XDA, a transfer-learning-based disassembly framework that learns different contextual dependencies present in machine code and transfers this knowledge for accurate and robust disassembly. We design a self-supervised learning task motivated by masked Language Modeling to learn interactions among byte sequences in binaries. The outputs from this task are byte embeddings that encode sophisticated contextual dependencies between input binaries' byte tokens, which can then be finetuned for downstream disassembly tasks.We evaluate XDA's performance on two disassembly tasks, recovering function boundaries and assembly instructions, on a collection of 3,121 binaries taken from SPEC CPU2017, SPEC CPU2006, and the BAP corpus. The binaries are compiled by GCC, ICC, and MSVC on x86/x64 Windows and Linux platforms over 4 optimization levels. XDA achieves 99.0% and 99.7% F1 score at recovering function boundaries and instructions, respectively, surpassing the previous state-of-the-art on both tasks. It also maintains speed on par with the fastest ML-based approach and is up to 38× faster than hand-written disassemblers like IDA Pro.

Learning to Find Usages of Library Functions in Optimized Binaries

“…We want to clarify that like [23], [24], [25], [26] we do not target the function boundary identification task. Ghidra & Hexrays already do this at 90%+ accuracy.…”

Boosting Neural Networks to Decompile Optimized Binaries

“…Similarly, many previous studies leverage neural networks to learn binary or assembly code representation. They perform well on binary-based downstream analysis tasks, including code clone detection [39], malicious code detection [2], and disassembly [170]. The application of deep learning in software analysis and software reverse engineering significantly reduces human resources and time costs, no matter from the view of developers or analysts.…”

“…The application of deep learning in software analysis and software reverse engineering significantly reduces human resources and time costs, no matter from the view of developers or analysts. In addition, compared to traditional tools, the faster speed of deep neural-based disassembly approaches [170] makes them a powerful engine for downstream models like malware classification. It is meaningful to study how to make neural network (NN) models work well in software reverse engineering and software analysis.…”

Towards rigorous evaluation of binary testing and analysis

“…[76], [115], [175], [176], [197], function boundary detection [32], [42], [59], [62], [176], [197], static similarity detection [49], [73], [99], [107], [109], [113], [126], [130], [160], [169], type recovery [19], and full decompilation [28], [44], [101]. Each of these capabilities is in turn crucial for downstream security tasks such as malware analysis [51], [67], [81], [122] and software hardening via control-flow-integrity (CFI) enforcement, artificial diversification, or debloating when source code is not available.…”

“…Neural binary analyses (NBAs) are seemingly wellmatched to the problem domain, where inference is necessary due to the lossy compilation process. Recent work has shown great promise for performing accurate disassembly [176], [197], function boundary detection [42], [62], [176], [197], and static binary similarity detection [49], [73], [99], [109], [113], [126], [130], [160], [169] that is simultaneously more efficient than deterministic methods.…”