一句话：提出概率反汇编方法，为每个地址估计其为真实指令的概率，在大量二进制上实现零漏报与低误报。
针对 stripped 二进制反汇编中代码与数据交织、间接跳转目标难解析导致现有工具误报和漏报的问题，本文提出概率反汇编：鉴于编译与代码生成造成信息丢失，反汇编不确定性不可避免，因而为代码空间中每个地址计算其为真实指令的概率。该概率由可达该地址的控制流与数据流特征计算得到。在 2000 多个二进制上的实验表明，方法实现 0 漏报、3.7% 误报；而先进 superset 反汇编误报达 85%。基于该反汇编的 rewriter 生成二进制大小约为前者一半且运行快 3%；即使无函数入口信息，仍可 0 漏报、6.8% 误报，而 IDA/BAP 会遗漏函数入口。
Disassembling stripped binaries is a prominent challenge for binary analysis, due to the interleaving of code segments and data, and the difficulties of resolving control transfer targets of indirect calls and jumps. As a result, most existing disassemblers have both false positives (FP) and false negatives (FN). We observe that uncertainty is inevitable in disassembly due to the information loss during compilation and code generation. Therefore, we propose to model such uncertainty using probabilities and propose a novel disassembly technique, which computes a probability for each address in the code space, indicating its likelihood of being a true positive instruction. The probability is computed from a set of features that are reachable to an address, including control flow and data flow features. Our experiments with more than two thousands binaries show that our technique does not have any FN and has only 3.7% FP. In comparison, a state-of-the-art superset disassembly technique has 85% FP. A rewriter built on our disassembly can generate binaries that are only half of the size of those by superset disassembly and run 3% faster. While many widely-used disassemblers such as IDA and BAP suffer from missing function entries, our experiment also shows that even without any function entry information, our disassembler can still achieve 0 FN and 6.8% FP.