一句话：提出 XLoc，用 LLM 将源码转为伪反编译表示并提取差异摘要验证，实现源码到二进制函数的确定性定位。
源码到二进制函数定位要求给定目标函数源码及所属包，判断其是否存在于去符号二进制并报告地址，但面临跨模态对齐与相似函数消歧两大挑战。本文提出 XLoc，一个“先召回后验证”框架：召回阶段用 LLM 将源码转为与反编译输出对齐的伪反编译表示，实现多阶段召回；验证阶段提取易混淆相似函数的差异摘要，引导验证聚焦区分性证据，输出确定的接受/拒绝判定而非相似度排序。在 196 个 CVE、480 个漏洞函数和 756 个二进制上，XLoc 定位准确率最高达 84.4%，为最优基线的 4.2 倍；正负判别 HM 达 87.1%，基线仅 35.1%。
Locating a known source function in a stripped binary is a prerequisite for many security and software engineering tasks, including Software Composition Analysis (SCA) false-positive elimination, patch presence verification, malware analysis, code plagiarism detection, and license compliance auditing. We formalize this need as source-to-binary function localization: given the source code of a target function and its encompassing source package, determine whether the function is present in a stripped binary and, if so, report its address. Two fundamental challenges arise: cross-modal alignment, as source code and stripped binary reside in vastly different representation spaces; and similar function disambiguation, as compilation erases the symbolic features that distinguish functionally similar functions. We present XLoc, a recall-then-verify framework built on two insights. First, cross-modal alignment does not require costly and error-prone compilation; it only demands token-level alignment, a process that can be reliably approximated. Second, the information needed to disambiguate similar functions is already available on the source side and can be extracted ahead of time to guide verification. Building on these insights, XLoc implements a multi-stage recall module in which an LLM transforms source code into pseudo-decompiled representations aligned with binary decompilation output, bridging the cross-modal gap. For verification, XLoc identifies potentially confusing similar functions, extracts differential summaries, and uses them to guide the verification process toward the specific distinguishing evidence for each candidate, producing definitive accept/reject verdicts rather than similarity rankings. We evaluate XLoc on two complementary datasets spanning 196 CVEs, 480 vulnerable functions, and 756 binaries. XLoc achieves up to 84.4% localization accuracy (4.2× over the best baseline) and HM=87.1% for positive/negative discrimination (vs. 35.1% for the best baseline). These results demonstrate that XLoc can locate target functions with high accuracy, reliably discriminate between positive and negative cases, and produce definitive verdicts.
@article{paperbot12163,
title = {From Similarity Ranking to Definitive Verdict: LLM-Enhanced Source-to-Binary Function Localization},
author = {Jingyi Shi and Chengyue Liu and Zhengzi Xu and Yang Xiao and Xingchu Chen and Yeting Li and Wei Huo and Yang Liu},
journal = {Proceedings of the ACM on Programming Languages},
volume = {10},
number = {OOPSLA2},
year = {2026},
doi = {10.1145/3839539}
}