一句话：将去符号二进制函数名恢复重构为证据驱动的语义状态迭代更新，用多智能体混合静态与动态证据提升跨架构恢复效果。
二进制函数名恢复对理解去符号二进制至关重要，但现有学习式方法难以捕获过程间上下文与复杂控制流，易产生语义歧义，且依赖静态分析与固定训练分布，跨异构架构与未见二进制泛化能力差。本文提出 HyBinMAS，把函数名恢复重构为证据驱动的语义状态更新过程：为每个目标函数维护 ⟨name, summary⟩ 语义状态，并利用静态证据、过程间语义传播与动态证据迭代精化。方法引入带属性的调用图（ACG）作为有状态语义记忆，并结合运行时反馈验证与纠正语义假设，通过 SemanticRestorer、TestGenerator、ExecutionValidator 组成的协作多智能体工作流，完成语义假设生成、可执行验证与行为反馈解释。作者构建了含 8000 余个二进制函数的 ARM-64 基准。在五种架构上的实验表明，HyBinMAS 平均 F1 达 0.343，较最强基线提升 39.43%；在受控子集上，引入执行证据相比纯静态分析带来 18.14% 的 F1 提升，显示动态反馈对语义状态更新的互补价值。
Binary function name recovery is vital for understanding stripped binaries, yet existing learning-based methods face significant hurdles. Current approaches often struggle to capture inter-procedural context and complex control flows, leading to semantic ambiguity. Furthermore, their reliance on static analysis and fixed training distributions severely limits their generalization across heterogeneous architectures and unseen binaries. In this paper, we propose a novel approach HyBinMAS that reformulates binary function name recovery as an evidence-driven semantic-state update process with LLM-Powered hybrid analysis. For each target function, HyBinMAS maintains a semantic state ⟨ name, summary ⟩ and iteratively refines it using static evidence, inter-procedural semantic propagation, and dynamic evidence. Specifically, it introduces an Attributed Call Graph (ACG) as a stateful semantic memory and incorporates runtime feedback to validate and correct semantic hypotheses. It further employs a collaborative multi-agent workflow, consisting of SemanticRestorer, TestGenerator, and ExecutionValidator to realize the state updates through semantic hypothesis generation, executable validation, and behavioral feedback interpretation. To address the lack of ARM-64 datasets, we construct an ARM-64 Benchmark comprising over 8,000 binary functions. Extensive experiments across five architectures demonstrate that HyBinMAS consistently outperforms existing approaches, achieving an average F1 score of 0.343 and improving the F1 score by 39.43% over the strongest baseline. Moreover, on a controlled subset, incorporating execution-grounded evidence yields an 18.14% F1 improvement over static-only analysis, demonstrating the complementary value of dynamic feedback for semantic-state update.
@inproceedings{paperbot12285,
title = {HyBinMAS: LLM-Powered Hybrid Analysis for Function Name Recovery of Stripped Binaries},
author = {Chenxi Wang and Lei Xu and Xincheng He and Gaozhan Yu and Ye Wang},
booktitle = {ASE},
year = {2026},
doi = {10.1145/3832783.3837532}
}