一句话：提出 BinCrypto，用区间域路径不敏感仿真做代码相似性分析，精准高效识别二进制中的密码函数。
二进制中的密码函数识别对恶意软件分析、区块链取证等安全应用至关重要，但现有方法难以兼顾准确率、效率与代码覆盖率。本文提出 BinCrypto，在区间域上进行基于仿真的代码相似性分析：它采集与行为相关的代码特征以保证准确性，同时以路径不敏感方式仿真，将值表示为区间，从而每个基本块仅分析一次，在提升效率的同时实现完整块覆盖。作者在九个真实密码库上评估，平均准确率达 83.2%，约为当前最优方法 WheresCrypto 的两倍，并成功完成静态链接库分析、跨库分析、混淆代码分析和恶意软件分析等任务，展示了实用潜力。
It becomes an essential requirement to identify cryptographic functions in binaries due to their widespread application in modern software. The technology fundamentally supports numerous software security analyses, such as malware analysis, blockchain forensics, etc. Unfortunately, the existing methods still struggle to strike a balance between analysis accuracy, efficiency, and code coverage, which hampers their practical application. In this paper, we propose BinCrypto, a method of emulation-based code similarity analysis on the interval domain, to identify cryptographic functions in binary files. It produces accurate results because it relies on the behavior-related code features collected during emulation. On the other hand, the emulation is performed in a path-insensitive manner, where the emulated values are all represented as intervals. As such, it is able to analyze every basic block only once, accomplishing the identification efficiently, and achieve complete block coverage simultaneously. We conduct the experiments with nine real-world cryptographic libraries. The results show that BinCrypto achieves the average accuracy of 83.2%, nearly twice that of WheresCrypto, the state-of-the-art method. BinCrypto is also able to successfully complete the tasks, including statically-linked library analysis, cross-library analysis, obfuscated code analysis, and malware analysis, demonstrating its potential for practical applications.
@article{paperbot3193,
title = {Binary Cryptographic Function Identification via Similarity Analysis with Path-Insensitive Emulation},
author = {Yikun Hu and Yituo He and Wenyu He and Haoran Li and Yubo Zhao and Shuai Wang and Dawu Gu},
journal = {Proceedings of the ACM on Programming Languages},
volume = {9},
number = {OOPSLA1},
year = {2025},
doi = {10.1145/3720415}
}