一句话：提出 DeLink 框架，从二进制中恢复源文件结构与文件名，提升逆向工程中的程序理解。
二进制逆向工程中，现有工作多关注指令翻译与函数名预测，难以从整体上理解程序；恢复源文件信息可作为高层程序摘要，但基于函数聚类的方法会包含分布不连续的函数，准确率低，且文件命名预测尚属空白。本文提出 DeLink：先基于边界定位恢复文件结构，识别二进制内的文件；再用编码器-解码器模型预测这些文件的名称。实验表明，文件结构恢复在六项指标上平均提升 14%，平均耗时 16.74 秒，在恢复质量与效率上均优于现有工作；文件名预测达到 70.09% 精确率与 63.91% 召回率。作者还展示了 DeLink 在恶意软件同源分析中的应用。
Program comprehension can help analysts understand the primary behavior of a binary and enhance the efficiency of reverse engineering analysis. The existing works focus on instruction translation and function name prediction. However, they are limited in understanding the entire program. The recovered source file information can offer insights into the primary behavior of a binary, serving as high-level program summaries. Nevertheless, the files recovered by the function clustering-based approach contain binary functions with discontinuous distributions, resulting in low accuracy. Additionally, there is no existing research related to predicting the names of these recovered files. To this end, we propose a framework for source file information recovery in binaries, DeLink. This framework first leverages a file structure recovery approach based on boundary location to recognize files within a binary. Then, it utilizes an encoder-decoder model to predict the names of these files. The experimental results show that our file structure recovery approach achieves an average improvement of 14% across six evaluation metrics and requires only an average time of 16.74 seconds, outperforming the state-of-the-art work in both recovery quality and efficiency. Additionally, our file name prediction model achieves 70.09% precision and 63.91% recall. Moreover, we demonstrate the effective application of DeLink in malware homology analysis.
@inproceedings{paperbot8540,
title = {DeLink: Source File Information Recovery in Binaries},
author = {Zhe Lang and Zhengzi Xu and Xiaohui Chen and Shichao Lv and Zhanwei Song and Zhiqiang Shi and Limin Sun},
booktitle = {ISSTA},
year = {2024},
doi = {10.1145/3650212.3680338}
}