一句话：提出 Moye，利用寄存器约束与掩码语言模型识别单体固件中的函数边界，精度和召回率超过 97%。
单体固件因执行高效、结构简单而广泛用于资源受限设备，但其镜像不包含格式描述文件，给逆向工程带来挑战。函数识别是分析单体固件的前提，而现有方法严重依赖文件格式，难以适用。本文提出 Moye：先对固件分段、定位代码段并输出指令，再利用寄存器使用必须满足约束这一关键洞察，采用掩码语言模型学习指令间的隐藏关系，从而识别函数边界。作者在 1,318 个单体固件镜像（含 48 个来自广泛使用设备的样本）上评估，多数数据集精度超过 98%、召回率超过 97%，并对复杂编译选项表现出鲁棒性。
As embedded devices become increasingly popular, monolithic firmware, known for its execution efficiency and simplicity, is widely used in resource-constrained devices. Different from ordinary firmware, the monolithic firmware image is packed without the file that indicates its format, which challenges the reverse engineering of monolithic firmware. Function identification is the prerequisite of monolithic firmware's analysis. Prior works on function identification are less effectiveness when applied to monolithic firmware due to their heavy reliance on file formats. In this paper, we propose Moye, a novel method to identify functions in monolithic firmware. We leverage the important insight that the use of registers must conform to some constraints. In particular, our approach segments the firmware, locate code sections and output the instructions. We use a masked language model to learn hiding relationships among the instructions to identify the function boundaries. We evaluate Moye using 1,318 monolithic firmware images, including 48 samples collected from widely used devices. The evaluation demonstrates that our approach significantly outperforms current works, achieving a precision greater than 98 % and a recall rate greater than 97 % across most datasets, showing robustness to complicated compilation options.
DOI 原文 ·
@inproceedings{paperbot8832,
title = {Moye: A Wallbreaker for Monolithic Firmware},
author = {Jintao Huang and Kai Yang and Gaosheng Wang and Zhiqiang Shi and Zhiwen Pan and Shichao Lv and Limin Sun},
booktitle = {ICSE},
year = {2025},
doi = {10.1109/icse55347.2025.00053}
}