一句话：提出 DIReducer，从二进制调试信息中削减源代码信息，同时保持内存缺陷检测能力。
软件供应商在让第三方审计内存安全时，常需披露源代码，这带来知识产权泄露风险。论文提出在透明性与代码隐私间折中的方案：从非 strip 二进制中提取调试信息并尽量削减，同时保证其仍足以支持内存缺陷检测。DIReducer 包含选择性剪枝与类型最小化，后者被证明为 NP-hard，并通过归约到集合覆盖问题获得近似最优解。实验表明，该方法可减少约 95% 调试信息，而缺陷检测能力与使用完整调试信息或源代码相近。
When proving to a third party that a software system is free from critical memory bugs, software vendors often face the problem of having to reveal their source code, so that the third party can scan the source code using static analysis tools. However, such transparency poses a significant threat to vendors, as the source code typically contains proprietary algorithms, core technical innovations, or trade secrets, exposing them to potential intellectual property risks. In this paper, we present a solution that offers a balance between transparency and code privacy, allowing software vendors to provide minimal source code information while justifying the sufficiency of bug detection. To this end, we propose DIReducer, which reduces source code information, a.k.a. debug information, from non-stripped binaries while preserving its utility for memory bug detection. DIReducer consists of two components: selective pruning and type minimization. The former eliminates redundant debug information, and the latter is proven to be NP-hard and minimizes type-related debug information by reducing it to the classic set-cover problem, which offers a near-optimal solution. Experimental results show that we can reduce 95% of debug information while maintaining similar bug detection capability compared to using full debug information or the source code.
DOI 原文 ·
@inproceedings{paperbot9228,
title = {Protecting Source Code Privacy When Hunting Memory Bugs},
author = {Jielun Wu and Bing Shui and Hongcheng Fan and Shengxin Wu and Rongxin Wu and Yang Feng and Baowen Xu and Qingkai Shi},
booktitle = {ASE},
year = {2025},
doi = {10.1109/ase63991.2025.00107}
}