一句话：提出Lares，用LLM与SMT从补丁源码向目标二进制伪代码做代码切片语义搜索，实现免编译的补丁存在性测试。
在现代软件生态中，代码复用使1-day漏洞风险突出；仅识别目标二进制中的脆弱函数不足，还需判断其是否已被修补。现有补丁存在性测试方法可用性和准确性有限：常依赖编译过程提取特征，需大量人工且对部分软件失效，也难以区分补丁修改与编译差异。为此，作者提出Lares，其核心为代码切片语义搜索：直接从补丁源码提取特征，并在目标二进制伪代码中寻找语义等价的代码切片；通过免编译提升可用性，并利用大语言模型进行代码分析、SMT求解器进行逻辑推理以提高准确性。实验表明，Lares在精确率、召回率和可用性上更优，且首次跨优化级别、体系结构和编译器评估补丁存在性测试。
In modern software ecosystems, 1-day vulnerabilities pose significant security risks due to extensive code reuse. Identifying vulnerable functions in target binaries alone is insufficient; it is also crucial to determine whether these functions have been patched. Existing methods, however, suffer from limited usability and accuracy. They often depend on the compilation process to extract features, requiring substantial manual effort and failing for certain software. Moreover, they cannot reliably differentiate between code changes caused by patches or compilation variations.To overcome these limitations, we propose Lares, a scalable and accurate method for patch presence testing. Lares introduces Code Slice Semantic Search, which directly extracts features from the patch source code and identifies semantically equivalent code slices in the pseudocode of the target binary. By eliminating the need for the compilation process, Lares improves usability, while leveraging large language models (LLMs) for code analysis and SMT solvers for logical reasoning to enhance accuracy. Experimental results show that Lares achieves superior precision, recall, and usability. Furthermore, it is the first work to evaluate patch presence testing across optimization levels, architectures, and compilers. The datasets and source code used in this article are available at https://github.com/Siyuan-Li201/Lares.
DOI 原文 ·
@inproceedings{paperbot9340,
title = {Lares: LLM-driven Code Slice Semantic Search for Patch Presence Testing},
author = {Siyuan Li and Yaowen Zheng and Hong Li and Jingdong Guo and Chaopeng Dong and Chunpeng Yan and Weijie Wang and Yimo Ren and Limin Sun and Hongsong Zhu},
booktitle = {ASE},
year = {2025},
doi = {10.1109/ase63991.2025.00081}
}