一句话：提出 BinStruct 框架，融合静态引用/调用模式与 LLM 语义，从二进制中恢复文件与模块两级结构。
传统二进制分析工具主要以函数为粒度，而现代二进制常含数千个函数，缺乏高层结构信息使逆向与下游分析既耗时又易错，但相关研究仍然有限。为此，作者提出 BinStruct：先结合数据引用模式、函数调用关系以及大语言模型提供的语义理解来识别文件结构；再借鉴源码分析中的软件架构恢复思想，依据结构依赖与语义相似度之间的一致性对已恢复文件进行聚类以得到模块结构。作者在 121 个真实世界 stripped 二进制上评估，结果表明 BinStruct 在文件与模块恢复准确率上均优于当前最优技术，且平均仅需 7.42 秒和 34.46 秒即可分别恢复文件与模块结构。在 Libxml2 与 PredatorTheStealer 上的案例研究进一步显示其在攻击面分析和恶意软件调查等安全任务中的实用价值。
Binary reverse engineering is foundational to various tasks such as malware analysis and vulnerability detection. Traditional binary analysis tools mainly operate at the function level. However, modern software has grown significantly in size, with binaries often containing thousands of functions. Without understanding how these functions are organized into higher-level structures, it becomes difficult to effectively support downstream analysis tasks. Analysts must examine thousands of functions separately, making the process time-consuming and error-prone. Despite these challenges, current research on recovering the higher-level structure of binaries remains limited.To bridge this gap, we propose BinStruct, a novel binary structure recovery framework that recovers both file and module structures from binaries. BinStruct first identifies the file structure by combining data reference patterns, function calls, and semantic understanding from Large Language Models. Then, inspired by software architecture recovery in source code analysis, BinStruct identifies modules by clustering the recovered files using consensus between structural dependency and semantic similarity. Evaluation on 121 real-world stripped binaries demonstrates that BinStruct outperforms state-of-the-art techniques in both file and module recovery accuracy, while requiring only 7.42s and 34.46s on average to recover file and module structures, respectively. Case studies on Libxml2 and PredatorTheStealer demonstrate BinStruct’s effectiveness on security tasks like attack surface analysis and malware investigation.
DOI 原文 ·
@inproceedings{paperbot9470,
title = {BinStruct: Binary Structure Recovery Combining Static Analysis and Semantics},
author = {Yiran Zhang and Zhengzi Xu and Zhe Lang and Chengyue Liu and Yuqiang Sun and Wenbo Guo and Chengwei Liu and Weisong Sun and Yang Liu},
booktitle = {ASE},
year = {2025},
doi = {10.1109/ase63991.2025.00060}
}