一句话：提出 DALEQ，将 Java 字节码反汇编为关系数据库并用 Datalog 规则归一化，可解释地判定重建二进制等价性。
软件构建安全事件促使企业重建开源项目并发布二进制，但重建产物与原二进制常非逐位相同，需判定其是否因构建环境差异而仍等价；现有工具缺乏来源说明，即无法解释等价与否的原因。DALEQ 将 Java 字节码反汇编为关系数据库，并应用 Datalog 规则归一化，再据此推断两个类之间的等价性，同时输出记录归一化过程的 Datalog 证明。作者在工业场景中评估 2,714 对 jar、265,690 对类，并与两个既有字节码变换工具比较。结果显示，DALEQ 显著减少人工审查非逐位等价产物的工作量，并能识别更多由同一代码重建的等价产物，即使不存在行为差异时也优于已有工具。
The security of software builds has attracted increased attention in recent years in response to incidents like solarwinds and xz. Now, several companies including Oracle and Google rebuild open source projects in a secure environment and publish the resulting binaries through dedicated repositories. This practice enables direct comparison between these rebuilt binaries and the original ones produced by developers and published in repositories such as Maven Central. These binaries are often not bitwise identical; however, in most cases, the differences can be attributed to variations in the build environment, and the binaries can still be considered equivalent. Establishing such equivalence, however, is a labor-intensive and error-prone process.While there are some tools that can be used for this purpose, they all fall short of providing provenance, i.e. readable explanation of why two binaries are equivalent, or not. To address this issue, we present daleq, a tool that disassembles Java byte code into a relational database, and can normalise this database by applying datalog rules. Those databases can then be used to infer equivalence between two classes. Notably, equivalence statements are accompanied with datalog proofs recording the normalisation process. We demonstrate the impact of daleq in an industrial context through a large-scale evaluation involving 2,714 pairs of jars, comprising 265,690 class pairs. In this evaluation, daleq is compared to two existing bytecode transformation tools. Our findings reveal a significant reduction in the manual effort required to assess non-bitwise equivalent artifacts, which would otherwise demand intensive human inspection. Furthermore, the results show that daleq outperforms existing tools by identifying more artifacts rebuilt from the same code as equivalent, even when no behavioral differences are present.
DOI 原文 ·
@inproceedings{paperbot9510,
title = {DALEQ - Explainable Equivalence for Java Bytecode},
author = {Jens Dietrich and Behnaz Hassanshahi},
booktitle = {ASE},
year = {2025},
doi = {10.1109/ase63991.2025.00300}
}