Mamba-based binary function identification method for embedded devices

Abstract

The application belongs to the field of binary code analysis, and specifically relates to a binary function identification method based on Mamba for embedded devices, which performs disassembly and fine-grained tokenization on solid binary; a general model is obtained by pre-training the Mamba model using a large amount of unlabeled solid instruction sequences; and the general model is fine-tuned using a new data set with function boundary annotation information to determine whether it is the boundary of a binary function. The key improvement of the application is that the Mamba architecture with linear computational complexity is used to replace the traditional Transformer, which significantly improves the speed of processing long instruction sequences and reduces memory overhead while ensuring recognition accuracy, thereby making it possible to automatically and real-time perform security audit and vulnerability analysis on a large amount of embedded solids.

Description

Technical Field

[0001] This application belongs to the field of binary code analysis, specifically relating to a Mamba-based binary function identification method for embedded devices. Background Technology

[0002] In embedded devices, software typically exists in the form of firmware, which is binary code written into the hardware read-only memory during manufacturing. Compared to general-purpose software, analyzing embedded firmware presents unique challenges: its code is usually stripped of all symbols and debugging information after compilation, and the firmware itself can be enormous (several MB to hundreds of MB) with diverse instruction set architectures (such as ARM and MIPS).

[0003] Function identification—that is, locating the start and end boundaries of functions in binary code without unsigned information—is a crucial and primary step in understanding firmware logic and performing subsequent security analysis. This is because functions, as logical blocks, play a vital role in understanding high-level semantics from low-level binary files. In this regard, most binary analysis tools (such as BAP, BitBlaze, angr, radare, IDA Pro, Ghidra, and rev.ng) typically require function boundary detection by default for further analysis. Similarly, many other tasks can be performed at the function level, including but not limited to control flow integrity (CFI), binary similarity analysis, binary instrumentation (such as code randomization or re-optimization), type inference, and vulnerability detection.

[0004] Previous research has explored the use of machine learning (ML) for function identification, but current ML-based methods still face two key challenges: First, insufficient binary feature representation. Existing methods employ byte encoding, applying simple encoding rules to the raw bytes of each instruction and then feeding the encoded instruction into a neural network model. While simple and effective, these methods do not provide semantic information about the instructions. Second, current state-of-the-art methods in binary analysis primarily employ the Transformer architecture, which computes the internal correlations of sequences through a quadratic complexity self-attention mechanism. This results in significant computational and memory overhead when processing long sequences, making the models unsuitable for real-time online function identification scenarios and unable to operate efficiently under the limited resources of typical network devices. Summary of the Invention

[0005] To overcome the shortcomings of the existing technologies, this invention provides a Mamba-based binary function recognition method for embedded devices. It specifically selects and improves upon unidirectional Mamba to replace Transformer, thus solving the efficiency problem. Furthermore, it employs a deep learning representation learning method to automatically map each assembly instruction into a vector representation, which is then input into the downstream model. By constructing a technical framework of "fine-grained representation - self-supervised pre-training - targeted fine-tuning," efficient and automated function recognition for large-scale firmware is achieved.

[0006] The technical solution adopted in this invention is:

[0007] A Mamba-based binary function identification method for embedded devices includes the following steps:

[0008] S1. Instruction Sequence Normalization: Obtain the binary program of the embedded device firmware, obtain its assembly instruction sequence through a disassembler, perform fine-grained markup processing on the instructions to generate a sequence consisting of opcodes, registers, and immediate value markers; and replace the strings and constant values ​​in the sequence with predefined special markers.

[0009] S2. Masked Autoencoder Model Pre-training: The masked autoencoder consists of an encoder and a decoder. The encoder uses assembly instruction sequences extracted from massive unlabeled embedded solids to perform self-supervised pre-training on the model. By minimizing the reconstruction loss of the masked labels, it outputs the corresponding latent semantic representation. The decoder takes the visible label representation and masked labels output by the encoder as input and reconstructs the original masked labels.

[0010] S3, Function Recognition Fine-tuning: Replace the decoder of the pre-trained mask autoencoder with a classifier, and use labeled data with function boundary labels to perform supervised fine-tuning of the model to obtain a special model that can determine whether an assembly instruction is a function boundary.

[0011] S4. Boundary prediction: After processing the stripped embedded solid binary file to be identified in step S1, it is input into the fine-tuned model, and the classifier outputs the function boundary prediction result.

[0012] Preferably, a binary dataset is constructed from the embedded device solid-state, the function start address and end address are obtained from the symbol table of the collected binary code, the assembly code instruction sequence is disassembled by the Ghidra disassembler, and the function boundary is marked on an instruction-by-instruction basis, that is, it is determined whether the assembly instruction is the start of a function, the end of a function, or a non-function boundary.

[0013] Preferably, in step S1, a predefined special marker is used for replacement, specifically: using<str>Mark the replacement string, use <const>The constant values ​​are replaced by markers, thereby normalizing the assembly code, representing the key content in the binary code, and reducing the size of the vocabulary.

[0014] Preferably, the binary assembly instructions are serialized and normalized to construct the input sequence of the masked autoencoder model. Specific steps include:

[0015] S101. Fine-grained tokenization: Treat each instruction as a sentence and break it down into tokens;

[0016] S102. Special Marker Normalization: Using special markers <str>Replace string literals in the replacement instruction; use special flags <const>Replace constant values ​​in replacement instructions;

[0017] S103. Sequence Encapsulation and Embedding: Add a learnable category tag to the end of the normalized instruction tag sequence. <cls>This is used to subsequently aggregate the semantic information of the entire sequence;

[0018] S104. Through a learnable linear projection layer, each tag is mapped to a fixed-dimensional vector representation, and positional embedding information is incorporated to preserve the order relationship in the sequence, ultimately resulting in an embedded tag vector sequence. The input is fed into the mask autoencoder model.

[0019] Preferably, the encoder includes four stacked unidirectional Mamba modules; the decoder includes two unidirectional stacked Mamba modules; the forward propagation computation flow of the Mamba modules is as follows: for the (t-1)th Mamba module, the output sequence is an input tag sequence of length L. Normalization is performed sequentially, and an intermediate vector x and a gated vector z are generated through linear projection. A causal one-dimensional convolution is then performed on x to obtain... ,based on Calculate the parameters of Mamba's state-space models (SSMs) B and C, using parameters The parameters A and B of the state-space model SSMs are discretized. The intermediate output y is calculated using the SSMs. After gating the intermediate output y with the gating vector z, it is then compared with the input. Perform residual joins to finally output the tag sequence of the t-th Mamba module. .

[0020] Preferably, Mamba introduces a selection mechanism that enables the masked autoencoder model to dynamically select relevant information from the context by adjusting the parameters of its state-space model (SSM). , and Convert to input The function achieves adaptation, specifically: SSMs are constructed as linear ordinary differential equations, and intermediate latent states are used to achieve this. Input sequence Mapping to output sequence :

[0021] ;

[0022] ;

[0023] in, For state evolution parameters, and These are the input and output projection parameters, respectively, where N is the dimension;

[0024] Discretization:

[0025] ;

[0026] ;

[0027] in, and For discretization parameters, Indicates the discretization step size;

[0028] SSMs are converted to the following convolutional form:

[0029] ;

[0030] ;

[0031] in Represented as input sequence Length, This represents the convolution operation. For structured convolution kernels, This is an intermediate output.

[0032] Preferably, the pre-training employs a masked language model task, aiming to enable the model to learn general semantic representations of binary instructions, specifically including:

[0033] S201 Random Mask: Given a token embedding vector Randomly mask a certain percentage of words in the instruction sequence; the masked words will be marked with a mask. <mask>The tail category tag always serves to aggregate global sequence information and remains unmasked throughout the process.

[0034] S202 Mask Pre-training: The encoder only processes visible, unmasked instruction tag sequences. The output vector is obtained through the forward propagation process of the Mamba module. The decoder receives the encoder's output. and mask mark To reconstruct the original masked label, the goal of pre-training is to minimize the mean squared error loss between the reconstructed label and the original masked label.

[0035] Preferably, step S3 involves function identification and fine-tuning:

[0036] All encoder parameters are loaded from the pre-training stage, and all embedded instruction tokens are visible to the encoder. At the encoder output, only the end of the sequence is extracted. <cls>Label the corresponding feature vector; label the tail. <cls>The input is fed into an MLP-based classifier and fine-tuned using supervised learning. The specific process is as follows:

[0037] ;

[0038] ;

[0039] in, To label the embedding vector, Indicates the tail category tag, Let S represent the predicted distribution, where S is the number of categories, corresponding to the predicted probability distributions of the three categories: "function start point," "function end point," and "non-function boundary point," respectively. The goal is to minimize this predicted distribution. With real labels The classification process is optimized using cross-entropy loss.

[0040] .

[0041] Compared with the prior art, the beneficial effects of this application are as follows:

[0042] (1) Achieving efficient long sequence processing with linear complexity. Existing Transformer-based methods rely on quadratic complexity. The self-attention mechanism of [the original text is incomplete and requires further context to translate accurately] leads to a sharp increase in computational and memory overhead when processing long sequences. This invention employs a Mamba architecture based on a state-space model, with a core computational complexity of [the original text is incomplete and requires further context to translate accurately]. It can efficiently process large-scale binary instruction sequences.

[0043] (2) More suitable for resource-constrained environments. Transformer training and optimization require a large amount of memory. Mamba, through recursive state updates and convolution parallelization design, significantly reduces the memory usage during training and inference. It can improve the inference speed by 1-2 orders of magnitude and reduce memory usage by about 30%-60%. It is suitable for deployment in network devices with limited memory resources, embedded security terminals or mobile analysis platforms to achieve real-time, online analysis of function boundaries of massive binary code.

[0044] (3) Enhance analytical capabilities in security-critical scenarios. Accurately restored function boundaries are the cornerstone of firmware security analysis. Binary function identification plays a crucial role in network security, such as in vulnerability discovery and exploitation analysis. Binary function identification is the foundation for security analyses such as vulnerability discovery and malicious code detection. For example, by comparing function-level differences between patched and unpatched binary files, key modification points can be accurately located, thereby understanding the vulnerability principles and attack patterns. In embedded device security research, firmware is usually released in symbol-stripped binary form, lacking source code and debugging information. This invention, by restoring its function boundaries, provides a crucial structured starting point for subsequent advanced analyses such as control flow reconstruction, vulnerability location, and malicious code screening, thereby significantly improving the automation level and reliability of reverse engineering and security assessment. Attached Figure Description

[0045] Figure 1 This refers to the Mamba module in this embodiment of the invention;

[0046] Figure 2 The pre-training phase workflow for binary function recognition using Mamba in this invention;

[0047] Figure 3 Fine-tuning phase workflow for binary function recognition in Mamba;

[0048] Figure 4 This is a flowchart of the application process. Detailed Implementation

[0049] The present invention will be further described below with reference to the accompanying drawings and embodiments.

[0050] It should be noted that the following detailed descriptions are illustrative and intended to provide further explanation of this application. Unless otherwise specified, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application pertains.

[0051] It should be noted that the terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the exemplary embodiments according to this application. As used herein, the singular form is intended to include the plural form as well, unless the context clearly indicates otherwise. Furthermore, it should be understood that when the terms "comprising" and / or "including" are used in this specification, they indicate the presence of features, steps, operations, devices, components, and / or combinations thereof.

[0052] Figure 4 As shown, a Mamba-based binary function identification method for embedded devices includes the following steps:

[0053] S1. Instruction Sequence Normalization: Obtain the binary program of the embedded device firmware, obtain its assembly instruction sequence through a disassembler, perform fine-grained markup processing on the instructions to generate a sequence consisting of opcodes, registers, and immediate value markers; and replace the strings and constant values ​​in the sequence with predefined special markers.

[0054] S2. Masked Autoencoder Pre-training: The masked autoencoder consists of an encoder and a decoder. The encoder performs self-supervised pre-training on the model using assembly instruction sequences extracted from massive amounts of unlabeled embedded solids. By minimizing the reconstruction loss of the masked labels, it outputs the corresponding latent semantic representation. The decoder takes the visible label representation and the masked labels output by the encoder as input and reconstructs the original masked labels.

[0055] S3, Function Recognition Fine-tuning: Replace the decoder of the pre-trained mask autoencoder with a classifier, and use labeled data with function boundary labels to perform supervised fine-tuning of the model to obtain a special model that can determine whether an assembly instruction is a function boundary.

[0056] S4. Boundary prediction: After processing the stripped embedded solid binary file to be identified in step S1, it is input into the fine-tuned model, and the classifier outputs the function boundary prediction result.

[0057] The function identification problem aims to find a set of (binary) functions, including i) the start of the function and ii) the boundaries (start and end) of the function, without the availability of symbols or debugging information.

[0058] Assuming bytes use letters If the entire binary code consists of n bytes, then it can be represented as { , , ..., }. Suppose a code segment contains k functions, and its start and end can be represented as ( , The following two tasks are defined: i) Function starting point identification; finding the set of starting points for all functions: { , , ..., }, and ii) Function boundary identification; find the set of boundaries for all functions: {( , ), ...,( , )}.

[0059] This embodiment constructs a binary dataset collected from embedded device solid-state drives. This dataset contains binary ELF files compiled from devices such as routers and switches. Since the binary program contains a symbol table without the '-s' compilation option, and this symbol table includes the names of all functions, their start and end addresses, this invention obtains the function start and end addresses from the symbol table using the collected binary code to obtain accurate function boundary truths. The assembly code instruction sequence is then obtained using the Ghidra disassembler, and function boundaries are marked on an instruction-by-instruction basis, classifying assembly instructions as either function start, function end, or non-function boundary—a total of three categories.

[0060] Before introducing the Mamba model architecture for binary function recognition, let's first explain the basic definitions, terminology, and core components involved in the Mamba module within that architecture. The Mamba module is as follows: Figure 1 As shown.

[0061] State-space models: As a core component of Mamba, state-space models (SSMs) are an emerging class of sequence models in deep learning, widely related to recurrent neural networks (RNNs) and convolutional neural networks (CNNs). Inspired by continuous systems, SSMs are typically constructed as linear ordinary differential equations (ODEs), using intermediate latent states. Input sequence Mapping to output sequence .

[0062] (1);

[0063] (2);

[0064] in, For state evolution parameters, and These are the input and output projection parameters, respectively.

[0065] Discretization: Combining original state-space models (SSMs) with deep learning presents significant challenges—real-world data typically exhibits discrete characteristics, while SSMs possess continuous-time properties. To overcome this challenge, the zero-order hold (ZOH) technique is employed for discretization, resulting in the following discretized version:

[0066] (3);

[0067] (4);

[0068] in, and For discretization parameters, This represents the discretization step size. By expanding the above formula, SSMs can be transformed into the following convolutional form:

[0069] (5);

[0070] (6);

[0071] in Represented as input sequence Length, This represents the convolution operation. This is a structured convolution kernel. This convolution representation solves the computational parallelization dilemma inherent in the recursive version.

[0072] Selection Mechanism: Despite being designed specifically for sequence modeling, state-space models (SSMs) perform poorly in scenarios requiring content-aware reasoning, primarily due to their time-invariant properties. Specifically, parameters... , and The sequence remains constant across all input labels. To address this issue, Mamba introduces a selection mechanism that allows the model to dynamically select relevant information from the context.

[0073] This mechanism uses SSMs parameters , and Convert to input The adaptive mechanism is achieved through a function. Furthermore, a GPU-friendly implementation was designed to support efficient computation of the selection mechanism, significantly reducing memory I / O operations and eliminating the need for intermediate state storage.

[0074] The following describes the Mamba model architecture for binary function recognition, as well as its pre-training and fine-tuning strategies. The overall structure is as follows: Figure 2 and Figure 3 As shown.

[0075] Instruction serialization and model input construction. First, the binary assembly instructions are serialized and normalized to construct the input sequence of the model. The specific steps include: (1) Fine-grained tokenization: Each instruction is treated as a sentence and decomposed into tokens (words). For example, for the instruction "mov rax, qword [rsp+0x58]", it is decomposed into "mov", "rax", "qword", "[", "rsp", "+", "]" and numerical constant tokens. (2) Special token normalization: In order to compress the vocabulary size and enhance the generalization ability of the model, specific types of tokens are uniformly replaced. Specifically: special tokens are used. <str>Replace string literals in the replacement instruction; use special flags <const>Replace the constant value in the instruction (such as 0x58 in the example above). After this processing, the final token sequence corresponding to the above example instruction is: "mov", "rax", "qword", "[", "rsp", "+", " <const>"and"]" (3) Sequence encapsulation and embedding. A learnable category tag is added to the end of the normalized instruction tag sequence. <cls>This is used to aggregate the semantic information of the entire sequence. Then, a learnable linear projection layer maps each tag to a fixed-dimensional vector representation, incorporating positional embedding information to preserve the order relationships within the sequence. The final result is a sequence of embedded tag vectors. Input it into the model.

[0076] Model Structure: The network structure described in this embodiment is a masked autoencoder, including: Encoder: Composed of four stacked unidirectional Mamba modules, it receives the visible tag sequence after random masking and outputs the corresponding latent semantic representation. Decoder: Composed of two stacked unidirectional Mamba modules, its input is the visible tag representation output by the encoder and the mask tag, and its task is to reconstruct the masked original tag. The computation flow of the forward propagation of the Mamba module is shown in Table 1. For the input tag sequence with a sequence length of L output by the (t-1)th Mamba module... Normalization is performed sequentially, and an intermediate vector x and a gated vector z are generated through linear projection. A causal one-dimensional convolution is then performed on x to obtain... ,based on calculate B and C. Use The parameters A and B of the state-space model SSMs are discretized. The intermediate output y is calculated using the SSMs. After gating y and z, it is compared with the input. Perform residual joins to finally output the tag sequence of the t-th Mamba module. .

[0077] Table 1. Forward Propagation Flow of Mamba Module

[0078] .

[0079] Pre-training phase: Pre-training adopts the masked language model task, which aims to enable the model to learn general semantic representations from massive unlabeled solid instructions. (1) Random mask, given the input embedding sequence Randomly mask a certain percentage of words in the instruction sequence; the masked words will be marked with a mask. <mask>Replacement. First, randomly select 15% of the words for replacement: of which 80% are replaced... <mask>Replacement: 10% is replaced with other lexical units (interference lexical units) in the vocabulary, and the remaining 10% remains unchanged. It should be noted that, in order to ensure that the tail category tag always plays the role of aggregating global sequence information, it remains unmasked throughout this process. (2) Masking pre-training. The encoder only processes the visible unmasked instruction tag sequence. The output vector is obtained through the forward propagation process of the Mamba module. The decoder receives the encoder's output. and mask mark The goal of pre-training is to reconstruct the original masked label.

[0080] Fine-tuning: The fine-tuning phase aims to adapt the pre-trained model to the specific downstream task of function boundary recognition. The decoder portion of the pre-trained model is removed, and all encoder parameters (including embedding and Mamba modules) are loaded from the pre-training phase. All embedded instruction tokens are visible to the encoder. At the encoder output, only the end of the sequence is extracted. <cls>Label the corresponding feature vectors. To recover the function boundary category, replace the decoder with the MLP (Multilayer Perceptron) head and label the tail. <cls>The input is fed into an MLP-based classifier. Fine-tuning is performed using supervised learning, with the specific process as follows:

[0081] (7);

[0082] (8);

[0083] in, To label the embedding vector, Indicates the tail category tag, Let S represent the prediction distribution, where S is the number of categories (3), corresponding to the predicted probability distributions for the three categories: "function start point," "function end point," and "non-function boundary point," respectively. The goal is to minimize this prediction distribution. With real labels The classification process is optimized using cross-entropy loss.

[0084] (9);

[0085] Implementation: (1) Build the model using PyTorch. (2) Pre-training settings: Set the batch size to Batch=128 and train for 10 epochs. Use the AdamW optimizer with an initial learning rate of 1.0×10⁻³ and a linear learning rate scaling strategy. (3) Fine-tuning settings: Adjust the batch size to Batch=64 and the learning rate to 2.0×10⁻³. Divide the dataset into training and test sets in a 7:3 ratio. Train all models on the training data for 30 epochs and evaluate them on the test set.

[0086] System Deployment:

[0087] A Mamba-based binary function recognition system for embedded devices, the system comprising a data preprocessing module, a training module, and a testing module;

[0088] Data preprocessing module: Constructs a binary dataset collected from the embedded device solid-state, disassembles the obtained assembly code instruction sequence using the Ghidra disassembler, and marks function boundaries on an instruction-by-instruction basis, that is, determines whether the assembly instruction is the start of a function, the end of a function, or a non-function boundary;

[0089] The training module includes random masks and mask pre-training:

[0090] The training module uses a masked language model task for pre-training, aiming to enable the model to learn general semantic representations of binary instructions. A random mask is provided, given an input embedding sequence. Randomly mask a certain percentage of words in the instruction sequence; the masked words will be marked with a mask. <mask>During the replacement process, the tail category tag always assumes the function of aggregating global sequence information and remains unmasked throughout the process.

[0091] Masked pre-training: The encoder only processes visible, unmasked instruction tag sequences. The output vector is obtained through the forward propagation process of the Mamba module. The decoder receives the encoder's output. and mask mark To reconstruct the original masked label, the goal of pre-training is to minimize the mean squared error loss between the reconstructed label and the original masked label;

[0092] The testing module processes the binary instruction sequence to be identified and inputs it into the fine-tuned model, which then outputs the function boundary prediction results from the classifier.

[0093] Although embodiments of this application have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and variations can be made to these embodiments without departing from the principles and spirit of this application, the scope of which is defined by the appended claims and their equivalents.< / mask> < / cls> < / cls> < / mask> < / mask> < / cls> < / const> < / const> < / str> < / cls> < / cls> < / mask> < / cls> < / const> < / str> < / const> < / str>

Claims

1. A Mamba-based binary function recognition method for embedded devices, characterized in that, include: S1. Instruction Sequence Normalization: Obtain the binary program of the embedded device firmware, obtain its assembly instruction sequence through a disassembler, perform fine-grained markup processing on the instructions to generate a sequence consisting of opcodes, registers, and immediate value markers; and replace the strings and constant values ​​in the sequence with predefined special markers. S2. Masked Autoencoder Model Pre-training: The masked autoencoder includes an encoder and a decoder; the encoder uses assembly instruction sequences extracted from massive unlabeled embedded solids to perform self-supervised pre-training on the model, and outputs the corresponding latent semantic representation by minimizing the reconstruction loss of the masked labels. The decoder input consists of the visible marker representation and the mask marker output by the encoder, which are used to reconstruct the original masked marker. The encoder consists of four stacked unidirectional Mamba modules; the decoder consists of two unidirectional stacked Mamba modules; the forward propagation computation flow of the Mamba modules is as follows: for the (t-1)th Mamba module, the output sequence is an input tag sequence of length L. Normalization is performed sequentially, and an intermediate vector x and a gated vector z are generated through linear projection. A causal one-dimensional convolution is then performed on x to obtain... ,based on Calculate the parameters of Mamba's state-space models (SSMs) B and C, using parameters The parameters A and B of the state-space model SSMs are discretized. The intermediate output y is calculated using the SSMs. After gating the intermediate output y with the gating vector z, it is then compared with the input. Perform residual joins to finally output the tag sequence of the t-th Mamba module. ; Mamba introduces a selection mechanism that enables masked autoencoder models to dynamically select relevant information from the context by adjusting the parameters of their state-space models (SSMs). , and Convert to input The function achieves adaptation, specifically: SSMs are constructed as linear ordinary differential equations, and intermediate latent states are used to achieve this. Input sequence Mapping to output sequence : ； ； in, For state evolution parameters, and These are the input and output projection parameters, respectively, where N is the dimension; Discretization: ； ； in, and For discretization parameters, Indicates the discretization step size; SSMs are converted to the following convolutional form: ； ； in Represented as input sequence Length, This represents the convolution operation. For structured convolution kernels, For intermediate output; S3, Function Recognition Fine-tuning: Replace the decoder of the pre-trained mask autoencoder with a classifier, and use labeled data with function boundary labels to perform supervised fine-tuning of the model to obtain a special model that can determine whether an assembly instruction is a function boundary. S4. Boundary prediction: After processing the stripped embedded solid binary file to be identified in step S1, it is input into the fine-tuned model, and the classifier outputs the function boundary prediction result.

2. The Mamba-based binary function recognition method for embedded devices according to claim 1, characterized in that, Construct a binary dataset collected from embedded device solid-state devices, obtain the function start and end addresses from the symbol table of the collected binary code, disassemble the obtained assembly code instruction sequence using the Ghidra disassembler, and mark the function boundaries on an instruction-by-instruction basis, that is, determine whether the assembly instruction is the start of a function, the end of a function, or a non-function boundary.

3. The Mamba-based binary function recognition method for embedded devices according to claim 1, characterized in that, In step S1, a predefined special marker is used for replacement, specifically: using <str>Mark the replacement string, use <const> The constant values ​​are replaced by markers, thereby normalizing the assembly code, representing the key content in the binary code, and reducing the size of the vocabulary.< / const> < / str> 4. The Mamba-based binary function recognition method for embedded devices according to claim 1, characterized in that, The binary assembly instructions are serialized and normalized to construct the input sequence for the masked autoencoder model. Specific steps include: S101. Fine-grained tokenization: Treat each instruction as a sentence and break it down into tokens; S102. Special Marker Normalization: Using special markers <str>Replace string literals in the replacement instruction; use special flags <const> Replace constant values ​​in replacement instructions;< / const> < / str> S103. Sequence Encapsulation and Embedding: Add a learnable category tag to the end of the normalized instruction tag sequence. <cls> This is used to subsequently aggregate the semantic information of the entire sequence;< / cls> S104. Through a learnable linear projection layer, each tag is mapped to a fixed-dimensional vector representation, and positional embedding information is incorporated to preserve the order relationship in the sequence, ultimately resulting in an embedded tag vector sequence. The input is fed into the mask autoencoder model.

5. The Mamba-based binary function recognition method for embedded devices according to claim 4, characterized in that, Pre-training employs a masked language modeling task, aiming to enable the model to learn general semantic representations of binary instructions, specifically including: S201 Random Mask: Given a token embedding vector Randomly mask a certain percentage of words in the instruction sequence; the masked words will be marked with a mask. <mask> The tail category tag always serves to aggregate global sequence information and remains unmasked throughout the process.< / mask> S202 Mask Pre-training: The encoder only processes visible, unmasked instruction tag sequences. The output vector is obtained through the forward propagation process of the Mamba module. The decoder receives the encoder's output. and mask mark To reconstruct the original masked label, the goal of pre-training is to minimize the mean squared error loss between the reconstructed label and the original masked label.

6. The Mamba-based binary function recognition method for embedded devices according to claim 4, characterized in that, Step S3: Function identification and fine-tuning All encoder parameters are loaded from the pre-training stage, and all embedded instruction tokens are visible to the encoder. At the encoder output, only the end of the sequence is extracted. <cls>Label the corresponding feature vector; label the tail. <cls> The input is fed into an MLP-based classifier and fine-tuned using supervised learning. The specific process is as follows:< / cls> < / cls> ； ； in, To label the embedding vector, Indicates the tail category tag, Let S represent the predicted distribution, where S is the number of categories, corresponding to the predicted probability distributions of the three categories: "function start point," "function end point," and "non-function boundary point," respectively. The goal is to minimize this predicted distribution. With real labels The classification process is optimized using cross-entropy loss. 。

Images