Binary function symbol recovery method based on LLM fusion interprocess context

Abstract

The invention relates to the technical field of network security and software reverse engineering, and discloses a binary function symbol recovery method based on LLM fusion interprocess context. The method comprises the following steps: firstly, extracting multi-dimensional feature information from a target binary function, wherein the multi-dimensional feature information comprises a function body pseudo code, a call point context code snippet, call chain information and a character string parameter transmitted by a call point; then, the multi-dimensional information is structured and constructed into prompts, the prompts are input into a large language model which is finely adjusted by a specific task for reasoning, and finally candidate function names are generated. The invention further discloses an LLM fine tuning technology fusing the multi-dimensional context information. According to the LLM fine tuning technology, efficient parameter fine tuning is carried out on the basic model by constructing a training sample set containing a function body, a calling context and character string parameters. According to the method, the inter-process context information is systematically introduced, so that the accuracy and semantic fitness of binary function symbol recovery are remarkably improved.

Description

Technical Field

[0001] This invention relates to the fields of network security and software reverse engineering, specifically to a binary function symbol recovery method based on LLM (Large Language Model) fusion process context. Background Technology

[0002] Reverse engineering is a crucial technology in fields such as cybersecurity, malware analysis, and software vulnerability discovery. However, released binary programs (such as executables or dynamic link libraries) are often "stripped," meaning their internal symbolic information (such as function names and variable names) is removed to reduce file size and increase the difficulty of reverse analysis. Function name recovery (also known as symbol recovery) aims to predict semantically meaningful names for these stripped functions and is a core step in understanding program logic and improving the efficiency of reverse analysis.

[0003] With the significant progress made by Large Language Models (LLMs) in code understanding and generation tasks, researchers have begun to explore using LLMs to automatically recover binary function names. However, existing methods have significant limitations: most current methods for function name recovery using LLMs analyze only the internal code of the function itself in isolation (i.e., the decompiled function body). This approach, which relies solely on "intra-procedural" information, ignores the fact that a function's functionality is determined not only by its internal logic but also by how it is used throughout the program. This approach is akin to understanding a single word out of context, losing crucial information about the function's role in the overall program.

[0004] In practice, when analyzing an unknown function, human reverse engineering experts never look at the function itself alone. Instead, they comprehensively analyze various "inter-procedural context" information, mainly including:

[0005] 1) Caller Context: Where is this function called? What is the code before and after it is called? This provides strong functional clues.

[0006] 2) Parameters: What parameters are passed when the call is made? Especially string constants (such as log information, error messages, file names, protocol names, etc.), they are a "gold mine" of semantic information.

[0007] 3) Call Chain: Who does this function call? And who calls it? This helps to understand its role in the overall program workflow.

[0008] Since this contextual information is crucial for human experts, providing it to large language models in the same way would significantly improve their predictive accuracy. However, current automated methods neglect this rich inter-process contextual information, resulting in room for improvement in both prediction accuracy and interpretability in complex scenarios. Summary of the Invention

[0009] To address the problem of insufficient accuracy in binary function name recovery caused by relying solely on function body code and lacking inter-procedural context information in existing technologies, this invention aims to provide an LLM binary function symbol recovery method that integrates inter-procedural context. This method simulates the analytical workflow of human experts by systematically extracting and fusing multi-dimensional information such as function body, call context, call chain, and call point string parameters. Furthermore, it utilizes a large-scale language model specifically fine-tuned for this purpose for inference, significantly improving the accuracy and semantic fit of function name recovery. The technical solution is as follows:

[0010] A binary function symbol recovery method based on the inter-process context of LLM fusion includes the following steps:

[0011] S1: Extracting multi-dimensional feature information of the target function: For each target function whose name is to be recovered in the binary program, automatically extract four types of key information: function body, calling context, call chain, and call point string parameters;

[0012] S2: Constructing Structured Hints: The function body, call context, call chain, and call point string parameters extracted in S1 are combined into structured hint text according to a preset template. The hint text instructs the large language model to act as a reverse engineering expert and comprehensively analyze all the information provided.

[0013] S3: Inference based on fine-tuning of a large language model: Input the structured prompt text constructed in S2 into the large language model;

[0014] S4: Generate and output candidate function names; receive N candidate function names that best reflect the true semantics of the functions from the output of a large language model, and complete the recovery process.

[0015] The technical solution provided by this invention has the following beneficial effects:

[0016] 1) This invention integrates call context information: It systematically incorporates the pseudocode context of all function call points into the LLM input, enabling the model to understand the actual usage of the function and its role in the program.

[0017] 2) This invention automatically extracts key string parameters: It innovatively realizes the automatic tracking of call points and extraction of valuable string parameters (such as logs, error messages, protocol names, etc.), providing the most powerful semantic clues for the model.

[0018] 3) The present invention has high information density: Compared with methods that rely solely on function bodies, the present invention greatly enriches the semantic information sources available for large models to discriminate, and significantly improves the richness of context and information density.

[0019] 4) The invention has high accuracy: By mimicking the analysis process of human experts and using a dataset that incorporates multidimensional contextual information for exclusive fine-tuning, the accuracy of this method in recovering function names is significantly higher than that of existing technologies. Attached Figure Description

[0020] Figure 1 This is a schematic diagram of the framework for an LLM function name recovery method for fusion inter-process context provided by the present invention.

[0021] Figure 2 This is a flowchart illustrating the multidimensional feature information extraction process in step S1 of the present invention.

[0022] Figure 3 This is a flowchart illustrating the process of fine-tuning a large language model in step S3 of the present invention.

[0023] Figure 4 This is an example of constructing structured prompts in step S2 of the present invention. Detailed Implementation

[0024] To make the objectives, technical solutions, and advantages of the present invention clearer, the technical solutions of the present invention will be clearly and completely described below in conjunction with the embodiments and accompanying drawings.

[0025] like Figure 1 As shown, the present invention provides a method for recovering binary function names of a large language model by fusing inter-process context, including steps S1, S2, S3, and S4.

[0026] S1: Extract multidimensional feature information of the objective function.

[0027] For each target function in the binary program whose name needs to be recovered, four types of key information are automatically extracted: function body, calling context, call chain, and call point string parameters.

[0028] In this embodiment, IDA Pro and its IDAPython scripting environment are used to automate information extraction. For example... Figure 2 As shown, this step specifically includes:

[0029] S11: Extract the function body.

[0030] The `ida_hexrays.decompile` API is called to obtain the decompiled pseudocode of the target function `func_ea`. Then, the `clean_decompiled_code` function is called to remove local variable declarations (such as `int v1; __int64 v2;`, etc.) using regular expressions and other methods, preserving the core logic structure of the function and reducing noise interference with the model.

[0031] S12: Extract the caller context.

[0032] First, use `idautils.CodeRefsTo` to find all references to the target function `func_ea` (i.e., the call site `call_site_ea`). Then, for each call site, obtain the caller function `caller_func_ea` and decompile it. Locate the line containing the call site in the pseudocode of the caller function and extract the code before and after that line (e.g., N=8), as the context `context_decompiled` for that call site.

[0033] S13: Extract the call chain.

[0034] Starting with the target function `func_ea`, the `get_call_chain` function is called. This function recursively uses `idautils.CodeRefsTo` to search upwards for callers, up to a maximum depth of N levels (e.g., N=5), constructing a partial call graph. During the recursion, the `is_dummy_function` function is used to filter out dummy function chains with no semantic value (such as functions whose names match patterns like `nullsub_`, `thunk_`, etc.), and the `calculate_chain_quality` function is used to score and sort the call chains, ultimately retaining high-quality call chains.

[0035] S14: Extract String Arguments at Call Sites.

[0036] Trace all call points, analyze and extract string constants passed as parameters during the call, and filter out meaningless short strings or garbled characters.

[0037] This step is one of the key innovations of this invention. For each call point `call_site_ea` found in S12, the `analyze_call_arguments_enhanced` function is executed, which combines two strategies:

[0038] 1) Assembly layer analysis: Search backward from the call point call_site_ea (e.g., arg_search_range = 30), analyze instructions such as mov, lea, push, etc., and check whether their operands are addresses pointing to string data.

[0039] Starting from the call point instruction (such as `CALL`), backtrack backwards to search the assembly code within a specified range (such as 30 instructions), identify parameter passing instructions (such as `MOV`, `LEA`, `PUSH`, etc.), and parse their operands (such as immediate value `o_imm` or memory address `o_mem`) to obtain the address of the string constant, and then read the string content from that address.

[0040] 2) Pseudocode layer analysis: Perform regular expression matching (e.g., `r'"([^"\\]*(?:\\.[^"\\]*)*)"'`) on the decompiled pseudocode of the caller function (already obtained in S12) to directly extract the string literals hard-coded near the call point as potential parameters.

[0041] 3) String filtering: Finally, use the is_meaningful_string function to filter the extracted strings, removing invalid strings that are too short, contain only symbols, or have no specific semantic meaning.

[0042] S2: Construct a structured prompt. The four types of information extracted in S1 (function_body, caller_context, call_chain, string_arguments) are combined according to a predefined template to form a structured prompt text, which is then filled into a predefined template, such as... Figure 4 As shown. The prompt text instructs the large language model to act as a reverse engineering expert and synthesize all the information provided.

[0043] S3: Inference based on fine-tuning of a large language model.

[0044] The complete prompt text obtained in S2 is input into a large language model that has been fine-tuned for a specific task. In this embodiment, the model is a dedicated model based on the Qwen2.5-Coder-7B-Instruct pre-trained model and fine-tuned using the methods described in S31 to S33 of this invention.

[0045] like Figure 3 As shown, the fine-tuning process is as follows:

[0046] S31: Constructing the fine-tuning dataset. Using the Python script constructed in this patent, batch processing of open-source C / C++ projects with symbols, such as the GHCC and coreutils datasets, was performed to extract the four types of information described in S1 and the real names of functions (real_name). A total of 953,615 data points were extracted for fine-tuning training. Structured JSON samples containing (instruction, input, output) were created.

[0047] S32: Construct the input for the fusion context. The instruction field contains the task instruction (e.g., "Based on the function body and context, deduce the actual name of the function"); the output field contains the actual name of the function (GroundTruth); and the input field systematically integrates the function body extracted from S1, all call context code snippets, and all call point string parameters.

[0048] The extracted information is organized into JSONL format, and each sample is as follows:

[0049] {

[0050] "instruction": "Based on the function body and context, please infer the actual name of this function."

[0051] "input": "[Function body]: ... [Function body pseudocode] ... " [Call Point Context 1]:... [Context Code]... [Call Point Context 2]: ... [Context Code] ... [Dot string parameter]: ['Error: File not found', 'Opening file %s'] [Call Chain]: ...[Call Chain Information] ...",

[0052] "output": "open_file_with_error_logging"

[0053] }

[0054] The key is that the `input` field incorporates all the context information extracted by S1.

[0055] S33: Execution Parameter Efficient Fine-Tuning (PEFT). Executed on a dual A100 40G GPU server using the fine-tuning script built in the patent.

[0056] A pre-trained large code model (such as Qwen2.5-Coder-7B-Instruct) was selected, employing techniques such as Low-Rank Adaptation (LoRA), 4-bit quantization (NF4), and Flash Attention 2. Supervised fine-tuning was performed using the dataset constructed in S31. The training objective was cross-entropy loss, and to ensure the model only learns to generate the target function name, the tokens in the input part were masked (their labels were set to -100) when calculating the loss. The model has the following characteristics:

[0057] 1) Quantization: Configure 4-bit NormalFloat (NF4) quantization using `BitsAndBytesConfig` (`load_in_4bit=True`, `bnb_4bit_quant_type="nf4"`) and enable double quantization (`bnb_4bit_use_double_quant=True`), with the calculation type being `torch.bfloat16`.

[0058] 2) LoRA (Low-Rank Adaptation): Configure `LoraConfig`, set the rank `r=64`, the scaling factor `lora_alpha=128`, and apply it to attention modules such as `q_proj`, `k_proj`, and `v_proj`.

[0059] 3) Acceleration: Enable `Flash Attention 2` (`attn_implementation="flash_attention_2"`) to reduce memory read and write operations and accelerate training.

[0060] 4) Training: Distributed training is performed using Hugging Face `Trainer` and `deepspeed`. The data processor `QwenFunctionNameDataset` is responsible for converting JSON samples into Qwen dialogue templates and performing batch processing and population using `DataCollatorForSeq2Seq`. The training objective is cross-entropy loss. : ; in, The length of the target sequence (i.e., the target function name) (total number of tokens). For the i-th token in the target sequence, The sequence preceding the i-th token in the target sequence (i.e. arrive ), The input sequence is (i.e., the multimodal description of the function). These are the trainable parameters of the model. For the model with given parameters Input sequence and historical content, Predicting generation under the condition The conditional probability.

[0061] When calculating the loss, the `labels` of the input part are set to -100, so that the gradient is backpropagated only in the output part of `assistant` (i.e., the function name).

[0062] S4: Generate and output candidate function names.

[0063] After the model inference is completed, N (e.g., 3) candidate function names are parsed from its output as the final recovery result.

[0064] In summary, this invention constructs an information-rich input by systematically integrating function bodies, call context, call chains, and key call point string parameters. Through dedicated fine-tuning, it enables large models to possess analytical capabilities comparable to human experts, thereby effectively solving the problem of low symbol recovery accuracy caused by the lack of contextual information in existing technologies.

Claims

1. A binary function symbol recovery method based on the inter-process context of LLM fusion, characterized in that, Includes the following steps: S1: Extracting multi-dimensional feature information of the target function: For each target function whose name is to be recovered in the binary program, automatically extract four types of key information: function body, calling context, call chain, and call point string parameters; S2: Constructing Structured Hints: The function body, call context, call chain, and call point string parameters extracted in S1 are combined into structured hint text according to a preset template. The hint text instructs the large language model to act as a reverse engineering expert and comprehensively analyze all the information provided. S3: Inference based on fine-tuning of a large language model: Input the structured prompt text constructed in S2 into the large language model; S4: Generate and output candidate function names; receive N candidate function names that best reflect the true semantics of the functions from the output of a large language model, and complete the recovery process.

2. The binary function symbol recovery method based on the inter-process context of LLM fusion as described in claim 1, characterized in that, The four types of information automatically extracted in S1 are as follows: S11: Extract function body: Obtain the decompiled pseudocode of the target function func_ea, clean it, remove local variable declarations, and make the model focus on the core logical semantics; S12: Extract the call context: Traverse all call points of the target function func_ea, obtain the caller function caller_func_ea where each call point is located, decompile the caller function caller_func_ea, locate the line where the current call point is located in the decompiled pseudocode of the caller function caller_func_ea, and extract the decompiled pseudocode of each of the N lines before and after the line as the context of the current call point; S13: Extract call chains: Recursively collect the upper-level call paths of the target function func_ea, construct a partial call graph, filter out meaningless dummy function chains, score and sort the call chains, and finally retain high-quality call chains. S14: Extract call point string parameters: Trace all call points, analyze and extract the string constants passed as parameters during the call, and filter out meaningless short strings or garbled characters.

3. The binary function symbol recovery method based on the inter-process context of LLM fusion as described in claim 2, characterized in that, The methods for extracting the call point string parameter in S14 include: 1) Parameter tracing based on assembly instructions: Backtrack from the call point instruction to search the assembly code within a specified range, identify the parameter passing instructions, parse their operands to obtain the address of the string constant, and then read the string content from the address; 2) Literal extraction based on decompiled code: Perform text analysis on the decompiled pseudocode of the caller function, and use regular expressions to match string literals appearing in the code as potential parameters; 3) String filtering: Filter the extracted strings, removing strings that are too short, contain only symbols, or have no specific meaning, and keeping only meaningful strings.

4. The binary function symbol recovery method based on the inter-process context of LLM fusion as described in claim 1, characterized in that, The training process for fine-tuning a large language model as described in S3 includes: S31: Constructing a multimodal fine-tuning dataset for functions: Based on an open-source project, extract the four types of key information mentioned in S1 and the real names of the functions to create a structured JSON sample containing: instruction, input, and output; S32: Constructing the input of the fusion context: where the instruction field is the task instruction; the output field is the actual name of the function; the input field systematically integrates the function body extracted from S1, all call context code snippets, and all call point string parameters; S33: Efficient Fine-tuning of Parameters: A pre-trained large-scale code model is selected, employing low-rank adaptation, 4-bit quantization, and FlashAttention 2 techniques. Supervised fine-tuning is performed using the multimodal function fine-tuning dataset constructed in S31. The training objective is cross-entropy loss, and to ensure the model only learns to generate the target function name, the tokens in the input part are masked when calculating the loss. The cross-entropy loss... for: ； in, The length of the target sequence, i.e., the total number of tokens; For the i-th token in the target sequence, The sequence preceding the i-th token in the target sequence; The input sequence is the function's multimodal description. These are the trainable parameters of the model. For the model with given parameters Input sequence and historical content, Predicting generation under the condition The conditional probability.

Images