A binary code similarity detection method and system based on source code remodeling

Abstract

This invention relates to the field of binary code similarity detection, specifically to a binary code similarity detection method and system based on source code reshaping. This invention utilizes a large model to reshape binary code into a source code representation, achieving cross-architecture, cross-compiler, and cross-optimization level binary code similarity detection. Specific steps include: preprocessing the binary code to extract assembly code, control flow graph, and pseudocode; using a fine-tuned large model to reshape the above multiple representations into a unified source code representation; and calculating the similarity between source codes using a similarity metric method to determine the similarity between binary codes. This invention effectively solves the semantic and structural information loss problems existing in the prior art, supports direct similarity detection between binary code and source code, and broadens the application scope of binary code similarity detection.

Description

Technical Field

[0001] This invention relates to the field of binary code similarity detection technology, and in particular to a binary code similarity detection method and system based on a large model, which can not only realize similarity detection between binary codes, but also directly realize similarity detection between binary code and source code. Background Technology

[0002] Binary code similarity detection has significant application value in fields such as software development, vulnerability detection, malware analysis, and code plagiarism detection. Traditional binary code similarity detection methods typically compare the syntactic, structural, or semantic similarity of binary code fragments, primarily comparing between binary code segments. However, these methods have the following limitations:

[0003] 1. Loss of semantic and structural information: Assembly instructions, control flow graphs, or intermediate languages ​​extracted from binary code cannot fully preserve the high-level semantic and structural information of the source code. This information loss leads to a decrease in the accuracy of similarity detection and an inability to fully capture the logical and functional characteristics of the code.

[0004] 2. Inability to directly compare source code and binary code: Due to the significant differences in abstraction level and representation between source code and binary code, existing methods struggle to achieve direct similarity detection between the two. This limits the analysis of unknown binary files and the study of the correlation between source code and its compiled binary code. Summary of the Invention

[0005] To address the aforementioned technical problems, this invention proposes a binary code similarity detection system based on source code reshaping, comprising:

[0006] A binary code similarity detection method based on source code reshaping includes the following steps:

[0007] S1: Obtain the binary files A and B to be tested, preprocess each function in binary files A and B respectively, and extract the assembly code, control flow graph and pseudocode of each function;

[0008] S2: Organize and combine the assembly code, control flow graph, and pseudocode of each of the above functions into a standard text suitable for model input;

[0009] S3: Input the standard text of each function construction one by one into the pre-fine-tuned model to generate the function-level source code corresponding to function i in binary file A. And the function-level source code corresponding to function j in binary file B.

[0010] S4: Yes and The similarity of the paired function pairs is calculated by calculating the cosine similarity and Jaccard similarity respectively, and the average of the two is taken as the actual similarity score.

[0011] S5: Calculate the mean of the similarity of all function pairs as the overall similarity between binary files A and B. If the overall similarity is greater than the preset threshold, they are judged to be similar.

[0012] Preferably, the preprocessing step specifically includes:

[0013] In the preprocessing stage, the assembly code of each function in the binary file is first extracted using decompilation tools (such as IDA Pro, Ghidra, etc.). This process locates the function's entry address and start / end range, and records the instruction sequence logic. The extraction results include the basic operation instruction set and their calling relationships, providing a foundation for subsequent generation of the control flow graph.

[0014] Furthermore, based on the extracted assembly code, the function jump logic is analyzed to generate a control flow graph. Basic blocks represent consecutive code without jumps, and jump relationships describe the execution path between these basic blocks. The control flow graph captures the function's execution logic, providing structural information for subsequent similarity analysis.

[0015] Finally, the assembly code is converted into pseudocode, and the advanced disassembly capabilities of the decompilation tool are used to generate a high-level language representation (such as C language style) that closely resembles the source code.

[0016] Preferably, the step of organizing and combining the text into standard text suitable for model input specifically includes:

[0017] The assembly code, control flow graph, and pseudocode are formatted and organized according to a unified template. The assembly code is arranged line by line using the original instruction sequence, the control flow graph is represented by an adjacency matrix, and the pseudocode is represented by removing newline characters and displaying it on a single line.

[0018] Furthermore, identifier labels are added for each data type. For example, "Assembly:" identifies assembly code, "CFG:" identifies control flow graphs, and "Pseudo:" identifies pseudocode. These labels are embedded in the data as text tags, while also providing a brief description of the content structure.

[0019] Finally, the assembly code, control flow graph, and pseudocode of each function are integrated into a complete input text, with the content arranged in a modular order.

[0020] Preferably, the generated function-level source code representation specifically includes:

[0021] Construct a training corpus for fine-tuning. Specifically, compile the same source code using multiple architectures (e.g., x86, ARM32, MIPS32) and under different optimization levels (e.g., O0, O1, O2) and compilers (e.g., GCC, Clang), generating multi-architecture binaries. Extract the assembly code, control flow graph, and pseudocode for each function from these binaries, and align them with the source code to form a large-scale training dataset containing inputs (assembly code, control flow graph, and pseudocode) and outputs (source code).

[0022] LoRA technology is used to fine-tune a large language model. During the fine-tuning process, the weights of the original model are fixed, and optimization is performed only on the incremental parts of the weights.

[0023] After the standard text of each function is processed, it is input one by one into the finely tuned large language model. The model performs semantic parsing and structured analysis on the assembly code, control flow graph, and pseudocode in the input text to generate function-level source code representations.

[0024] Preferably, the similarity calculation specifically includes:

[0025] For each function in binary file A and each function in binary file B Combine each pair of functions to form all possible function pairs. Each function pair... and This represents the combination relationship between the i-th function in file A and the j-th function in file B;

[0026] Furthermore, for each pair of functions, cosine similarity and Jaccard similarity are calculated separately, and the mean of cosine similarity and Jaccard similarity is used as the actual similarity score of the function pair for subsequent calculation of overall similarity.

[0027] Preferably, the step of calculating the mean of similarity for all functions specifically includes:

[0028] Collect similarity scores for all function pairs in binary files A and B, calculate the average of these scores to obtain the overall similarity between binary files A and B, and judge them as similar if the overall similarity is greater than a preset threshold.

[0029] Furthermore, the similarity scores of all function pairs and the overall similarity of the binary files are recorded and stored in the detection report.

[0030] A binary code similarity detection system based on source code reshaping includes: a preprocessing module, a model input text construction module, a source code generation module, a similarity calculation module, and a result processing module.

[0031] The preprocessing module includes: an assembly code extraction unit, a control flow graph generation unit, and a pseudocode generation unit;

[0032] The assembly code extraction unit extracts the assembly code of each function in the binary file, locates the entry address and start and end range of the function, and records the instruction sequence logic. The extraction results include the basic operation instruction set and its calling relationship.

[0033] The control flow graph generation unit analyzes the function jump logic based on assembly code and generates a control flow graph. The control flow graph contains basic blocks and their jump relationships, capturing the execution logic structure of functions.

[0034] The pseudocode generation unit uses the advanced disassembly capabilities of decompilation tools to convert assembly code into pseudocode, generating a high-level language representation that closely resembles the source code.

[0035] The model input text construction module includes: a formatting unit, a tag generation unit, and a content integration unit;

[0036] The formatting unit standardizes the assembly code, control flow graph, and pseudocode, representing the assembly code as a sequence of raw instructions arranged line by line, the control flow graph as an adjacency matrix, and the pseudocode as a single line.

[0037] The label generation unit adds identification labels to different types of data, including "Assembly:" to identify assembly code, "CFG:" to identify control flow graphs, and "Pseudo:" to identify pseudocode. The labels are embedded in the data in the form of text tags.

[0038] The content integration unit integrates assembly code, control flow graph, and pseudocode into a single complete input text, with the content arranged in a modular order.

[0039] The source code generation module includes: a corpus construction unit, a fine-tuning unit, and a source code generation unit;

[0040] The corpus construction unit is responsible for building a high-quality corpus for model fine-tuning. Specifically, it compiles the same source code using multiple architectures (e.g., x86, ARM, MIPS), multiple compilers (e.g., GCC, Clang), and different optimization levels (e.g., O0, O1, O2, etc.) to generate binary files with different combinations. Decompilation tools are used to extract function-level assembly code, control flow graphs, and pseudocode as input, while the source code is retained as output labels to construct function-level input-output pairs.

[0041] The fine-tuning unit optimizes large language models based on corpora and employs LoRA technology for efficient model fine-tuning. By fixing the original model weights and optimizing only the weight increments, storage requirements and computational resource consumption are reduced. After model fine-tuning, the multidimensional information of binary code can be more accurately reconstructed into a semantically consistent source code representation.

[0042] The source code generation unit receives the standardized model input text, including the assembly code, control flow graph, and pseudocode of the functions, and inputs the standardized text of each function one by one into the fine-tuned large language model. The model parses the input content, comprehensively analyzes multi-dimensional information, and generates function-level source code representations.

[0043] The similarity calculation module includes: a function pair combination unit and a similarity scoring unit;

[0044] The function pair combination unit combines each function in binary file A With each function in binary file B By combining pairs, all possible function pairs can be generated;

[0045] The similarity scoring unit calculates cosine similarity and Jaccard similarity for each pair of functions, and uses the average of the two as the actual similarity score for the function pair, which is then used for the subsequent calculation of overall similarity.

[0046] The result processing module includes: a mean calculation unit and a result recording unit;

[0047] The mean calculation unit calculates the mean similarity score of all function pairs to obtain the overall similarity between binary files A and B. If the overall similarity is greater than a preset threshold, the two files are judged to be similar.

[0048] The results recording unit records the similarity scores and overall similarity of all function pairs and stores them in the detection report for subsequent analysis and result verification.

[0049] The beneficial effects of this invention are as follows: This invention enables high-precision similarity detection at the binary code level, and supports cross-level similarity detection between binary files and source code, thus broadening the application scope of similarity detection. Attached Figure Description

[0050] Figure 1 This is a flowchart of the binary code similarity detection method according to an embodiment of the present invention;

[0051] Figure 2 This is a schematic diagram of the preprocessing process according to an embodiment of the present invention;

[0052] Figure 3 This is a schematic diagram of the control flow graph construction according to an embodiment of the present invention;

[0053] Figure 4 This is a schematic diagram of the corpus construction according to an embodiment of the present invention.

[0054] Figure 5 This is a flowchart of the similarity measurement process according to an embodiment of the present invention;

[0055] Figure 6 This is a schematic diagram of a binary code similarity detection system according to an embodiment of the present invention;

[0056] Figure 7 This is a schematic diagram of the preprocessing module according to an embodiment of the present invention;

[0057] Figure 8 This is a schematic diagram of the format unification module in an embodiment of the present invention;

[0058] Figure 9 This is a schematic diagram of the source code generation module according to an embodiment of the present invention;

[0059] Figure 10 This is a schematic diagram of the similarity calculation module in an embodiment of the present invention;

[0060] Figure 11 This is a schematic diagram of the result processing module in an embodiment of the present invention. Detailed Implementation

[0061] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are merely some embodiments of the present invention, and not all embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative effort are within the protection scope of the present invention.

[0062] A binary code similarity detection method based on source code reshaping, such as Figure 1 As shown, the feature is that it includes:

[0063] S1: Obtain the binary files A and B to be tested, preprocess each function in binary files A and B respectively, and extract the assembly code, control flow graph and pseudocode of each function;

[0064] S2: Organize and combine the assembly code, control flow graph, and pseudocode of each of the above functions into a standard text suitable for model input;

[0065] S3: Input the standard text of each function construction one by one into the pre-fine-tuned model to generate the function-level source code corresponding to function i in binary file A. And the function-level source code corresponding to function j in binary file B.

[0066] S4: Yes and The similarity of the paired function pairs is calculated by calculating the cosine similarity and Jaccard similarity respectively, and the average of the two is taken as the actual similarity score.

[0067] S5: Calculate the mean of the similarity of all function pairs as the overall similarity between binary files A and B. If the overall similarity is greater than the preset threshold, they are judged to be similar.

[0068] Each function in the binary file is preprocessed to extract the assembly code, control flow graph, and pseudocode, such as... Figure 2 As shown, it specifically includes:

[0069] The binary file is analyzed using decompilation tools (such as IDA Pro and Ghidra) to locate the entry address and start / end range of each function and extract the instruction sequence. The generated assembly code is saved as a .asm file, recording the basic operation instruction set and call relationships of the functions. The output of the decompilation tool can also generate an .i64 file containing all the analysis information from the disassembly process for use by subsequent modules. The extracted assembly code provides the foundation for the generation of control flow graphs and pseudocode.

[0070] Based on the extracted assembly code, the function jump logic is analyzed, and a control flow graph in the form of an adjacency matrix is ​​generated, such as... Figure 3 As shown. The control flow graph describes the jump relationships between basic blocks using an adjacency matrix, where each row and column corresponds to a basic block. For example, the adjacency matrix [[1, 2], [3], [], []] indicates that basic block 0 points to basic blocks 1 and 2, basic block 1 points to basic block 3, while basic blocks 2 and 3 have no jump relationship. This representation clearly reflects the logical structure and execution path of the function in a compact form, providing structured data input for subsequent analysis;

[0071] Using the advanced disassembler features of a decompiler, assembly code can be converted into a pseudocode representation, such as... Figure 2 As shown, the pseudocode uses a representation similar to a high-level language (such as C), and reconstructs the operational semantics of the program by analyzing registers, variables, and their dependencies. The pseudocode further extracts high-level semantic information from functions, providing a higher-level representation of input data for the model.

[0072] The extracted assembly code, control flow graph, and pseudocode are organized into standardized text suitable for model input, specifically including the following processes:

[0073] The extracted assembly code, control flow graph, and pseudocode are formatted. The assembly code is represented line by line, with each instruction on a separate line. Irrelevant comments and redundant symbols are removed, retaining only the opcode and operands to ensure clear instruction logic. The control flow graph is represented using an adjacency matrix, with each row corresponding to a basic block and recording its jump target. This array-based representation simplifies the control flow graph representation. The pseudocode eliminates redundant newline characters and whitespace, compressing the semantic representation of each function into a single line, maintaining logical semantic integrity while optimizing the length of the input data.

[0074] Each section is labeled with a unique identifier to clearly identify its data source. Specifically, "Assembly:" identifies the assembly code section, "CFG:" identifies the control flow graph section, and "Pseudo:" identifies the pseudocode section. These labels are embedded as text tags before the corresponding content, along with brief descriptions, such as adjacency matrices describing the logical structure of the control flow graph and pseudocode formatted using a high-level language.

[0075] The formatted and annotated content is integrated in a modular order to construct the complete input text. During integration, the "assembly code - control flow" approach is followed. Figure 1 The pseudocode arranges each part of the content in a logical order to ensure a coherent and hierarchical data structure. Simultaneously, the length of the integrated text is standardized to avoid exceeding the model's input limits, and the completeness of each part is verified to ensure that the standardized text accurately expresses the multi-dimensional information of the function.

[0076] The integrated standard text is input into a pre-tuned large language model to generate a function-level source code representation, specifically including:

[0077] Prepare a corpus for fine-tuning a large language model. The corpus construction is as follows: Figure 4 As shown, the input data includes the assembly code, control flow graph, and pseudocode of the functions, and the output is the corresponding source code representation. In practice, the same source code is compiled using multiple compilers (such as GCC and Clang) and different optimization levels (such as O0, O1, and O2) to generate binary files for multiple architectures (such as x86, ARM32, and MIPS32). The generated binary files are then decompiled to extract the assembly code, control flow graph, and pseudocode of each function, forming a structured input. Simultaneously, the original source code is retained as a supervisory signal for training the model's output. All input and output data pairs form a large-scale function-level source code and binary code aligned corpus for fine-tuning the model.

[0078] Low-rank adaptation (LoRA) is used to fine-tune large language models. During fine-tuning, the model parameters are decomposed into low-rank matrix form to reduce storage requirements and accelerate training. Assuming the model's weight matrix is ​​W0, the fine-tuned weight matrix W is expressed as:

[0079] W = W0 + ΔW, ΔW = A·B

[0080] Where A and B are low-rank matrices, satisfying During training, W0 is kept constant, and only A and B are optimized. This method can efficiently adapt large models to the requirements of this task, while significantly reducing the consumption of computing resources;

[0081] Furthermore, the standard text obtained from each function after integration is input one by one into the fine-tuned model. The model receives input including line-by-line assembly code, a control flow graph in the form of an adjacency matrix, and compressed pseudocode text. The model performs semantic parsing and structured understanding of the input data, integrating the complementary information from the three types of input data to generate function-level source code representations. The generated source code not only preserves the logical structure and high-level semantics of the functions but also adaptively handles differences in specific architectures and optimization levels.

[0082] For each function in binary files A and B, pairwise combine them and calculate the similarity of the function pairs, such as... Figure 5 As shown, it specifically includes:

[0083] The function representations in binary file A and binary file B are paired to generate all possible function pairs. The function representation in each pair is the previously generated function-level source code representation. These function representations are then input into a downstream model for encoding. The downstream model typically uses a recognized encoding model (e.g., BERT, Siamese Network) to vectorize the function representations, generating corresponding high-dimensional embedding representations.

[0084] Furthermore, similarity is calculated for the embedding representations of each pair of functions, such as... Figure 5 As shown, multiple similarity metrics are used for comprehensive evaluation. First, cosine similarity is calculated. This method measures the directional similarity between two embedding vectors and reflects the semantic similarity of the functions. The calculation formula is:

[0085]

[0086] in, and Let these represent the embedding vectors of the two functions in the function pair. Next, calculate the Jaccard similarity, a method that measures the overlap between two sets of embedded features and reflects the structural similarity of the functions. The formula is as follows:

[0087]

[0088] Finally, the mean of cosine similarity and Jaccard similarity is used as the actual similarity score of the function pair for subsequent statistical analysis of overall similarity.

[0089] The similarity scores of function pairs are summarized to calculate the overall similarity between binary files A and B, specifically including:

[0090] Collect similarity scores for all function pairs, and calculate the average of these scores. Use this average as the overall similarity between binary files A and B to determine the degree of similarity between the files. If the overall similarity is greater than a preset threshold, the files are considered similar. Furthermore, record the overall similarity and the similarity scores for each function pair to generate a detection report for subsequent analysis and verification.

[0091] A binary code similarity detection system based on source code reshaping, such as Figure 6 As shown, it includes: a preprocessing module, an input text construction module, a source code generation module, a similarity calculation module, and a result processing module;

[0092] The preprocessing module includes: an assembly code extraction unit, a control flow graph construction unit, and a pseudocode generation unit, such as... Figure 7 As shown;

[0093] The assembly code extraction unit parses the binary file, extracts the assembly code for each function, locates the function's entry address, instruction range, and call relationships, and records the logical structure of the instruction sequence. The extraction results are presented in assembly format for use by subsequent processing modules.

[0094] The control flow graph construction unit generates the control flow graph based on assembly code, and uses an adjacency matrix to represent the jump relationships between basic blocks. It can record the target basic blocks that a basic block may jump to, accurately capturing the logical structure and execution path of functions;

[0095] The pseudocode generation unit translates assembly code into pseudocode that approximates a high-level language (such as C), extracting high-level semantic information from the program. The pseudocode expresses the operational intent of functions, further compensating for the semantic deficiencies of assembly code and providing a higher-level semantic representation for model input.

[0096] The input text construction module includes: a formatting unit, a tag generation unit, and a content integration unit, such as... Figure 8 As shown;

[0097] The formatting unit standardizes the assembly code, control flow graph, and pseudocode generated by the preprocessing module. The assembly code is arranged line by line, preserving core instruction information; the control flow graph is represented in a compact adjacency matrix form, simplifying the function logic structure into an array; the pseudocode compresses the semantic representation of functions into a single line by removing redundant formatting symbols, thereby optimizing the model input length.

[0098] The tag generation unit adds unique identifiers to standardized content. For example, "Assembly:" identifies assembly code, "CFG:" identifies control flow graphs, and "Pseudo:" identifies pseudocode. These tags clearly distinguish different types of data sources and provide a brief description of the content's structure and purpose.

[0099] The content integration unit integrates the formatted and annotated content into a complete standard text in a modular order. Integration follows the "assembly code - control flow" principle. Figure 1 The pseudocode arranges each part of the content in a logical order to ensure clear hierarchy and coherent structure. At the same time, the length of the integrated text is standardized to avoid exceeding the input limit of the model.

[0100] The source code generation module includes: a corpus construction unit, a fine-tuning unit, and a source code generation unit, such as... Figure 9 As shown;

[0101] The corpus building unit collects binary files and their corresponding source code from multiple architectures, compilers, and different optimization levels (such as O0, O1, O2, etc.) to form an input-output aligned corpus. Specifically, this involves extracting the assembly code, control flow graph, and pseudocode from the binary files as input, and using the original source code as a supervisory signal for model fine-tuning. The constructed corpus comprehensively covers different architectural characteristics and compilation optimization differences, enhancing the model's generalization ability.

[0102] The fine-tuning unit employs LoRA technology for efficient fine-tuning of large language models. During fine-tuning, the low-rank matrix is ​​optimized to adapt to the model's task requirements while preserving the knowledge of the original model. Specifically, the weight matrix update formula is:

[0103] W = W0 + ΔW, ΔW = A·B

[0104] Here, A and B are low-rank matrices. During optimization, only these two matrices are adjusted, which significantly reduces the computational resource consumption for fine-tuning.

[0105] The source code generation unit inputs the standard text of each function generated by the input text construction module into the finely tuned large language model. The model generates the corresponding function-level source code representation by integrating complementary information from assembly code, control flow graph, and pseudocode through semantic parsing and structural understanding of the input content.

[0106] The similarity calculation module includes: a function pair combination unit and a similarity scoring unit, such as... Figure 1 As shown in Figure 0;

[0107] The function pair combination unit combines all function-level source code in binary file A with all function-level source code in binary file B in pairs to generate all possible function pairs;

[0108] The similarity scoring unit scores the source code representations of each pair of functions using two similarity metrics. Specifically, it calculates cosine similarity to measure similarity along the embedding vector direction, and calculates Jaccard similarity to assess the degree of overlap in the feature sets. The average of these two metrics is then used as the actual similarity score for the function pair, for use in overall similarity analysis.

[0109] The result processing module includes: a mean calculation unit and a result recording unit, such as... Figure 11 As shown.

[0110] The mean calculation unit summarizes the similarity scores of all function pairs and calculates the mean to obtain the overall similarity between binary files A and B. It then compares the overall similarity with the set similarity threshold. If the overall similarity is greater than the set threshold, the files are considered similar.

[0111] The results recording unit stores the similarity scores and overall similarity of all function pairs in the detection report, and generates an easy-to-analyze report file for subsequent verification and results application.

[0112] Although embodiments of the present invention have been shown and described, those skilled in the art can make various changes, modifications or substitutions to these embodiments without departing from the spirit and principles of the present invention, and such changes, modifications and substitutions should also fall within the protection scope of the present invention.

Claims

1. A binary code similarity detection method based on source code reshaping, characterized in that, include: S1: Obtain the binary files A and B to be tested, preprocess the binary files A and B respectively, and extract the assembly code, control flow graph and pseudocode of each function; S2: Organize and combine the assembly code, control flow graph, and pseudocode of each of the above functions into a standard text suitable for model input; S3: Input the standard text of each function construction mentioned above into the fine-tuned model one by one to generate the function-level source code corresponding to function i in binary file A. Generate the function-level source code corresponding to function j in binary file B. S4: Yes and Similarity is calculated for pairs of functions, mainly using cosine similarity and Jaccard similarity functions to score similarity, and the average of the two is taken as the actual similarity score. S5: Calculate the mean of the similarity of all function pairs as the overall similarity between binary files A and B. If the overall similarity is greater than the preset threshold, they are judged to be similar.

2. The binary code similarity detection method based on source code reshaping according to claim 1, characterized in that, The preprocessing of binary files A and B respectively includes: Use a decompiler to extract the assembly code of each function in the binary file; A control flow graph is constructed based on the extracted assembly code, and basic blocks and their jump relationships are extracted. The assembly code is converted into pseudocode to extract the program's high-level semantic information.

3. The binary code similarity detection method based on source code reshaping according to claim 1, characterized in that, The assembly code, control flow graph, and pseudocode of each of the above functions are organized and combined into a standard text suitable for model input, specifically including: The assembly code, control flow graph, and pseudocode of each function are standardized and formatted into text suitable for model input. Add specific tags to identify the data source, such as "Assembly:" for identifying assembly code, "CFG:" for identifying control flow graphs, and "Pseudo:" for identifying pseudocode; The assembly code, control flow graph, and pseudocode of each function are integrated to input text into the corresponding model.

4. The binary code similarity detection method based on source code reshaping according to claim 1, characterized in that, The above standard text is input into the finely tuned large language model to generate a source code representation, specifically including: The model is fine-tuned by building a corpus. In practice, different architectures (such as x86, ARM32, etc.), multiple compilers (such as GCC, Clang, etc.) and different optimization levels (such as O0, O1, O2, etc.) are used to generate multiple binary files. The generated binary files are decompiled to extract the assembly code, control flow graph and pseudocode of the functions. These are then aligned with the original source code to form function-level input and output pairs, and a large-scale corpus is built. Low-Rank Adaptation (LoRA) is used to fine-tune a large language model. During fine-tuning, the original weights of the model are fixed, and efficient training is achieved only by optimizing the low-rank matrix. The finely tuned large language model is used to generate source code representations. Standard text for each function is input into the model, containing line-by-line assembly code, a control flow graph in adjacency matrix form, and pseudocode. Through semantic parsing and structured understanding, the model integrates various input information to generate function-level source code representations with logical structure and high-level semantics. According to claim 1, a binary code similarity detection method based on source code reshaping is characterized in that the source code obtained from different binary files is paired into function pairs, and the similarity of the function pairs is calculated, specifically including: Represent the generated function-level source code and Pairwise, we form function pairs and calculate the cosine similarity and Jaccard similarity for each function pair. The average of the cosine similarity and Jaccard similarity for each pair of functions is taken as the actual similarity score for each pair of functions.

5. The binary code similarity detection method based on source code reshaping according to claim 1, characterized in that, The overall similarity is obtained by calculating the mean of the similarity of all functions, specifically including: Collect similarity scores for all function pairs in binary files A and B, calculate the average of these scores to obtain the overall similarity between binary files A and B, and judge them as similar if the overall similarity is greater than a preset threshold. Furthermore, the similarity scores of all function pairs and the overall similarity of the binary files are recorded and stored in the detection report.

6. The binary code similarity detection method based on source code reshaping according to claim 1, characterized in that, The method can also be used to represent function-level source code of binary files. Directly related to function-level source code representation in the source code file Similarity detection is performed to determine whether there is code in the binary file that is highly similar to the source code file, thus supporting cross-level similarity detection between source code and binary files and expanding the application scope of the method.

7. A binary code similarity detection system based on source code reshaping, characterized in that, include: The system includes a preprocessing module, a model input text construction module, a source code generation module, a similarity calculation module, and a result processing module. The preprocessing module includes an assembly code extraction unit, a control flow graph construction unit, and a pseudocode generation unit; The assembly code extraction unit is used to extract the assembly code for each function from the binary file; The control flow graph construction unit is used to generate a control flow graph based on assembly code and extract basic blocks and their jump relationships. The pseudocode generation unit is used to convert assembly code into pseudocode and extract high-level semantic information of the program. The model input text construction module includes a formatting unit, a tag generation unit, and a content integration unit; The formatting unit is used to perform uniform formatting processing on assembly code, control flow graphs, and pseudocode; The tag generation unit is used to add identification tags to the formatted content, such as "Assembly:" for identifying assembly code, "CFG:" for identifying control flow graphs, and "Pseudo:" for identifying pseudocode; The content integration unit is used to integrate the assembly code, control flow graph, and pseudocode of each function into a complete model input format. The source code generation module includes a corpus construction unit, a fine-tuning unit, and a source code generation unit; The corpus construction unit is used to build the training dataset. The input consists of the assembly code, control flow graph, and pseudocode of functions, and the output is the corresponding source code representation. Different types of binary files are generated using various architectures, compilers, and optimization levels. Function-level decompiled data is extracted and aligned with the source code to form input-output pairs. The fine-tuning unit uses LoRA technology to fine-tune the large language model, fixing the original model weights and optimizing only the low-rank matrix ΔW = A·B, so that the model can be efficiently adapted to binary code similarity detection tasks. The source code generation unit receives standard text input into a fine-tuned large language model and generates function-level source code representations based on the input assembly code, control flow graph, and pseudocode. The similarity calculation module includes a function pair combination unit and a similarity scoring unit; The function pair combination unit combines each function in binary file A With each function in binary file B By combining pairs, all possible function pairs can be generated; The similarity scoring unit calculates the cosine similarity and Jaccard similarity for each pair of functions, and uses the average of the two as the actual similarity score for the function pair. The result processing module includes a mean calculation unit and a result recording unit; The mean calculation unit is used to calculate the mean of the similarity score, which is used as the overall similarity between binary files A and B. If the overall similarity is greater than a preset threshold, they are judged to be similar. The results recording unit is used to store the similarity scores of all function pairs in binary files A and B, as well as the overall similarity between binary files A and B, in the detection report.

Images