Hierarchical Graph Learning for Stripped Binary Symbol Recovery
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Legacy software systems lack effective methods for recovering missing symbols from stripped binaries, complicating the patching of vulnerabilities due to the absence of source code and the inefficiencies of existing reverse engineering tools.
Innovation Solution
A method and system using a graph-of-graph representation and hierarchical graph learning pipeline to reconstruct function names and symbols from stripped binaries, leveraging Ghidra decompiler APIs and machine learning models to analyze control flow and cross-calling dependencies.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Weight of stationary object
If symbols are excluded from binary files to reduce file size, then binary footprint is optimized, but symbol recovery becomes difficult and decompilers assign meaningless names
Solution Approach 1:
The patent introduces an intermediary machine learning model that acts as a mediator between the stripped binary and the missing symbols. The model takes decompiled code and control flow information as input and predicts probable original symbols, effectively bridging the information gap created by symbol stripping without requiring the symbols to be present in the binary itself.
Solution Approach 2:
The patent performs preliminary actions by collecting symbol information from multiple sources (decompiled code, control flow graphs, cross-calling dependencies) before the actual symbol recovery process. The system pre-processes the binary to extract all available contextual information, which is then used by the ML model to make informed predictions about missing symbols.
2Loss of information
If traditional reverse engineering tools are used to disassemble and decompile binaries, then function reconstruction is possible, but the process is time-consuming and requires expert interpretation
Solution Approach 1:
The patent implements self-service by enabling the system to automatically recover symbols without requiring expert reverse engineer intervention. The machine learning model autonomously analyzes the binary, processes decompiled code, and generates symbol predictions, replacing the need for human experts to manually interpret decompiled code and assign meaningful names.
Solution Approach 2:
The patent substitutes the mechanical process of manual reverse engineering with an automated machine learning system. Instead of relying on human experts to systematically analyze control flow, interpret code semantics, and assign symbols, the system uses an ML model that automatically performs these tasks by learning from training data, thereby replacing the manual mechanical process with an automated computational one.
3Extent of automation
If decompilers assign meaningless symbol names to coding elements, then processing is automated, but understanding software semantics becomes difficult
Solution Approach 1:
The patent implements feedback by using the ML model to generate predicted symbols that are then fed back into the decompiled code representation. This creates a loop where the system continuously refines symbol assignments based on learned patterns from training data, improving the semantic quality of automated decompilation outputs over time.
Data Source
AI summary
Recovering symbols from a stripped binary includes representing the stripped binary as a plurality of graph of graphs (GoG) representations, converting the plurality of GoGs into a plurality of expressive representations of each function in the stripped binary, training a machine learning (ML) model using the expressive representations, and determining a missing symbol of at least one of the functions based on an output of the ML model. Information relating to functions is and interactions between functions are used to train an ML to determine similarity of two functions. Based on similarities, missing symbols may be inferred and used to enable updates to the stripped binary file where source code is not available.