Transformer Function Symbol Inference from Stripped Assembly
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional binary reverse engineering techniques struggle to infer function symbols from stripped executable binaries, leading to performance degradation and limitations in recovering lost information during the compilation stage.
Innovation Solution
A transformer-based function symbol inference model is employed, utilizing Byte-Pair-Encoding tokenization and positional embedding to infer function symbols without code normalization, with an encoder and decoder architecture of two to four layers, and applying Unique-softmax for attention value calculation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional static or dynamic binary analysis techniques are used to infer function symbols from stripped executable binaries, then the analysis process can be performed, but the performance is degraded and the ability to recover lost information is limited
Solution Approach 1:
The patent replaces traditional mechanical binary analysis techniques (static analysis, dynamic analysis, assembly code inference) with an AI-based transformer model that uses deep learning to infer function symbols. The model takes assembly code as input and directly predicts function symbol names, eliminating the need for complex manual analysis pipelines and achieving superior accuracy in recovering lost debugging information.
2Ease of manufacture
If code normalization techniques are applied to assembly code before input to inference models, then specific code information can be selectively utilized, but performance degrades due to arbitrary manipulation of potentially useful information
Solution Approach 1:
The patent extracts only the essential normalization step (Byte-Pair-Encoding tokenization) while removing all other code normalization operations that manipulate assembly code. By taking out the harmful normalization steps that arbitrarily modify potentially useful information, the model receives raw, unmanipulated assembly code that retains all original information while still being processed into a suitable format for neural network input.
3Measurement precision
If deep learning models with complex architectures are used to infer function symbols, then inference accuracy improves, but the time required for binary analysis increases
Solution Approach 1:
The patent employs a dynamic transformer-based architecture with encoder-decoder layers that can adaptively process assembly code sequences of varying lengths. The model dynamically adjusts its computation based on input characteristics, using attention mechanisms to focus on relevant code portions. This dynamic approach maintains high inference accuracy while optimizing processing speed, achieving 100 function inferences in approximately 30 milliseconds.
Data Source
AI summary
Disclosed is a method inferring function symbol names from assembly code in an executable binary with transformer-based architecture on a computing apparatus having at least one processor. The method includes: performing BPE (Byte-Pair-Encoding) tokenization on the assembly code, without code normalization for using the assembly code as an input to the inference model; and inferring the function symbols based on the input. The inference model performs operations as follows: at each layer of an encoder and decoder, normalizing input tokens by grouping similar tokens in an input vector and then dividing each group by a sum of unique values, and applying positional embedding at each layer of the encoder.