lt-asset/resymFor our CCS24 paper 🏆 "ReSym: Harnessing LLMs to Recover Variable and Data Structure Symbols from Stripped Binaries" by Danning Xie, Zhuo Zhang, Nan Jiang, Xiangzhe Xu, Lin Tan, and Xiangyu Zhang. 🏆 ACM SIGSAC Distinguished Paper Award Winner
Ce dépôt fournit les artefacts de l'article « ReSym: Harnessing LLMs to Recover Variable and Data Structure Symbols from Stripped Binaries » (CCS 2024).
🏆 Lauréat du prix ACM SIGSAC Distinguished Paper Award
Remarque : Nous maintenons et mettons à jour activement nos artefacts. Veuillez vous assurer d'utiliser la dernière version.
process_data. Il génère des données d'entraînement avec les informations de symboles de vérité terrain. Le script s'exécute en une seule commande (push-button) et les instructions d'utilisation sont fournies dans le dossier.ReSym_rawdata). Cela inclut les fichiers binaires bruts et le code décompilé correspondant que nous avons utilisés dans ce projet :
bin/ : Contient les fichiers binaires non strippés bruts avec les informations de débogage.decompiled/ : Code décompilé à partir de binaires entièrement strippés.metadata.json : Métadonnées des binaires, y compris les informations sur le projet.training_src pour les modèles VarDecoder et FieldDecoder.ReSym_data). Cela inclut : les données d'entraînement, les données de test et les résultats de prédiction pour FieldDecoder et VarDecoder.posterior_reasoning. Les détails et instructions se trouvent dans ce dossier.training_src.@inproceedings{10.1145/3658644.3670340,
author = {Xie, Danning and Zhang, Zhuo and Jiang, Nan and Xu, Xiangzhe and Tan, Lin and Zhang, Xiangyu},
title = {ReSym: Harnessing LLMs to Recover Variable and Data Structure Symbols from Stripped Binaries},
year = {2024},
isbn = {9798400706363},
publisher = {Association for Computing Machinery},
address = {New York, NY, USA},
url = {https://doi.org/10.1145/3658644.3670340},
doi = {10.1145/3658644.3670340},
abstract = {Decompilation aims to recover a binary executable to the source code form and hence has a wide range of applications in cyber security, such as malware analysis and legacy code hardening. A prominent challenge is to recover variable symbols, including both primitive and complex types such as user-defined data structures, along with their symbol information such as names and types. Existing efforts focus on solving parts of the problem, e.g., recovering only types (without names) or only local variables (without user-defined structures). In this paper, we propose ReSym, a novel hybrid technique that combines Large Language Models (LLMs) and program analysis to recover both names and types for local variables and user-defined data structures. Our method encompasses fine-tuning two LLMs to handle local variables and structures, respectively. To overcome the token limitations inherent in current LLMs, we devise a novel Prolog-based algorithm to aggregate and cross-check results from multiple LLM queries, suppressing uncertainty and hallucinations. Our experiments show that ReSym is effective in recovering variable information and user-defined data structures, substantially outperforming the state-of-the-art methods.},
booktitle = {Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security},
pages = {4554–4568},
numpages = {15},
keywords = {large language models, program analysis, reverse engineering},
location = {Salt Lake City, UT, USA},
series = {CCS '24}
}