Abstract:Security experts reverse engineer (decompile) binary code to identify critical security vulnerabilities. The limited access to source code in vital systems - such as firmware, drivers, and proprietary software used in Critical Infrastructures (CI) - makes this analysis even more crucial on the binary level. Even with available source code, a semantic gap persists after compilation between the source and the binary code executed by the processor. This gap may hinder the detection of vulnerabilities in source code. That being said, current research on Large Language Models (LLMs) overlooks the significance of decompiled binaries in this area by focusing solely on source code. In this work, we are the first to empirically uncover the substantial semantic limitations of state-of-the-art LLMs when it comes to analyzing vulnerabilities in decompiled binaries, largely due to the absence of relevant datasets. To bridge the gap, we introduce DeBinVul, a novel decompiled binary code vulnerability dataset. Our dataset is multi-architecture and multi-optimization, focusing on C/C++ due to their wide usage in CI and association with numerous vulnerabilities. Specifically, we curate 150,872 samples of vulnerable and non-vulnerable decompiled binary code for the task of (i) identifying; (ii) classifying; (iii) describing vulnerabilities; and (iv) recovering function names in the domain of decompiled binaries. Subsequently, we fine-tune state-of-the-art LLMs using DeBinVul and report on a performance increase of 19%, 24%, and 21% in the capabilities of CodeLlama, Llama3, and CodeGen2 respectively, in detecting binary code vulnerabilities. Additionally, using DeBinVul, we report a high performance of 80-90% on the vulnerability classification task. Furthermore, we report improved performance in function name recovery and vulnerability description tasks.

Multi-modal Learning for WebAssembly Reverse Engineering

StackSight: Unveiling WebAssembly through Large Language Models and Neurosymbolic Chain-of-Thought Decompilation

WaDec: Decompiling WebAssembly Using Large Language Model

WasmWalker: Path-based Code Representations for Improved WebAssembly Program Analysis

Disassembling Obfuscated Executables with LLM

Wasm-Mutate: Fast and effective binary diversification for WebAssembly

Semantics-Recovering Decompilation through Neural Machine Translation

HexT5: Unified Pre-Training for Stripped Binary Code Information Inference.

Hierarchical Multimodal Pre-training for Visually Rich Webpage Understanding

JABBERWOCK: A Tool for WebAssembly Dataset Generation and Its Application to Malicious Website Detection

SeeWasm: An Efficient and Fully-Functional Symbolic Execution Engine for WebAssembly Binaries

Madvex: Instrumentation-based Adversarial Attacks on Machine Learning Malware Detection

Neural reverse engineering of stripped binaries using augmented control flow graphs

Extracting Multiple Visual Senses for Web Learning

Is a Single Model Enough? MuCoS: A Multi-Model Ensemble Learning Approach for Semantic Code Search

SoK: Analysis techniques for WebAssembly

Rephrasing the Web: A Recipe for Compute and Data-Efficient Language Modeling

Leveraging Multi-modal Prior Knowledge for Large-scale Concept Learning in Noisy Web Data.

Active Assembly Guidance with Online Video Parsing

Enhancing Reverse Engineering: Investigating and Benchmarking Large Language Models for Vulnerability Analysis in Decompiled Binaries

Nova: Generative Language Models for Assembly Code with Hierarchical Attention and Contrastive Learning