## 4 The Design of GeneDiff
### Semantic Representation Model  
Inspired by the PV-DM model, we proposed a novel semantic-based representation learning model for binaries. In this semantic representation model, every VEX instruction is treated as a letter, and combinations of VEX instructions are regarded as words in the NLP models, basic blocks are regarded as sentences, and functions are regarded as paragraphs. Therefore, the model for the semantic representation vector of functions can learn from the model of paragraph vectors, although they have certain differences. Compared with the extraction of paragraph vectors, the extraction of the function vector differs primarily in the following ways: (i) the calling relationships between functions are complex, (ii) the execution flows of the functions have multiple paths, and (iii) each expression consists of multiple parts. To address these differences, GeneDiff utilizes the following scheme. **Callee expansion**. In software code, a function often calls another function (the _callee_) to achieve some goals. When compiling source code into binary files, the compiler may apply compiler optimization techniques to these functions. Function inlining is one such compiler optimization technique. This technique can extend callees in callers to eliminate the call overhead and improve the performance of the binaries. In binary similarity comparisons, however, such techniques may produce obstacles because they substantially modify the control flow graph of the caller function. Figure 5 shows three examples of calling a function. Figure 5a,b perform the same function using a normal call and function inlining, respectively. When using function inlining, the CFG of the function of Figure 5b is significantly different from the CFG of the original function in Figure 5a. To perform a similarity comparison in this case, if callee expansion of the original function is not performed, the two functions may be considered as different. If we use callee expansion for all callees without distinction, then the situation in Figure 5c will be questionable. In Figure 5c, the length of the callee is much greater than the length of the original function. Thus, callee expansion of the callee (_sub_400526_) in the original function may cause the expanded original function to be similar to the callee. Considering the above cases, the callee expansion approach used by GeneDiff is shown in Algorithm 1. We use \(f\) to represent the original function, \(f_{c}\) to represent a callee function, and \(\|f\|\) to indicate the instruction length of \(f\). GeneDiff does not expand callees when they satisfy the following two conditions: (i) callees are not in the list of the data repository (Algorithm 1, Line 3), (ii) the ratio of \(\|f_{c}\|\) to \(\|f\|\) is greater than a _threshold_, and \(\|f_{c}\|\) is greater than \(numIns\). In this study, \(numIns\) and _threshold_ are set to 10 and 0.5 respectively. **Multi-path generation**. In assembly functions, instructions are usually not executed in order, and there are usually multiple execution paths. Given a function \(f\), we obtain a CFG \(G_{f}\) from the data repository of GeneDiff. Then, we randomly pick edges from \(G_{f}\) and expand them into sequences \(seq\) until all the basic blocks in \(G_{f}\) are fully covered. The pseudocode of this multi-path generation process is given in Algorithm 2. Figure 5: Examples of calling a function. (**a**) An example of calling a function normally; (**b**) an example of calling a function using inlining; (**c**) an example of calling a function that possesses more than 100 instructions and whose control flow graph is complicated. ```
Input: A given function \(f\). Output: A collection of multiple paths Paths.