Virtual Compiler Is All You Need For Assembly Code Search (2024)

Abstract: Assembly code search is vital for reducing the burden on reverse engineers, allowing them to quickly identify specific functions using natural language within vast binary programs.Despite its significance, this critical task is impeded by the complexities involved in building high-quality datasets. This paper explores training a Large Language Model (LLM) to emulate a general compiler. By leveraging Ubuntu packages to compile a dataset of 20 billion tokens, we further continue pre-train CodeLlama as a Virtual Compiler (ViC), capable of compiling any source code to assembly code. This approach allows for “virtual” compilation across a wide range of programming languages without the need for a real compiler, preserving semantic equivalency and expanding the possibilities for assembly code dataset construction. Furthermore, we use ViC to construct a sufficiently large dataset for assembly code search. Employing this extensive dataset, we achieve a substantial improvement in assembly code search performance, with our model surpassing the leading baseline by 26%.

## introduction reverse engineering frequently entails the challenging task of swiftly locating specific functions within extensive binary files, such as those associated with malicious behavior. traditionally, reverse engineers rely on the tedious approach of searching for unique strings (hex-rays, 2023a) or constants (polymorf, 2020) to locate these functions. this practice often leads to inefficiency as it heavily relies on experience or heuristic algorithms, frequently consuming considerable time. we observe that the specific search requirements articulated by reverse engineers could often be distilled into natural language descriptions. this realization sparked the idea of employing a code * corresponding author search @xcite perspective to refine the extant methodologies. code search has achieved substantial success in highlevel programming languages, garnering wide commercial application @xcite . assembly code search enables users to search the assembly (i.e. assembly code) function with natural language, enhancing user interaction with binary executable files through natural language. the construction of assembly code search datasets presents considerable difficulty. unlike high-level programming languages where datasets can be readily created by parsing the docstring of function, constructing an assembly code search dataset entails an obligatory compilation step from source code to assembly code. it is exemplified by the work conducted in nova + @xcite . despite attempts to compile over 4 million c programs and 1 million c++ programs, only 32,774 c programs and 40,087 c++ programs were successfully compiled. numerous compilation failures stem from the complex compilation environment, including diverse dependencies and variations in optimization levels and compilers, greatly complicating dataset construction. previous efforts target the compilation challenges of single-source c functions through type inference or neural compilation (da @xcite @xcite . yet, the practical utility of these advancements is constrained by the scarce availability of code search datasets for c language. inspired by meta's use of large language models (llms) for compiler optimization @xcite , we postulate a novel modeling paradigm-let llms emulate a general compiler and understand the comprehensive compilation process, including optimization options and assembly code generation. this method not only enables us to utilize the previous code search dataset in c/c++ language like ccsd @xcite but also demonstrates the capability to generalize across languages such as python and golang, despite only being trained on c/c++ source and assembly code pairs. this flexibility suggests the potential of applying extensive datasets from prior works, like codesearchnet @xcite , to the realm of assembly code search, addressing the historical constraints of dataset scarcity in this field. addressing the challenges in assembly code search and the shortcomings of current methodologies, our work makes the following contributions: we introduce a novel approach, vic for creating an assembly code search dataset. by employing the virtual compiler, we generate a diverse and robust dataset that circumvents the traditional barriers related to compilation challenges, vastly enriching the resources available for assembly code search tasks. ## overview we present our workflow in figure 2 , with three phases to advance assembly code search capabilities. initially, we compile a vast collection of packages from ubuntu to obtain a mapping between source and assembly code. following this, we train the codellama model on this massive dataset to emulate compiler behavior (section 4). lastly, leveraging this model, we perform virtual compilations on existing code search datasets to produce an augmented assembly code search dataset. this enriched dataset then informs the training of an assembly code encoder, yielding a refined model for effective assembly code search (section 5). ## evaluation 6.1 evaluation setup we implement vic using pytorch 2.1 @xcite . we use ida pro 8.3 (hex-rays, 2023b) to disassemble and extract the functions from the binary executable file in all of the experiments. our training and experiments are conducted on several servers to accelerate training. the cpu setup is 128 cores with 2tb ram for each server. the total gpu setup is 32 nvidia tesla a100. ## conclusion in this study, we introduce a pioneering method to improve assembly code search by training an llm to function as a virtual compiler, vic, effectively addressing the challenge of compiling difficulties and enhancing dataset quality for assembly code. this approach not only broadens the scope of languages compilable to assembly but also significantly boosts the performance of assembly code search tasks, outperforming all the existing solutions. our results demonstrate the potential of virtual compilers to revolutionize reverse engineering processes, offering a promising direction for future advancements in software engineering and security analysis.