CP - BCS : Binary Code Summarization Guided by Control Flow Graph and Pseudo Code (2023)

Abstract: Automatically generating function summaries for binaries is an extremely valuable but challenging task, since it involves translating the execution behavior and semantics of the low-level language (assembly code) into human-readable natural language. However, most current works on understanding assembly code are oriented towards generating function names, which involve numerous abbreviations that make them still confusing. To bridge this gap, we focus on generating complete summaries for binary functions, especially for stripped binary (no symbol table and debug information in reality). To fully exploit the semantics of assembly code, we present a control flow graph and pseudo code guided binary code summarization framework called CP-BCS. CP-BCS utilizes a bidirectional instruction-level control flow graph and pseudo code that incorporates expert knowledge to learn the comprehensive binary function execution behavior and logic semantics. We evaluate CP-BCS on 3 different binary optimization levels (O1, O2, and O3) for 3 different computer architectures (X86, X64, and ARM). The evaluation results demonstrate CP-BCS is superior and significantly improves the efficiency of reverse engineering.

## introduction most commercial off-the-shelf software is closedsource and typically distributed as stripped binaries that lack a symbol table or any debug information (e.g., variable names, function names). this practice is mainly done for easy distribution, copyright protection, and malicious evasion. professionals seeking to analyze these stripped binaries must perform reverse engineering and inspect the logic at the binary level. while current binary disassemblers, such as ida pro @xcite and @xcite , can translate machine code into assembly code, the assembly representation only consists of plain instruction mnemonics we argue that generating a high-quality descriptive summary is a more direct and fundamental approach to strike at the essence compared to function name prediction (e.g., "free all resources associated with context_handle." in the figure 1 ). similar tasks have been extensively studied at the source code level (known as source code summarization) for languages such as python and java @xcite @xcite . at the source code level, researchers typically rely on advanced code analysis tools to extract fine-grained code structure properties and leverage the high-level semantic information inherent in the source code itself. however, assembly code, a low-level language, often lacks high-level, human-readable information and is prone to ambiguity. moreover, the absence of fine-grained assembly code analysis tools makes it more challenging to gain a semantic understanding of assembly code. furthermore, we discover that current large language models, such as chatgpt @xcite , generally possess only a rudimentary understanding of assembly code without high-level abstract semantic comprehension (shown in appendix a). in this paper, we specifically concentrate on binary code summarization in stripped scenarios, which is a highly practical setting, and present cp-bcs. the novel cp-bcs framework comprehensively represents the execution behavior and semantics of assembly code from three different perspectives inspired by observing how human engineers analyze assembly code in practice. (1) assembly instruction: the assembly instructions themselves provide certain features such as memory operations and setting of register values. in addition, we also take into account some meaningful strings that remained in stripped binaries, such as the name of externally called function. (2) control flow graph: to obtain the logical execution order of the assembly code, we extract the control flow graph (cfg) of the assembly code. considering the order relationship between adjacency instruction, we augment the original basic-block level cfg to a bidirectional instruction-level control flow graph (bi-cfg). (3) pseudo code: due to the difficulty of understanding assembly code, plugins that attempt to decompile assembly code into high-level, c-like language (known as pseudo code) are available. although many of the resulting pseudo codes are imprecise and usually cannot be compiled, it still encompasses expert knowledge and understanding derived from human reverse engineers. furthermore, considering the lack of meaningful high-level strings in pseudo code in realistic scenarios, inspired by pre-trained models such as codet5's @xcite great performance in source code-related tasks, we explore the potential of utilizing such pre-trained models to recover missing semantic strings in pseudo code on stripped binaries. our objective is to further narrow the gap between pseudo code and natural language by leveraging the capability of pre-trained models. to facilitate further research in this area, we have made our dataset and code publicly available foot_0 . in summary, the contributions of this paper can be outlined as follows: in particular, the human evaluation indicates that cp-bcs can significantly improve the efficiency of reverse engineers' comprehension of binary functions. cfg mov rax, [rdi] test rax, rax jz short loc_81752d04 push rbp mov rbp, rsp push rbx mov rbx, rdi mov rdi, [rax+8] test rdi, rdi jz short loc_81752ce2 mov rax, [rax] mov rax, [rax+48h] call qword ptr [rax+28h] mov rax, [rbx] mov rdi, [rax] call sub_8175287f mov rdi, [rbx] ...... pop rbx pop rbp retn __int64 __fastcall sub_ffffffff81752cbf(_qword *a1) {_qword *v1; // rax @xmath0; if ( !*a1 ) return 0x80000ll; if ( v1[1] ) (*(void (**)(void))(*(_qword *) (*v1 + 72ll) + 40ll))(); sub_ffffffff8175287f(*(_qword *)*a1); sub_ffffffff8114766e(*a1); *@xmath1; return 0ll;} pseudo code 3 1 2 bi-cfg bi-cfg encoder 4 5 pseudo code encoder fine-tuned codet5 refined pseudo code assembly instruction encoder mov rax [rdi]test string feature masked self attention pseudo code multi-head cross attention assembly code multi-head cross-attention bi-cfg multi-head cross-attention feed forward network decompilation construction assembly code mov rax, [rdi] test rax, rax jz short loc_81752d04 push rbp mov rbp, rsp ...... mov eax, 0 pop rbx pop rbp retn not solved the ambiguous function name issues. xfl @xcite performs multilabel classification and learns an xml model to predict common tokens found in the names of functions from c binaries in debian. as xfl predicts labels instead of whole function names, it is able to predict names for functions even when no function of that name is contained in the training set. the biggest difference between them and us is that we directly generate function summary sentences rather than a few function name tokens. ## conclusion in this paper, we propose the cp-bcs framework, a novel approach that makes use of the control flow graph and pseudo code guidance. we manually construct the corresponding dataset that takes into account real-world scenarios. finally, extensive experiments, ablation studies, and human evaluations demonstrate the effectiveness of cp-bcs. in practical applications, cp-bcs can significantly aid reverse engineers and security analysts in efficiently comprehending assembly code. we hope that our work can serve as a baseline while further prompting the development of this field.