Type Inference Assisted By Instruction Context

Binary analysis is a powerful way to eliminate code defects.It requires the understanding of program function and logic,which is based on variable information within that binary.However,for closed-source software,or COTS,this information is stripped.At present,many works aim to recover variable information.They rely on pre-defined rules to extract data dependencies and then infer further information.However,they encounter three major problems.Firstly,as compilers develop,some rules should be updated.Secondly,for some variables that only participate in few operations,their features are far from enough.Lastly,variables of different types might have the same features.To overcome the problems mentioned above,we introduce Variable Usage Context to enrich features of variables.Then,by using word embedding technique,we could automatically vectorize assembly code of different architectures while preserving semantics.Finally,a simple neural network takes the vectors as input to infer types.On this basis,we implement an intelligent cross-architecture type inference system.Compared to previous works,the accuracy increases significantly.On x86?64,the most widely-used architecture at present,the accuracy increase from 73% to 86% under the same measurement.Our contributions are:1)We analyze over 16,000 stripped binaries on different architectures,by different compilers and using different optimizations.We analyze the severity of missing data dependencies.Thus we give a theoretical upper limit for the accuracy.2)Based on our analysis,we find that the neighboring instructions of target variable instructions are likely to operate variables of the same type.Thus,they are encoded together as a feature of the target variable.We leverage this to build a new type inference system.3)We conduct a thorough evaluation on binary compiled with different architectures,compilers,optimizations and prove the effectiveness of our system.