Neural Nets Can Learn Function Type Signatures From Binaries
summary
A system called EKLAVYA trains instruction embeddings plus a 3-layer GRU to infer function argument count and coarse types from disassembled binaries without any instruction-set semantics, using compiled programs for ground truth. It learns semantic relationships (analogy-style embeddings), exposes decisions with gradient-based saliency maps, and achieves roughly 84% accuracy for argument count and ~81% for type recovery across x86/x64 on ~60k sanitized functions per architecture. Accuracy drops on optimized or register-reusing binaries.
AI-written summary · about
chapters (15)
- 0:00Intro
- 0:27Importance of Function Type Recovery
- 2:00Existing Practice: How an analyst does it?
- 4:12A New Approach
- 5:23Contributions
- 6:05The Learning Problem
- 8:27Intuition
- 10:50Prediction Model
- 12:21Analysis Techniques: Saliency Maps
- 14:25Example of Saliency Maps
- 16:39Architectural Overview of EKLAVYA
- 17:51Experimental Setup - Dataset
- 18:21Dataset Sanitization
- 19:55Accuracy Results Summary
- 22:28Conclusion
related talks
14mNeural Reverse Engineering of Stripped Binaries using Augmented Control Flow Graphs
40mAttention Is All You Need for Semantics Detection:A Novel Transformer on Neural…
40mYou can AI like an Expert
48mKeynote – Sameer Singh
46mCode + AI: Will Robots Take Our Coding Jobs? ML Applied to Programming
18mActive Learning for Neurosymbolic Program Synthesis
27mPattern Analysis: Learned vs. Engineered
37mNeural Networks are Programs, Too