bytecode parsing

Existing approaches for variable type recovery in binary code suffer from low accuracy due to real-world challenges—including cross-function type propagation, skewed type distributions, and interference from compiler optimizations. Method: We propose the first holistic framework that decouples (1) target type set construction, (2) cross-function data-flow tracing, and (3) joint modeling via gated graph neural networks (GGNNs). Crucially, it is the first to systematically characterize how compiler optimizations perturb type-relevant features. The method synergistically integrates precise static analysis with long-range dependency modeling. Contribution/Results: Our approach achieves significant improvements over state-of-the-art methods on the TYDA multi-architecture benchmark. In practical CTF scenarios, the decompiled pseudocode exhibits superior readability compared to outputs from IDA Pro and Ghidra, substantially accelerating reverse-engineering workflows.

This work addresses the challenging problem of recovering original source code from stripped binary functions, a task where traditional decompilation typically yields only approximate pseudocode. The paper proposes a novel paradigm that replaces pseudocode generation with direct source code retrieval. By extracting anchors such as strings and constants from binaries, the method retrieves candidate functions from a source code corpus and constructs a multimodal representation incorporating assembly instructions, decompiled code, and metadata. A large language model (LLM) is then employed for semantic re-ranking of candidates. The approach integrates Ghidra-based static analysis with an inverted index system and introduces an iterative anchor refinement strategy. Evaluated on a high-quality tcpdump dataset, it achieves 95.2% instruction coverage, and attains 35.5% coverage on general-purpose GitHub repositories, demonstrating effectiveness in both ideal and noisy real-world scenarios.

Cross-compiling legacy C/C++ code to WebAssembly (Wasm) frequently incurs semantic divergence, silent miscompilation, and compilation failures, undermining reliability. Method: We propose WasmChecker, the first differential-testing framework for semantic equivalence verification of Wasm compilation. It employs binary-level semantic comparison, cross-platform compilation analysis, and an empirical study across 115 open-source projects. Contribution/Results: Our analysis systematically identifies four root causes of semantic deviation: standard library inconsistencies, missing system calls, Wasm-specific constraints, and compiler bugs. WasmChecker discovers and confirms 11 previously unknown vulnerabilities in Emscripten. We publicly release the WasmChecker framework and a benchmark dataset, providing the first quantitative evidence that mainstream Wasm compilers exhibit significant semantic non-fidelity. This work has directly driven critical fixes in Emscripten.

Traditional large language models struggle to directly process raw bytes of executable files, limiting their applicability to binary understanding tasks such as malware analysis. This work proposes the first large language model natively designed for byte-level input, integrating a custom byte tokenizer, byte-level language modeling, and injection of binary-domain knowledge to enable semantic understanding and question answering over compiled code. Experimental results demonstrate that the proposed approach achieves 69% accuracy in malware family classification and 98% accuracy in architecture classification, substantially outperforming general-purpose large language models. These findings underscore the effectiveness and necessity of native byte-level modeling combined with domain-specific knowledge for advancing binary analysis capabilities.

This work addresses the challenge of efficient and scalable formal verification of concurrency properties—such as deadlock—in Java bytecode by proposing a Petri net–based modeling and analysis approach. The method precisely encodes bytecode semantics into Petri nets and leverages the mature model checker LoLA to enable automated verification of concurrent behaviors. Notably, this is the first application of Petri nets to concurrency analysis of Java bytecode, supporting multiple Java versions and partial Kotlin programs, thereby overcoming language-version limitations of existing tools. The prototype implementation, jPetrify, demonstrates high precision and strong scalability in verifying fundamental concurrency properties like deadlock, with performance largely insensitive to parameter scale.

This study investigates whether pretrained code models encode cross-lingually consistent formal type semantics in their hidden representations. To this end, the authors construct a parallel Java–Python code dataset and employ linear probing on residual stream activations to analyze how type information is represented. They further design cross-lingual transfer experiments to assess whether models can recover formal type annotations from untyped code. This work presents the first direct interpretability analysis targeting formal type semantics and cross-lingual representation alignment in pretrained models. The results demonstrate that such models indeed learn transferable, cross-lingually aligned type structures, and that these representations exhibit robustness to lexical perturbations and syntactic discrepancies between languages.

This work addresses the challenge posed by syntactic disparities across programming languages in cross-lingual code understanding tasks. The authors propose a novel approach that integrates standardized abstract syntax tree (AST) node labels with a Graph Matching Network (GMN) to enable precise alignment of functionally equivalent code fragments within a shared semantic space. By unifying AST label normalization and GMN for the first time, the method effectively bridges the syntactic gap between languages. Experimental results demonstrate significant improvements over state-of-the-art techniques: on cross-language code clone detection, the model achieves an F1 score of 99.93%, representing a nearly 3% absolute gain, while cross-language code retrieval performance improves by 13% in Mean Reciprocal Rank (MRR).

This work addresses the challenges posed by Go-language malware to traditional static analysis and memory forensics, stemming from its statically linked binaries, intricate runtime structures, and absence of type information. The paper presents the first memory forensic framework specifically designed for Go malware, built upon Volatility 3. By dissecting Go runtime internals, the framework systematically reconstructs active execution states through ABI-aware call stack unwinding, goroutine stack traversal, and recovery of heap-allocated strings and associated metadata. Evaluated on real-world samples including BRICKSTORM, Obscura, and Pantegana, the approach successfully extracts critical artifacts such as C2 addresses, persistence mechanisms, encryption keys, and ransom notes—some of which surpass existing threat intelligence reports—thereby filling a significant gap in dynamic analysis capabilities for Go-based malware.

This work addresses the challenge of reliable source-level binary patching in the absence of original source code and toolchains, where existing decompilers often produce outputs riddled with syntactic and semantic errors. To overcome this limitation, the authors propose a static patching framework that integrates decompilation with binary-aware recompilation. By leveraging information extracted directly from the original binary, the framework corrects semantic distortions in decompiled code and enables automated patch generation. The approach substantially improves recompilation correctness, fixing approximately 81% of erroneous functions produced by Hex-Rays, successfully patching 13 out of 14 real-world CVEs, and increasing user experiment success rates from 3.7% to 100%. Furthermore, it supports large-model-driven fully automated patching, demonstrating robust practical applicability.

Static analysis struggles to reconstruct complete control flow graphs for binaries employing dynamic loading techniques—such as packed programs and modern malware—due to unresolved indirect calls. This work proposes a novel approach that integrates symbolic execution with speculative library preloading. By deploying custom hooks during symbolic execution, the method intercepts dynamic loading operations in real time, speculatively preloads required libraries, and synchronously tracks instructions while managing intercepted functions—all without executing potentially malicious code. Consequently, it safely recovers accurate control flow graphs. Experimental evaluation on 16 synthetic benchmarks demonstrates that, compared to pure static analysis, the proposed technique recovers on average 29.8% more nodes and 26.5% more edges, while achieving 100% precision and recall in library identification.