control-flow reconstruction

Static analysis struggles to reconstruct complete control flow graphs for binaries employing dynamic loading techniques—such as packed programs and modern malware—due to unresolved indirect calls. This work proposes a novel approach that integrates symbolic execution with speculative library preloading. By deploying custom hooks during symbolic execution, the method intercepts dynamic loading operations in real time, speculatively preloads required libraries, and synchronously tracks instructions while managing intercepted functions—all without executing potentially malicious code. Consequently, it safely recovers accurate control flow graphs. Experimental evaluation on 16 synthetic benchmarks demonstrates that, compared to pure static analysis, the proposed technique recovers on average 29.8% more nodes and 26.5% more edges, while achieving 100% precision and recall in library identification.

Existing approaches for variable type recovery in binary code suffer from low accuracy due to real-world challenges—including cross-function type propagation, skewed type distributions, and interference from compiler optimizations. Method: We propose the first holistic framework that decouples (1) target type set construction, (2) cross-function data-flow tracing, and (3) joint modeling via gated graph neural networks (GGNNs). Crucially, it is the first to systematically characterize how compiler optimizations perturb type-relevant features. The method synergistically integrates precise static analysis with long-range dependency modeling. Contribution/Results: Our approach achieves significant improvements over state-of-the-art methods on the TYDA multi-architecture benchmark. In practical CTF scenarios, the decompiled pseudocode exhibits superior readability compared to outputs from IDA Pro and Ghidra, substantially accelerating reverse-engineering workflows.

This work addresses the inefficiency of traditional fuzzing in black-box or obfuscated binary programs where static instrumentation is infeasible and control-flow feedback is unavailable. The authors propose a dynamic feedback mechanism based on Execution Divergence Graphs (EDGs), which constructs control-flow-like structures at runtime by analyzing execution traces to precisely identify path divergences and avoid redundant exploration of loops. Requiring no static program information, the approach integrates divergence detection with an EDG-guided input mutation strategy. Evaluated on multiple obfuscated targets, it substantially outperforms blind fuzzers, demonstrating its effectiveness in non-instrumented settings. Furthermore, the framework is extensible to multidimensional feedback channels, such as power consumption, broadening its applicability in side-channel-aware fuzzing scenarios.

This work addresses the challenges posed by Go-language malware to traditional static analysis and memory forensics, stemming from its statically linked binaries, intricate runtime structures, and absence of type information. The paper presents the first memory forensic framework specifically designed for Go malware, built upon Volatility 3. By dissecting Go runtime internals, the framework systematically reconstructs active execution states through ABI-aware call stack unwinding, goroutine stack traversal, and recovery of heap-allocated strings and associated metadata. Evaluated on real-world samples including BRICKSTORM, Obscura, and Pantegana, the approach successfully extracts critical artifacts such as C2 addresses, persistence mechanisms, encryption keys, and ransom notes—some of which surpass existing threat intelligence reports—thereby filling a significant gap in dynamic analysis capabilities for Go-based malware.

Existing program behavior prediction models struggle to effectively capture dynamic inter-statement dependencies, limiting their performance in code coverage prediction and runtime error detection. To address this, we propose a dual-path joint modeling framework: (1) a static path that encodes control dependencies via control flow graphs (CFGs) and graph neural networks; and (2) a dynamic path that learns temporal execution dependencies from program execution traces. Crucially, we introduce node-level dual-path embedding to enable fine-grained, unified representation of both static and dynamic dependencies. To the best of our knowledge, this is the first work to jointly and coherently model static control-flow dependencies and dynamic execution-time dependencies within a single framework. Evaluated on code coverage prediction and runtime error localization tasks, our approach achieves significant improvements over state-of-the-art methods—yielding a 12.3% gain in prediction accuracy and an 18.7% increase in error localization precision.

This study addresses the inefficiency of manual reverse engineering caused by control-flow obfuscation techniques—such as control-flow flattening and opaque predicates—by systematically introducing Chain-of-Thought (CoT) prompting into code deobfuscation for the first time. The proposed approach guides large language models (LLMs) through step-by-step reasoning to simultaneously recover both program structure and semantics. Experimental evaluation on a standard C-language benchmark, involving five state-of-the-art LLMs, demonstrates that CoT significantly enhances the accuracy of control-flow graph reconstruction and semantic fidelity. Notably, GPT-5 achieves the best performance, yielding average improvements of 16% in control-flow graph reconstruction accuracy and 20.5% in semantic preservation over zero-shot prompting, thereby validating the method’s effectiveness and novelty.

Existing debugging tools excel at verifying hypotheses but struggle to support hypothesis generation, as programmers must manually reconstruct the program’s state evolution. This work proposes a novel debugging paradigm centered on complete execution traces, leveraging program tracing techniques to record and temporally visualize the actual code paths executed, rather than relying on the static structure of the source code. By presenting runtime behavior in a chronological and contextualized manner, this approach significantly enhances the comprehensibility of program execution, thereby facilitating more efficient hypothesis generation during debugging. We implement a prototype system and conduct preliminary experiments that demonstrate its effectiveness in improving program understanding efficiency, while also uncovering key challenges and promising directions for future research.

This work addresses the challenging problem of recovering original source code from stripped binary functions, a task where traditional decompilation typically yields only approximate pseudocode. The paper proposes a novel paradigm that replaces pseudocode generation with direct source code retrieval. By extracting anchors such as strings and constants from binaries, the method retrieves candidate functions from a source code corpus and constructs a multimodal representation incorporating assembly instructions, decompiled code, and metadata. A large language model (LLM) is then employed for semantic re-ranking of candidates. The approach integrates Ghidra-based static analysis with an inverted index system and introduces an iterative anchor refinement strategy. Evaluated on a high-quality tcpdump dataset, it achieves 95.2% instruction coverage, and attains 35.5% coverage on general-purpose GitHub repositories, demonstrating effectiveness in both ideal and noisy real-world scenarios.

Automated analysis of programmable logic controller (PLC) binary programs faces significant challenges, including cross-platform format heterogeneity, entanglement of control logic with runtime code, and insufficient semantic representation. This work proposes PLC-BinX, the first approach to achieve function-level semantic recovery across four major PLC platforms. By integrating cross-platform reverse engineering, precise function boundary identification, and semantic feature extraction, PLC-BinX constructs a unified and interpretable function-level semantic representation framework that supports downstream learning tasks. Experimental results demonstrate that the method achieves 100% precision, recall, and F1 score in toolchain prediction and attains an F1 score of 49.18% across 22 functional classification tasks.