Hieronym: Leveraging Hierarchical Multi-Source Information for Function Renaming in Stripped Binary

2026-09-11

AI Summary

本文提出Hieronym，一种基于生成式大语言模型的框架，通过整合多层次信息提高被剥离二进制文件函数重命名的准确性与可读性。

Abstract

Function renaming in stripped binaries can substantially assist reverse engineers by improving code readability, yet it is a challenging task. The difficulty stems from the need to accurately capture function semantics from low-level binary code across diverse instruction sets, architectures, and compiler optimizations, and to express these semantics in concise, human-readable names. Existing approaches either inadequately capture comprehensive function semantics or exhibit limited generalization to previously unseen binaries. In this paper, we present Hieronym, a generative large language model (LLM)-based framework for stripped binary function renaming. Hieronym adopts a hierarchical summarization-driven domain adaptation strategy and integrates multi-source information, including global binary context, local calling context, and intrinsic function semantics, to enhance the LLM's understanding of binary code. To enable systematic evaluation, we further propose a dual-layer evaluation framework that incorporates both token-level and whole-name-level metrics. We evaluate Hieronym on binary functions compiled with four compiler optimization levels (O0-O3) for four architectures (x64, x86, ARM, and MIPS). Experimental results demonstrate that Hieronym significantly outperforms state-of-the-art methods, achieving token-level improvements of 50.12% in precision, 41.75% in recall, and 45.10% in F1-score, as well as a 79.94% improvement in name-level accuracy, while also exhibiting strong generalization capability. Moreover, experiments on real-world malware samples further validate the practical effectiveness of Hieronym in security-critical scenarios.

Problem

• function renaming
• stripped binaries
• binary code
• function semantics
• code readability

Innovation

• Hierarchical Summarization-Driven Domain Adaptation
• Multi-Source Information Integration
• Generative Large Language Model (LLM)
• Stripped Binary Function Renaming
• Dual-Layer Evaluation Framework