bytecode parsing

Existing approaches for variable type recovery in binary code suffer from low accuracy due to real-world challenges—including cross-function type propagation, skewed type distributions, and interference from compiler optimizations. Method: We propose the first holistic framework that decouples (1) target type set construction, (2) cross-function data-flow tracing, and (3) joint modeling via gated graph neural networks (GGNNs). Crucially, it is the first to systematically characterize how compiler optimizations perturb type-relevant features. The method synergistically integrates precise static analysis with long-range dependency modeling. Contribution/Results: Our approach achieves significant improvements over state-of-the-art methods on the TYDA multi-architecture benchmark. In practical CTF scenarios, the decompiled pseudocode exhibits superior readability compared to outputs from IDA Pro and Ghidra, substantially accelerating reverse-engineering workflows.

This work addresses the challenging problem of recovering original source code from stripped binary functions, a task where traditional decompilation typically yields only approximate pseudocode. The paper proposes a novel paradigm that replaces pseudocode generation with direct source code retrieval. By extracting anchors such as strings and constants from binaries, the method retrieves candidate functions from a source code corpus and constructs a multimodal representation incorporating assembly instructions, decompiled code, and metadata. A large language model (LLM) is then employed for semantic re-ranking of candidates. The approach integrates Ghidra-based static analysis with an inverted index system and introduces an iterative anchor refinement strategy. Evaluated on a high-quality tcpdump dataset, it achieves 95.2% instruction coverage, and attains 35.5% coverage on general-purpose GitHub repositories, demonstrating effectiveness in both ideal and noisy real-world scenarios.

Cross-compiling legacy C/C++ code to WebAssembly (Wasm) frequently incurs semantic divergence, silent miscompilation, and compilation failures, undermining reliability. Method: We propose WasmChecker, the first differential-testing framework for semantic equivalence verification of Wasm compilation. It employs binary-level semantic comparison, cross-platform compilation analysis, and an empirical study across 115 open-source projects. Contribution/Results: Our analysis systematically identifies four root causes of semantic deviation: standard library inconsistencies, missing system calls, Wasm-specific constraints, and compiler bugs. WasmChecker discovers and confirms 11 previously unknown vulnerabilities in Emscripten. We publicly release the WasmChecker framework and a benchmark dataset, providing the first quantitative evidence that mainstream Wasm compilers exhibit significant semantic non-fidelity. This work has directly driven critical fixes in Emscripten.

Traditional large language models struggle to directly process raw bytes of executable files, limiting their applicability to binary understanding tasks such as malware analysis. This work proposes the first large language model natively designed for byte-level input, integrating a custom byte tokenizer, byte-level language modeling, and injection of binary-domain knowledge to enable semantic understanding and question answering over compiled code. Experimental results demonstrate that the proposed approach achieves 69% accuracy in malware family classification and 98% accuracy in architecture classification, substantially outperforming general-purpose large language models. These findings underscore the effectiveness and necessity of native byte-level modeling combined with domain-specific knowledge for advancing binary analysis capabilities.

This work addresses the challenge of efficient and scalable formal verification of concurrency properties—such as deadlock—in Java bytecode by proposing a Petri net–based modeling and analysis approach. The method precisely encodes bytecode semantics into Petri nets and leverages the mature model checker LoLA to enable automated verification of concurrent behaviors. Notably, this is the first application of Petri nets to concurrency analysis of Java bytecode, supporting multiple Java versions and partial Kotlin programs, thereby overcoming language-version limitations of existing tools. The prototype implementation, jPetrify, demonstrates high precision and strong scalability in verifying fundamental concurrency properties like deadlock, with performance largely insensitive to parameter scale.

This study investigates whether pretrained code models encode cross-lingually consistent formal type semantics in their hidden representations. To this end, the authors construct a parallel Java–Python code dataset and employ linear probing on residual stream activations to analyze how type information is represented. They further design cross-lingual transfer experiments to assess whether models can recover formal type annotations from untyped code. This work presents the first direct interpretability analysis targeting formal type semantics and cross-lingual representation alignment in pretrained models. The results demonstrate that such models indeed learn transferable, cross-lingually aligned type structures, and that these representations exhibit robustness to lexical perturbations and syntactic discrepancies between languages.

This work addresses the challenges posed by Go-language malware to traditional static analysis and memory forensics, stemming from its statically linked binaries, intricate runtime structures, and absence of type information. The paper presents the first memory forensic framework specifically designed for Go malware, built upon Volatility 3. By dissecting Go runtime internals, the framework systematically reconstructs active execution states through ABI-aware call stack unwinding, goroutine stack traversal, and recovery of heap-allocated strings and associated metadata. Evaluated on real-world samples including BRICKSTORM, Obscura, and Pantegana, the approach successfully extracts critical artifacts such as C2 addresses, persistence mechanisms, encryption keys, and ransom notes—some of which surpass existing threat intelligence reports—thereby filling a significant gap in dynamic analysis capabilities for Go-based malware.

Function inlining disrupts the call graph structure of binary programs, undermining conventional function-based module decomposition and matching approaches. To address this challenge, this work proposes a module decomposition strategy guided by inlining-invariant anchor functions and introduces an ACFG-FCG joint graph representation that integrates opcode sequences, control flow, and calling context. A hierarchical graph neural network is employed to learn module-level embeddings from this enriched representation. Experimental results demonstrate that the proposed method significantly outperforms existing techniques in both module decomposition quality and matching accuracy, thereby enhancing the robustness and precision of program-level binary code similarity analysis.

This work addresses a critical limitation in existing binary code representation learning methods, which typically overlook instruction-level alignment information and thus fail to effectively leverage fine-grained supervisory signals from compiler debug information. To overcome this, the paper introduces the first approach that explicitly models instruction alignment as an auxiliary training objective. By employing multi-task learning, the method jointly optimizes function-level embeddings and instruction alignment, using debug information to construct precise alignment supervision signals. Experimental results demonstrate that this approach significantly improves accuracy in binary code similarity retrieval, enhances the model’s discriminative power and semantic understanding, and reveals a strong correlation between instruction alignment and the quality of function representations. Consequently, it establishes a more interpretable and precise framework for binary code representation learning.

Existing WebAssembly decompilers often suffer from verbose output, poor readability, and weak type recovery, severely limiting their utility for effective security auditing. This work proposes NotDec, a novel framework that introduces the Retypd algorithm to WebAssembly for the first time. By extending its type system to construct an SSA-based intermediate representation and integrating interprocedural type inference, Memory SSA, and structured control-flow analysis, NotDec precisely distinguishes pointers from numeric values and recovers complex data structure semantics. Experimental results demonstrate that NotDec achieves a 100% recompilation success rate on the Juliet and Howard datasets and attains an 85.33% accuracy in recovering struct member access types—substantially outperforming Ghidra, which achieves only 9.24%. Moreover, the lightweight variant NotDec_F consumes less than half the memory of Ghidra and reduces execution time by up to 97%.