CFG2VEC: Hierarchical Graph Neural Network for Cross-Architectural Software Reverse Engineering

TL;DR

CFG2VEC introduces a hierarchical GNN approach with a novel graph-of-graphs representation to improve cross-architecture binary analysis, significantly enhancing function name prediction accuracy and generalization in reverse engineering tasks.

Contribution

The paper presents cfg2vec, a hierarchical GNN with a graph-of-graphs representation for cross-architecture binary analysis, outperforming state-of-the-art methods and demonstrating practical applicability.

Findings

Outperforms state-of-the-art by 24.54% in function name prediction.

Achieves 51.84% improvement with more training data.

Generalizes well to unseen CPU architectures.

Abstract

Mission-critical embedded software is critical to our society's infrastructure but can be subject to new security vulnerabilities as technology advances. When security issues arise, Reverse Engineers (REs) use Software Reverse Engineering (SRE) tools to analyze vulnerable binaries. However, existing tools have limited support, and REs undergo a time-consuming, costly, and error-prone process that requires experience and expertise to understand the behaviors of software and vulnerabilities. To improve these tools, we propose $\textit{cfg2vec}$, a Hierarchical Graph Neural Network (GNN) based approach. To represent binary, we propose a novel Graph-of-Graph (GoG) representation, combining the information of control-flow and function-call graphs. Our $\textit{cfg2vec}$ learns how to represent each binary function compiled from various CPU architectures, utilizing hierarchical GNN and the siamese network-based supervised learning architecture. We evaluate $\textit{cfg2vec}$'s capability of predicting function names from stripped binaries. Our results show that $\textit{cfg2vec}$ outperforms the state-of-the-art by $24.54\%$ in predicting function names and can even achieve $51.84\%$ better given more training data. Additionally, $\textit{cfg2vec}$ consistently outperforms the state-of-the-art for all CPU architectures, while the baseline requires multiple training to achieve similar performance. More importantly, our results demonstrate that our $\textit{cfg2vec}$ could tackle binaries built from unseen CPU architectures, thus indicating that our approach can generalize the learned knowledge. Lastly, we demonstrate its practicability by implementing it as a Ghidra plugin used during resolving DARPA Assured MicroPatching (AMP) challenges.