Neural-FEBI: Accurate Function Identification in Ethereum Virtual Machine Bytecode

TL;DR

Neural-FEBI is a neural network framework that accurately identifies function entries and boundaries in Ethereum smart contract bytecode, improving reverse engineering and analysis without relying on handcrafted rules.

Contribution

It introduces a neural network-based approach using bi-LSTM and CRF for function identification in EVM bytecode, surpassing existing heuristic-based methods.

Findings

Achieves F1-scores of 88.3% to 99.7% for function entry detection.

Improves function boundary detection accuracy from 79.4% to 97.1%.

Enables more precise construction of control flow graphs and call graphs.

Abstract

Millions of smart contracts have been deployed onto the Ethereum platform, posing potential attack subjects. Therefore, analyzing contract binaries is vital since their sources are unavailable, involving identification comprising function entry identification and detecting its boundaries. Such boundaries are critical to many smart contract applications, e.g. reverse engineering and profiling. Unfortunately, it is challenging to identify functions from these stripped contract binaries due to the lack of internal function call statements and the compiler-inducing instruction reshuffling. Recently, several existing works excessively relied on a set of handcrafted heuristic rules which impose several faults. To address this issue, we propose a novel neural network-based framework for EVM bytecode Function Entries and Boundaries Identification (neural-FEBI) that does not rely on a fixed set of handcrafted rules. Instead, it used a two-level bi-Long Short-Term Memory network and a Conditional Random Field network to locate the function entries. The suggested framework also devises a control flow traversal algorithm to determine the code segments reachable from the function entry as its boundary. Several experiments on 38,996 publicly available smart contracts collected as binary demonstrate that neural-FEBI confirms the lowest and highest F1-scores for the function entries identification task across different datasets of 88.3 to 99.7, respectively. Its performance on the function boundary identification task is also increased from 79.4% to 97.1% compared with state-of-the-art. We further demonstrate that the identified function information can be used to construct more accurate intra-procedural CFGs and call graphs. The experimental results confirm that the proposed framework significantly outperforms state-of-the-art, often based on handcrafted heuristic rules.