Towards LLM-Based Analysis of Virtualization-Obfuscated Code through Automated Data Generation

TL;DR

This paper presents a static analysis framework that enables large-scale, structure-focused analysis of virtualization-obfuscated binaries using LLMs, overcoming input size and data labeling challenges.

Contribution

It introduces a method to decompose complex obfuscated binaries into manageable units and automates labeling for large dataset generation.

Findings

Prototype achieves strong performance on real-world obfuscators.

Structural analysis approach mitigates input size limitations.

Automated labeling facilitates large-scale dataset creation.

Abstract

Virtualization-based obfuscation produces extremely large and structurally complex binaries, posing challenges for LLM-based analysis due to input size limits and the need for large-scale labeled data. We address this by focusing on structural rather than full semantic analysis. Obfuscated binaries are decomposed into the largest semantically coherent units that fit within LLM constraints and are labeled according to their structural roles. We implement a static analysis framework to automate labeling and enable large-scale dataset generation. Our prototype shows strong performance on real-world virtualization obfuscators.