RouAlign: Cross Version Function Alignment and Routine Recovery with Graphlet Edge Embedding
Reverse engineering is labor intensive work to understand the inner implementation of a program, and is necessary for malware analysis, vulnerability hunting, etc. Cross version function identification and subroutine matching would greatly release manpower by indicating the known parts coming from different binary programs. Existing approaches mainly focus on function recognition ignoring the recovery of the relationships between functions, which makes the researchers hard to locate the calling routine they are interested in. In this paper, we propose a method using graphlet edge embedding to abstract high level topology features of function call graphs and recover the relationships between functions. With the recovery of function relationships, we reconstruct the calling routine of the program and then infer the specific functions in it. We implement a prototype model called RouAlign, which can automatically align the trunk routine of assembly codes. We evaluated RouAlign on 65 groups of real world programs, with over two million functions. RouAlign outperforms state of the art binary comparing solutions by over 35% with a high precision of 92% on average in pairwise function recognition.
SEC