<p>The recovery of indirect calls is a fundamental task in binary program analysis, with critical impacts on downstream tasks such as interprocedural analysis, function call graph generation, and vulnerability discovery. Traditional solutions relying on approximation algorithms often suffer from high false positive and false negative rates. Learning-based approaches have improved accuracy but exhibit limitations in feature extraction and lack semantic understanding of functions. In this paper, we propose <span>SemanCall</span>, a method for recovering indirect calls in binary programs based on semantic graph deep matching. It employs a fine-grained feature extraction approach for binary functions to generate semantic graphs, then frames indirect calls and callee functions as a graph matching problem, leveraging a deep graph matching model to recover indirect calls. Extensive experiments demonstrate that <span>SemanCall</span> significantly outperforms classic baseline methods, validating the effectiveness and rationality of our architecture.</p>

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

SemanCall: recovery of indirect calls in binaries via semantic graph deep matching

  • Xiangzhi Wang,
  • Futai Zou,
  • Ken Zhong,
  • Liang Zhang

摘要

The recovery of indirect calls is a fundamental task in binary program analysis, with critical impacts on downstream tasks such as interprocedural analysis, function call graph generation, and vulnerability discovery. Traditional solutions relying on approximation algorithms often suffer from high false positive and false negative rates. Learning-based approaches have improved accuracy but exhibit limitations in feature extraction and lack semantic understanding of functions. In this paper, we propose SemanCall, a method for recovering indirect calls in binary programs based on semantic graph deep matching. It employs a fine-grained feature extraction approach for binary functions to generate semantic graphs, then frames indirect calls and callee functions as a graph matching problem, leveraging a deep graph matching model to recover indirect calls. Extensive experiments demonstrate that SemanCall significantly outperforms classic baseline methods, validating the effectiveness and rationality of our architecture.