RustBound: Function Boundary Detection over Rust Stripped Binaries
摘要
Function boundary detection identifies start addresses and end addresses of functions in a binary. It is a critical step in binary analysis and is considered as a challenging task over stripped binaries. While existing studies have shown that it is feasible to efficiently and accurately perform function boundary detection over C stripped binaries, it remains unknown whether these methods will perform well over Rust stripped binaries. In this paper, we experimentally evaluate and compare four methods/tools, including two industry reverse engineering tools (Ghirda and IDA Pro) and two neural-network-based methods, in the context of function boundary detection over Rust binaries. We establish a large-scale dataset consisting of 2,471 Rust binaries (with over 8.69 million functions) across five optimization levels and develop two tools to perform analyses automatically. We derive two major findings based on our experimental results. First, one of the two neural-network-based methods, named XDA, can achieve promising results (e.g., 94.8% precision and 85.5% recall over binaries compiled with O0) and outperform other methods/tools in detecting function boundaries over Rust binaries, except over binaries from Oz optimization. Second, although Ghidra and IDA Pro can accurately detect function starts, they are not effective on precisely distinguishing function ends over Rust binaries.