Hieronym improves function naming in stripped binary code
Hieronym: Leveraging Hierarchical Multi-Source Information for Function Renaming in Stripped Binary
Software Engineering
Summary
Stripped binaries remove helpful function names to protect or reduce programs, making it hard for people to understand the code. Hieronym is a new tool that uses a large language model to suggest accurate and readable names for these functions by combining different information sources from the program. It works well across several computer architectures and optimization levels, making reverse engineering easier and more reliable. The authors also tested Hieronym on real malware, showing it can help in security situations.
What this means in practice
- •For reverse engineers: Accurately rename functions in stripped binaries to improve understanding during analysis tasks.
- •For malware analysts: Provide clearer function names in malware binaries to speed up investigation of security threats.
- •For software security teams: Enhance automated tools for interpreting unknown or stripped binary code to support vulnerability assessments.$Commercial implications: Allows creation of advanced binary analysis products that offer better function name recovery for security audits.
Authors
Xiaoling Zhang, Jian Sun, Dawei Wang, Chongyu Wang, Li Chen, Zhaoteng Yan, Peipei Liu, Lixiao Zhang, Dan Li
Abstract
Function renaming in stripped binaries can substantially assist reverse engineers by improving code readability, yet it is a challenging task. The difficulty stems from the need to accurately capture function semantics from low-level binary code across diverse instruction sets, architectures, and compiler optimizations, and to express these semantics in concise, human-readable names. Existing approaches either inadequately capture comprehensive function semantics or exhibit limited generalization to previously unseen binaries. In this paper, we present Hieronym, a generative large language model (LLM)-based framework for stripped binary function renaming. Hieronym adopts a hierarchical summarization-driven domain adaptation strategy and integrates multi-source information, including global binary context, local calling context, and intrinsic function semantics, to enhance the LLM's understanding of binary code. To enable systematic evaluation, we further propose a dual-layer evaluation framework that incorporates both token-level and whole-name-level metrics. We evaluate Hieronym on binary functions compiled with four compiler optimization levels (O0-O3) for four architectures (x64, x86, ARM, and MIPS). Experimental results demonstrate that Hieronym significantly outperforms state-of-the-art methods, achieving token-level improvements of 50.12% in precision, 41.75% in recall, and 45.10% in F1-score, as well as a 79.94% improvement in name-level accuracy, while also exhibiting strong generalization capability. Moreover, experiments on real-world malware samples further validate the practical effectiveness of Hieronym in security-critical scenarios.