PatchAlign accurately finds security fixes in stripped software binaries
Locate, Then Reason: End-to-End Patch Presence Testing in Stripped Binaries
Cryptography and Security
Summary
When software gets updated to fix security problems, these updates (or patches) are sometimes hidden inside stripped program files that remove helpful labels. This makes it hard to know if a fix was applied. The authors created PatchAlign, a method that first finds where the patch code might be, then carefully checks if the patch is really there using a language model that understands code. This approach works even when the usual clues like function names are missing or changed.
What this means in practice
- •For security audit teams: Test if security fixes are present in stripped software binaries without relying on precise function matches.
- •For software maintenance engineers: Automatically verify patch deployment status in compiled software even when debugging information is removed.
Authors
Huaijin Wang, Tongda Wang, Zhibo Liu, Yue Zhang, Shuai Wang, Pengfei Hu, Jianzhong Liu, Fangtian Zhong, Shaohua Wang
Abstract
Binary patch presence testing (PPT) determines whether a security fix is present in a stripped binary. Prior systems often assume that patch-relevant code is known or successfully matched. Function-level matching is brittle to compilation changes, inlining, finite model context, and missing usage context; moreover, similarity suppresses the patch-sized distinction needed for the verdict. We present PatchAlign, an end-to-end binary PPT workflow, which performs large-scale localization that maximizes recall economically, then the final verdict reasons for patch-specific evidence. PatchAlign uses instruction-aligned retrieval and caller-callee context to accurately locate patch-relevant binary code pieces, then screens the shortlist and compares target binary code with vulnerable and patched references using an LLM. Our experiments indicate that PatchAlign can precisely localize patch-relevant code and determine patch status without a target-location oracle.