Pith. sign in

REVIEW 4 major objections 5 minor 39 references

Beyond C/C++: Probabilistic and LLM Methods for Next-Generation Software Reverse Engineering

T0 review · 4 major / 5 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read This paper proposes that a probabilistic inference engine combining a rigorous program-analysis engine with a fine-tuned LLM can recover source-level semantics from binaries compiled in Rust, Go, and Mojo, where C/C++-centric tools fail.

desk verdict A coherent research proposal with correct observations about modern-language binaries, but no implementation or evaluation to back its central claim. read the letter →

arxiv 2506.03504 v1 pith:BHSDFBQF submitted 2025-06-04 cs.SE

Zhuo Zhuo , Xiangyu Zhang This is my paper
classification cs.SE
keywords reverseengineeringbinaryanalysisprobabilisticinferencelargelanguagemodelsRustGodecompilationhallucination
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper argues that reverse engineering has been built on heuristics tuned to C and C++, and that those heuristics become wrong or incomplete when the binary comes from Rust, Go, Mojo, or other modern system languages. It proposes a three-engine design in which a probabilistic inference engine aggregates facts from two sources: a program analysis engine that emits only rigorous, high-confidence facts, and a fine-tuned large language model that emits creative heuristic guesses, each with a confidence value. The aim is to recover source-level names, types, and structures from binaries that current tools misread, while the probabilistic aggregation is supposed to keep LLM hallucinations from corrupting the final result. The paper is a proposal; it supports the design with concrete failure cases rather than with an implemented evaluation.

What carries the argument

The load-bearing mechanism is the probabilistic inference engine, a component inherited from probabilistic binary analysis, in which uncertain decisions are attached to probabilities and merged by inference rather than made deterministically. In the proposed design it sits between two fact producers: the program analysis engine, which is stripped of heuristic guessing and emits only well-founded facts, and the LLM analysis engine, which emits fallible guesses about code structures and semantics across many programming languages. The engine's job is to aggregate these heterogeneous facts using their confidence values, counterbalancing LLM bias or overconfidence with the program analysis engine's high-confidence facts. The paper also singles out Rust trait monomorphization as a new kind of evidence: the multiple compiled instances of one generic function can be analyzed jointly to reinforce each other's recovered types and names.

What would settle it

Build a benchmark of stripped Rust and Go binaries with known source, and compare three outputs: probabilistic analysis alone, LLM guesses alone, and the combined engine. If the combined output is not more accurate than the better of the two components, or if facts the engine labels high-confidence are not more accurate than its low-confidence facts, the proposed aggregation is refuted.

Watch

Extended reading notes

Core claim

The paper's central claim is that the two main failure modes of today's tools—C/C++-specific heuristics and hallucinating data-driven models—can be addressed by the same architectural move: separate rigorous reasoning from guessing, and merge them under probability. The program analysis engine is deliberately restricted to verifiable reasoning such as data-flow analysis, while the LLM engine supplies heuristic facts that draw on human-readable strings, constants, and patterns learned from multiple languages. A probabilistic inference engine then weighs each fact by its confidence, so a single overconfident LLM guess does not dominate. The motivating evidence is the failure cases themselves: Go strings are length-prefixed rather than null-terminated, Rust's `Option<String>` can share a memory layout with `String`, Rust trait monomorphization produces near-duplicate functions that current tools ignore, and direct LLM decompilation alters data flow while guessing field offsets incorrectly. The intended outcome is a reverse engineering pipeline that extends beyond C and C++ without hand-writing a new heuristic library for every emerging language.

Load-bearing premise

The whole approach depends on the fine-tuned LLM producing heuristic facts about non-C/C++ binaries that are accurate enough, and on the probabilistic engine assigning confidence values that are reliable enough, that combining the two improves the final answer rather than simply adding noise.

Editorial extensions

If this is right

  • A decompiler built this way would recognize Go strings by their `(ptr, len)` layout and Rust `Option<String>` by its null-pointer discriminant, instead of misreading them with C/C++ heuristics.
  • Rust trait monomorphization would become a source of redundant evidence: the two compiled copies of a generic function could be analyzed together to raise confidence in recovered types and names.
  • Security workflows that depend on binaries—patching commercial off-the-shelf software, debloating third-party libraries, hardening legacy systems—would receive results with stated confidence values, which the paper argues is necessary for decisions made by human analysts.
  • Coverage of new languages would not require hand-writing heuristic libraries; each language would be handled by fine-tuning the LLM on labels derived from source-level analysis, such as the pairing of monomorphized functions.
  • Direct LLM decompilation, with its data-flow-altering hallucinations, would be avoided because the LLM would supply only heuristic facts that the probabilistic engine can overrule.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The paper leaves implicit that its central bet is testable before any large fine-tuning effort: an off-the-shelf LLM's type, name, and string guesses for stripped Rust and Go binaries could be scored against known source, and one could check whether a calibrated confidence value ranks correct guesses above hallucinations.
  • A natural extension is to derive the proposed source-level fine-tuning labels automatically from compiler metadata or from matching debug and stripped builds, then measure how label quality degrades as the compiler, optimizer, or language changes; the paper assumes such labels are available.
  • If the core bet pays off, the same architecture—a rigorous engine plus a stochastic language model under a probabilistic scheduler—could generalize to other lossy reverse engineering tasks such as binary diffing, patch generation, or library identification, though the paper does not claim this.
  • A boundary the paper does not explore is adversarial calibration: byte-level perturbations could shift not only LLM facts but also their confidence scores, so robustness under attack would need a dedicated study before the approach is trusted in security-sensitive settings.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The manuscript is a proposal (arXiv:2506.03504, cs.SE) arguing that existing reverse-engineering (RE) tools are inadequate for binaries compiled from languages beyond C/C++, and that a hybrid architecture—combining a probabilistic inference engine, a program-analysis engine, and a fine-tuned LLM engine—would improve the robustness and accuracy of RE. The paper motivates three limitations (C/C++-specific heuristics, neglect of descriptive semantics, hallucination in data-driven methods) with illustrative examples (Go strings, Rust Option/String layouts, Rust trait monomorphization) and describes a three-component system at a high level. It does not provide a formal model, an implementation, or an empirical evaluation; the central claim that the proposed approach 'enhances the robustness and accuracy' of RE is asserted rather than demonstrated.

Significance. If the proposed architecture were realized and validated, it could address a real and growing problem: the difficulty of reverse-engineering binaries from Rust, Go, and other modern languages. The manuscript is honest about the limitations of current tools and gives several concrete, instructive examples (e.g., the Rust Option<String> memory-layout pitfall for type inference). It also correctly identifies hallucination as a core risk in LLM-based RE and gestures at a plausible mitigation through probabilistic aggregation. However, the paper is a position statement rather than a technical contribution: there is no formal derivation, no algorithm, no implementation, no dataset, and no baseline comparison. The load-bearing concepts—calibrated confidence for LLM facts and a probabilistic aggregation mechanism—are described only in prose. The strengths are the motivating examples and the identification of a worthwhile research direction; the technical substance that would justify the central claim is absent.

major comments (4)
  1. [Section 3, Probabilistic Inference Engine bullet] The manuscript never specifies how LLM outputs are converted into probabilities. The bullet says the engine 'assigns probabilities to these facts based on their confidence levels,' which is circular unless a separate likelihood model is defined: an LLM's raw output (e.g., 'these two functions are monomorphized from the same generic') has no intrinsic frequency-based prior, unlike the program-analysis heuristics in the cited probabilistic framework [32, 34]. Without a likelihood function and a calibration procedure, the claim that probabilistic aggregation improves accuracy is not well-defined, and the proposed system may simply propagate hallucinated LLM facts with spuriously high confidence.
  2. [Section 3, LLM Analysis Engine bullet] The fine-tuning-label proposal is underspecified as a load-bearing component. The paper suggests labels 'collected from source-code level analysis,' such as recognizing two Rust functions as monomorphizations of the same generic, but gives no evidence that such labels are available at scale, how they would be extracted for arbitrary binaries, or how they yield calibrated confidence values. Since this engine is the only novel source of information for non-C/C++ binaries, the entire proposal rests on an unvalidated premise about the feasibility and accuracy of this fine-tuning pipeline.
  3. [Section 3, Program Analysis Engine bullet] The distinction between 'rigorous reasoning' and 'heuristic guesses' is overstated. Disassembly, function-boundary detection, and even data-flow analysis on stripped binaries all rely on heuristics and approximations (e.g., linear sweep vs. recursive descent; recovery of indirect calls). The claim that this engine produces 'high-confidence data' that is 'grounded in verifiable program analysis' requires a formal soundness argument; none is provided. This matters because the proposed mitigation of LLM hallucination depends on the program-analysis facts being trustworthy in a well-defined sense.
  4. [Section 2, L3 and Figure 4] The evidence for the hallucination limitation is anecdotal. The paper reports that 'our efforts' with GPT-4 and a fine-tuned end-to-end model 'revealed limitations,' but provides no experimental methodology: no dataset, no prompt details, no fine-tuning hyperparameters, no metrics, and no comparison to a baseline. As a motivating observation this is acceptable, but it does not constitute an empirical characterization of LLM hallucination in RE, and the paper uses this observation to justify the entire architecture.
minor comments (5)
  1. [Section 2, Figure 1 caption] There is a typo: 'excatly' should be 'exactly' in the description of the Rust Option<String> memory layout.
  2. [Section 2, Figure 1(b)] The notation 'None-0-' in the figure is unclear; the text explains that the 'ptr' field is set to 0, but the figure would benefit from an explicit label.
  3. [References] Reference [1] is an incomplete citation (only a URL and a date); it should include a title and publisher.
  4. [Section 1, first paragraph] The mention of 'Mojo' as a system programming language lacks a citation; consider citing a language reference or compiler source.
  5. [Section 4, Conclusion] The conclusion repeats the abstract's claims without adding any concrete next steps or evaluation plan; a revised version should outline specific research milestones and evaluation criteria.

Circularity Check

0 steps flagged · score 0.0 of 10

No circular derivation; core gap is an unspecified calibration mechanism, not a self-referential reduction.

full rationale

This is a position/proposal paper with no formal derivation chain, so there is no equation-level circularity to expose. The central claim—that combining a probabilistic inference engine with a fine-tuned LLM engine improves robustness and accuracy for non-C/C++ binaries—is asserted as a design goal, not derived from its inputs. The Probabilistic Inference Engine is described as 'assigning probabilities to these facts based on their confidence levels,' but the mapping from LLM outputs to calibrated confidence values is never specified; that is an underspecification and correctness-risk concern, not a circular reduction. Similarly, the claim that the Program Analysis Engine is 'dedicated solely to rigorous and methodical reasoning' and therefore produces 'high-confidence data' is an unvalidated assumption, not a definitional tautology. Self-citations to Osprey [34] and the probabilistic binary analysis dissertation [32] supply the prior framework, but the paper does not define its target result as an instance of those citations, nor does it invoke a uniqueness theorem from them to forbid alternatives. No quoted reduction of a predicted quantity to a fitted input or to a self-citation chain exists, so the appropriate finding is no significant circularity.

Assumptions & free parameters 0 free parameters · 4 assumptions · 0 invented entities

The paper introduces no fitted parameters or invented entities because it contains no quantitative model. Its feasibility depends entirely on the domain assumptions listed, none of which are validated.

assumptions (4)
  • domain assumption Fine-tuning on source-code-derived labels yields useful heuristics for binary analysis across languages.
    Section 3 (LLM Analysis Engine) proposes labels 'collected from source-code level analysis' but does not show such labels exist in sufficient quantity or quality.
  • domain assumption LLM outputs can be converted into probabilistic facts with calibrated confidence levels.
    Section 3 (Probabilistic Inference Engine) says facts are assigned probabilities 'based on their confidence levels' without defining the conversion or calibration method.
  • domain assumption Existing probabilistic binary analysis provides a sound foundation that can be extended to new languages without modification.
    Section 3 cites probabilistic binary analysis [32,34] as the backbone, but the same section earlier states those techniques are limited by C/C++-centric heuristics.
  • domain assumption The anecdotal failures in Section 2 generalize across modern compiled languages.
    The examples (Go strings, Rust Option, Rust Traits) are used to justify a general approach for all languages beyond C/C++, but only three patterns are shown.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Beyond C/C++: Probabilistic and LLM Methods for Next-Generation Software Reverse Engineering." pith.science (2026). https://pith.science/paper/BHSDFBQF

@misc{pith2026250603504,
  author       = {Pith},
  title        = {Pith review of: Beyond C/C++: Probabilistic and LLM Methods for Next-Generation Software Reverse Engineering},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/BHSDFBQF}},
  note         = {Machine review of arXiv:2506.03504}
}
read the original abstract

This proposal discusses the growing challenges in reverse engineering modern software binaries, particularly those compiled from newer system programming languages such as Rust, Go, and Mojo. Traditional reverse engineering techniques, developed with a focus on C and C++, fall short when applied to these newer languages due to their reliance on outdated heuristics and failure to fully utilize the rich semantic information embedded in binary programs. These challenges are exacerbated by the limitations of current data-driven methods, which are susceptible to generating inaccurate results, commonly referred to as hallucinations. To overcome these limitations, we propose a novel approach that integrates probabilistic binary analysis with fine-tuned large language models (LLMs). Our method systematically models the uncertainties inherent in reverse engineering, enabling more accurate reasoning about incomplete or ambiguous information. By incorporating LLMs, we extend the analysis beyond traditional heuristics, allowing for more creative and context-aware inferences, particularly for binaries from diverse programming languages. This hybrid approach not only enhances the robustness and accuracy of reverse engineering efforts but also offers a scalable solution adaptable to the rapidly evolving landscape of software development.

Figures

Figures reproduced from arXiv: 2506.03504 by the authors.

Figure 1
Figure 1. Incorrect heuristics when applied to non-C lan [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. Example of Traits in Rust trait, ensuring that the type can be converted into a string using the “to_string()” method. The example demonstrates how the function “foo” can handle different types, such as an integer “1” and a string ““a””, both of which implement the Display trait. More importantly, when Rust code is compiled, Traits are monomorphized. Specifically, in [PITH_FULL_IMAGE:figures/full_fig_p002_2.png] view at source ↗
Figure 3
Figure 3. A function’s source code and decompiled code } } } Decompiled Code Source Code 11 11 [PITH_FULL_IMAGE:figures/full_fig_p003_3.png] view at source ↗
Figures from the paper (1 more)
Figure 4
Figure 4. Figure 4: GPT-4 and direct fine-tuning are limited. [PITH_FULL_IMAGE:figures/full_fig_p003_4.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

39 extracted references · 25 canonical work pages

  1. [1]

    2024. en-US. (Feb. 2024). https://www.whitehouse.gov/oncd/briefing-room/20 24/02/26/press-release-technical-report/

    work page 2024

  2. [2]

    2024. en. Page Version ID: 1218930528. (Apr. 2024). https://en.wikipedia.org/w /index.php?title=Tiny_Encryption_Algorithm&oldid=1218930528

    work page 2024

  3. [3]

    [n. d.] en. (). https://hex-rays.com/blog/rust-analysis-plugin-tech-preview/

    work page

  4. [5]

    Anil Altinay et al. 2020. Binrec: dynamic binary lifting and recompilation. In EuroSys ’20: Fifteenth EuroSys Conference 2020, Heraklion, Greece, April 27-30,

    work page 2020

  5. [6]

    Jim Alves-Foss and Jia Song. 2019. Function boundary detection in stripped binaries. In Proceedings of the 35th Annual Computer Security Applications Conference, ACSAC 2019, San Juan, PR, USA, December 09-13, 2019 . David M. Balenson, (Ed.) ACM, 84–96. doi: 10.1145/3359789.3359825

    arXiv 2019

  6. [7]

    Zion Leonahenahe Basque, Ati Priya Bajaj, Wil Gibbs, Jude O’Kain, Derron Miao, Tiffany Bao, Adam Doupé, Yan Shoshitaishvili, and Ruoyu Wang. 2024. Ahoy sailr! there is no need to DREAM of C: A compiler-aware structuring al- gorithm for binary decompilation. In33rd USENIX Security Symposium, USENIX Security 2024, Philadelphia, PA, USA, August 14-16, 2024 ....

    work page 2024

  7. [8]

    Erick Bauman, Zhiqiang Lin, and Kevin W. Hamlen. 2018. Superset disassembly: statically rewriting x86 binaries without heuristics. In 25th Annual Network and Distributed System Security Symposium, NDSS 2018, San Diego, California, USA, February 18-21, 2018 . The Internet Society. https://www.ndss-symposium .org/wp-content/uploads/2018/02/ndss2018%5C_05A-4...

    work page 2018

  8. [9]

    Kevin Burk, Fabio Pagani, Christopher Kruegel, and Giovanni Vigna. 2022. Decomperson: how humans decompile and what we can learn from it. In 31st USENIX Security Symposium, USENIX Security 2022, Boston, MA, USA, August 10- 12, 2022. Kevin R. B. Butler and Kurt Thomas, (Eds.) USENIX Association, 2765–

    work page 2022

Show all 39 references
  1. [10]

    Martim Carbone, Weidong Cui, Long Lu, Wenke Lee, Marcus Peinado, and Xuxian Jiang. 2009. Mapping kernel objects to enable systematic integrity Beyond C/C++: Probabilistic and LLM Methods for Next-Generation Software Reverse Engineering checking. In Proceedings of the 2009 ACM ...

    2009

  2. [11]

    Wagner, and Thomas R

    Nicholas Carlini, Antonio Barresi, Mathias Payer, David A. Wagner, and Thomas R. Gross. 2015. Control-flow bending: on the effectiveness of control-flow in- tegrity. In 24th USENIX Security Symposium, USENIX Security 15, Washington, D.C., USA, August 12-14, 2015 . Jaeyeon Jung...

    2015

  3. [12]

    Schwartz, Claire Le Goues, Graham Neubig, and Bogdan Vasilescu

    Qibin Chen, Jeremy Lacomis, Edward J. Schwartz, Claire Le Goues, Graham Neubig, and Bogdan Vasilescu. 2022. Augmenting decompiler output with learned variable names and types. In 31st USENIX Security Symposium, USENIX Security 2022, Boston, MA, USA, August 10-12, 2022 . Kevin ...

    2022

  4. [13]

    JongHyup Lee, Thanassis Avgerinos, and David Brumley. 2011. TIE: principled reverse engineering of types in binary programs. In Proceedings of the Network and Distributed System Security Symposium, NDSS 2011, San Diego, California, USA, 6th February - 9th February 2011 . The I...

    2011

  5. [14]

    Yao Li, Weiyang Xu, Yong Tang, Xianya Mi, and Baosheng Wang. 2017. Semhunt: identifying vulnerability type with double validation in binary code. In The 29th International Conference on Software Engineering and Knowledge Engineer- ing, Wyndham Pittsburgh University Center, Pit...

    2017 doi

  6. [15]

    Zhiqiang Lin, Xiangyu Zhang, and Dongyan Xu. 2010. Automatic reverse engineering of data structures from binary execution. In Proceedings of the Network and Distributed System Security Symposium, NDSS 2010, San Diego, California, USA, 28th February - 3rd March 2010 . The Inter...

    2010

  7. [16]

    Alessandro Mantovani, Simone Aonzo, Yanick Fratantonio, and Davide Balzarotti

  8. [17]

    Jean-Phillipe Martin, Michael Hicks, Manuel Costa, Periklis Akritidis, and Miguel Castro. 2010. Dynamically checking ownership policies in concurrent c/c++ programs. In Proceedings of the 37th ACM SIGPLAN-SIGACT Symposium on Principles of Programming Languages, POPL 2010, Madr...

    2010

  9. [18]

    Miller, Yonghwi Kwon, Yi Sun, Zhuo Zhang, Xiangyu Zhang, and Zhiqiang Lin

    Kenneth A. Miller, Yonghwi Kwon, Yi Sun, Zhuo Zhang, Xiangyu Zhang, and Zhiqiang Lin. 2019. Probabilistic disassembly. In Proceedings of the 41st International Conference on Software Engineering, ICSE 2019, Montreal, QC, Canada, May 25-31, 2019 . Joanne M. Atlee, Tevfik Bultan...

    2019

  10. [19]

    Girish Mururu, Chris Porter, Prithayan Barua, and Santosh Pande. 2019. Binary debloating for security via demand driven loading. CoRR, abs/1902.06570. http: //arxiv.org/abs/1902.06570 arXiv: 1902.06570

    2019 arXiv

  11. [20]

    Kuntal Kumar Pal et al. 2024. Len or index or count, anything but v1”: predicting variable names in decompilation output with transfer learning. In 2024 IEEE Symposium on Security and Privacy (SP) . IEEE Computer Society, 152–152

    2024

  12. [21]

    Kexin Pei, Jonas Guan, David Williams-King, Junfeng Yang, and Suman Jana

  13. [22]

    Kexin Pei et al. 2021. Stateformer: fine-grained type recovery from binaries using generative state modeling. In ESEC/FSE ’21: 29th ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering, Athens, Greece, August 23-28, 2021 ....

    2021

  14. [23]

    Nilo Redini, Ruoyu Wang, Aravind Machiry, Yan Shoshitaishvili, Giovanni Vi- gna, and Christopher Kruegel. 2019. Bintrimmer: towards static binary debloat- ing through abstract interpretation. In Detection of Intrusions and Malware, and Vulnerability Assessment - 16th Internati...

    2019

  15. [24]

    Schwartz, Cory F

    Edward J. Schwartz, Cory F. Cohen, Michael Duggan, Jeffrey Gennari, Jeffrey S. Havrilla, and Charles Hines. 2018. Using logic programming to recover C++ classes and methods from compiled executables. In Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communicatio...

    2018 doi

  16. [25]

    Yan Shoshitaishvili et al. 2016. SOK: (state of) the art of war: offensive tech- niques in binary analysis. In IEEE Symposium on Security and Privacy, SP 2016, San Jose, CA, USA, May 22-26, 2016 . IEEE Computer Society, 138–157. doi: 10.1109/SP.2016.17

    2016 doi

  17. [26]

    Asia Slowinska, Traian Stancescu, and Herbert Bos. 2011. Howard: A dynamic excavator for reverse engineering data structures. InProceedings of the Network and Distributed System Security Symposium, NDSS 2011, San Diego, California, USA, 6th February - 9th February 2011 . The I...

    2011

  18. [27]

    Danning Xie, Zhuo Zhang, Nan Jiang, Xiangzhe Xu, Lin Tan, and Xiangyu Zhang. 2024. Resym: harnessing llms to recover variable and data structure symbols from stripped binaries. In Proceedings of the 2024 ACM Conference on Computer and Communications Security, CCS 2024, Sakt Ka...

    2024

  19. [28]

    Xiangzhe Xu, Zhuo Zhang, Shiwei Feng, Yapeng Ye, Zian Su, Nan Jiang, Siyuan Cheng, Lin Tan, and Xiangyu Zhang. 2023. Lmpa: improving decompilation by synergy of large language model and program analysis. arXiv preprint arXiv:2306.02546

    2023 arXiv

  20. [29]

    Zhengzi Xu, Bihuan Chen, Mahinthan Chandramohan, Yang Liu, and Fu Song

  21. [30]

    Yapeng Ye, Zhuo Zhang, Qingkai Shi, Yousra Aafer, and Xiangyu Zhang. 2023. D-ARM: disassembling ARM binaries by lightweight superset instruction in- terpretation and graph modeling. In 44th IEEE Symposium on Security and Privacy, SP 2023, San Francisco, CA, USA, May 21-25, 202...

    2023

  22. [31]

    Haotian Zhang, Mengfei Ren, Yu Lei, and Jiang Ming. 2022. One size does not fit all: security hardening of MIPS embedded systems via static binary debloating for shared libraries. In ASPLOS ’22: 27th ACM International Con- ference on Architectural Support for Programming Langu...

    2022

  23. [32]

    Zhuo Zhang. 2023. Revamping Binary Analysis with Sampling and Probabilistic Inference. Ph.D. Dissertation. Purdue University, USA. https://docs.lib.purdue.e du/dissertations/AAI30641562

    2023

  24. [33]

    Zhuo Zhang, Guanhong Tao, Guangyu Shen, Shengwei An, Qiuling Xu, Yingqi Liu, Yapeng Ye, Yaoxuan Wu, and Xiangyu Zhang. 2023. PELICAN: exploiting backdoors of naturally trained deep learning models in binary code analysis. In 32nd USENIX Security Symposium, USENIX Security 2023...

    2023

  25. [34]

    Zhuo Zhang, Yapeng Ye, Wei You, Guanhong Tao, Wen-Chuan Lee, Yonghwi Kwon, Yousra Aafer, and Xiangyu Zhang. 2021. OSPREY: recovery of variable and data structure via probabilistic analysis for stripped binary. In 42nd IEEE Symposium on Security and Privacy, SP 2021, San Franci...

    2021

  26. [35]

    Zhuo Zhang, Wei You, Guanhong Tao, Yousra Aafer, Xuwei Liu, and Xiangyu Zhang. 2021. Stochfuzz: sound and cost-effective fuzzing of stripped binaries by incremental and stochastic rewriting. In 42nd IEEE Symposium on Security and Privacy, SP 2021, San Francisco, CA, USA, 24-27...

    2021

  27. [2017]

    In Proceedings of the 39th International Conference on Software Engineering, ICSE 2017, Buenos Aires, Argentina, May 20-28, 2017

    SPAIN: security patch analysis for binaries towards understanding the pain and pills. In Proceedings of the 39th International Conference on Software Engineering, ICSE 2017, Buenos Aires, Argentina, May 20-28, 2017 . Sebastián Uchitel, Alessandro Orso, and Martin P. Robillard,...

    2017 doi

  28. [2020]

    Markatos, Dejan Kostic, and Margo I

    Angelos Bilas, Kostas Magoutis, Evangelos P. Markatos, Dejan Kostic, and Margo I. Seltzer, (Eds.) ACM, 36:1–36:16. doi: 10.1145/3342195.3387550

  29. [2021]

    In28th Annual Network and Distributed System Security Symposium, NDSS 2021, virtually, February 21-25, 2021

    XDA: accurate, robust disassembly with transfer learning. In28th Annual Network and Distributed System Security Symposium, NDSS 2021, virtually, February 21-25, 2021. The Internet Society. https://www.ndss-symposium.org /ndss-paper/xda-accurate-robust-disassembly-with-transfer...

    2021

  30. [2022]

    In31st USENIX Security Symposium, USENIX Security 2022, Boston, MA, USA, August 10-12, 2022

    Re-mind: a first look inside the mind of a reverse engineer. In31st USENIX Security Symposium, USENIX Security 2022, Boston, MA, USA, August 10-12, 2022. Kevin R. B. Butler and Kurt Thomas, (Eds.) USENIX Association, 2727–2745. ht tps://www.usenix.org/conference/usenixsecurity...

    2022

  31. [2782]

    https://www.usenix.org/conference/usenixsecurity22/presentation/burk

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.