Pith. sign in

REVIEW 7 cited by

Trex: Learning Execution Semantics from Micro-Traces for Binary Similarity

Not yet reviewed by Pith; the record is open.

Re-run · record.json Download PDF Read on arXiv ↗

This paper has not been read by Pith yet. Machine review is queued; the pith claim, tier, and objections will appear here once it completes.

SPECIMEN: schema-true, not a live event

T0 review · schema-true

One-sentence machine reading of the paper's core claim.

pith:XXXXXXXX · record.json · timestamp

arxiv 2012.08680 v3 pith:YN2XJHUX submitted 2020-12-16 cs.CR cs.LGcs.SE

Trex: Learning Execution Semantics from Micro-Traces for Binary Similarity

Kexin Pei , Zhou Xuan , Junfeng Yang , Suman Jana , Baishakhi Ray This is my paper
classification cs.CR cs.LGcs.SE
keywords functionsexecutionsemanticsfunctionmicro-tracessemanticallysimilartrex
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved
0 comments
Share X Bluesky LinkedIn Reddit HN
read the original abstract

Detecting semantically similar functions -- a crucial analysis capability with broad real-world security usages including vulnerability detection, malware lineage, and forensics -- requires understanding function behaviors and intentions. This task is challenging as semantically similar functions can be implemented differently, run on different architectures, and compiled with diverse compiler optimizations or obfuscations. Most existing approaches match functions based on syntactic features without understanding the functions' execution semantics. We present Trex, a transfer-learning-based framework, to automate learning execution semantics explicitly from functions' micro-traces and transfer the learned knowledge to match semantically similar functions. Our key insight is that these traces can be used to teach an ML model the execution semantics of different sequences of instructions. We thus train the model to learn execution semantics from the functions' micro-traces, without any manual labeling effort. We then develop a novel neural architecture to learn execution semantics from micro-traces, and we finetune the pretrained model to match semantically similar functions. We evaluate Trex on 1,472,066 function binaries from 13 popular software projects. These functions are from different architectures and compiled with various optimizations and obfuscations. Trex outperforms the state-of-the-art systems by 7.8%, 7.2%, and 14.3% in cross-architecture, optimization, and obfuscation function matching, respectively. Ablation studies show that the pretraining significantly boosts the function matching performance, underscoring the importance of learning execution semantics.

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Forward citations

Cited by 7 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score.

  1. PLC-BinX: A Cross-Platform Binary Code Analysis Framework for PLC Binaries

    cs.SE 2026-05 unverdicted novelty 7.0

    PLC-BinX is a cross-platform binary code analysis framework achieving 100% toolchain prediction accuracy and 49.18% F1 on functionality prediction across 22 labels on 2431 binaries from CODESYS, GEB, and OpenPLC platforms.

  2. Exploring Code Analysis: Zero-Shot Insights on Syntax and Semantics with LLMs

    cs.SE 2023-05 unverdicted novelty 7.0

    LLMs achieve strong results on syntax parsing tasks but show limited and variable performance on dynamic reasoning, with a clear performance hierarchy across model scales.

  3. Understanding Binary Code Similarity for Real-World Vulnerability Detection: A Large-Scale Empirical Study

    cs.CR 2026-06 unverdicted novelty 6.0

    Large-scale study on 60k firmware shows vulnerable function versions, search space, function sizes and compilation toolchains affect BCSD performance; build-aware queries raise MRR from 0.818 to 0.981 and TPL-aware tw...

  4. PLC-BinX: A Cross-Platform Binary Code Analysis Framework for PLC Binaries

    cs.SE 2026-05 unverdicted novelty 6.0

    PLC-BinX recovers function-level semantic representations from heterogeneous PLC binaries across CODESYS, GEB, and OpenPLC platforms and reports 100% accuracy on toolchain prediction plus ~50% on functionality predict...

  5. PLC-BinX: A Cross-Platform Binary Code Analysis Framework for PLC Binaries

    cs.SE 2026-05 unverdicted novelty 6.0

    PLC-BinX performs cross-platform reverse engineering and core-function extraction on PLC binaries to build semantic representations that enable 100% accurate toolchain prediction and ~50% accurate functionality predic...

  6. REBENCH: A Procedural, Fair-by-Construction Benchmark for LLMs on Stripped-Binary Types and Names (Extended Version)

    cs.CR 2026-04 unverdicted novelty 6.0

    REBench is a new benchmark that consolidates existing datasets into a large collection of binaries with knowledge-base-driven ground truth to enable fair LLM evaluation on stripped-binary type and name recovery.

  7. RINSER: Accurate API Prediction Using Masked Language Models

    cs.CY 2025-09 conditional novelty 6.0

    RINSER uses a masked-language model trained on API codeprints (assembly context around API calls) to predict Windows API names, reporting 85.77% accuracy on normal and 82.88% on stripped binaries, and finding 65 APIs ...