NeuCall: Cross-Reference Graph Learning for Binary-Only Indirect-Call Target Refinement

Abstract: Binary code analysis is a fundamental task in program understanding and optimization when source code is unavailable. However, accurately resolving indirect call targets remains a longstanding challenge in maintaining the integrity of static analysis in binary code. This difficulty arises because the operand of a call instruction (e.g., call rax) remains unknown until runtime, resulting in an incomplete inter-procedural control flow graph (CFG). Previous approaches have struggled with low accuracy and limited scalability. To address these limitations, recent work has increasingly turned to machine learning (ML) to enhance analysis. However, this ML-driven approach faces two significant obstacles: low-quality callsite-callee training pairs and inadequate binary code representation, both of which undermine the accuracy of ML models. In this paper, we introduce NeuCall, a novel approach for resolving indirect calls using graph neural networks. Repository Structure We have uploaded both the source code and dataset used in our experiments. The detailed information is listed below..├── batch├── binary_collection├── database├── env├── graph_generation├── model├── model.checkpoint├── predictor.checkpoint├── README.md└── util Dataset: binary: binary.zip graph: graph.zip Detailed Workflow Step 1: Environment Setup To replicate our experiments, first, set up the environment using the provided YAML files. This ensures that all dependencies and configurations are correctly established. Step 2: Binary Collection Using the modified Typro_CFI and GHCC tools, we collect binaries and annotate them with ground truth information. This step involves compiling source code from Arch Linux and GitHub to create a comprehensive dataset. Step 3: Graph Generation Convert the collected binary information into heterogeneous graphs. These graphs serve as the input for our GNN model, capturing the necessary control flow and data flow information. Step 4: Model Training Train the GNN model using the generated graphs. Experiment with different model settings, such as varying the size, layers, and types of graph elements, to optimize performance.