[Paper Review] BinMatch: A Semantics-based Hybrid Approach on Binary Code Clone Analysis

Yikun Hu, Yuanyuan Zhang+4 more|arXiv (Cornell University)|Aug 19, 2018

Software Engineering Research37 references4 citations

TL;DR

BinMatch proposes a semantics-based hybrid approach for binary code clone detection by executing a template function with test cases and emulating target functions using migrated runtime information to extract semantic signatures. It achieves high accuracy and full coverage, outperforming state-of-the-art methods in robustness to code transformations and detection precision across 100+ million function pairs.

ABSTRACT

Binary code clone analysis is an important technique which has a wide range of applications in software engineering (e.g., plagiarism detection, bug detection). The main challenge of the topic lies in the semantics-equivalent code transformation (e.g., optimization, obfuscation) which would alter representations of binary code tremendously. Another chal- lenge is the trade-off between detection accuracy and coverage. Unfortunately, existing techniques still rely on semantics-less code features which are susceptible to the code transformation. Besides, they adopt merely either a static or a dynamic approach to detect binary code clones, which cannot achieve high accuracy and coverage simultaneously. In this paper, we propose a semantics-based hybrid approach to detect binary clone functions. We execute a template binary function with its test cases, and emulate the execution of every target function for clone comparison with the runtime information migrated from that template function. The semantic signatures are extracted during the execution of the template function and emulation of the target function. Lastly, a similarity score is calculated from their signatures to measure their likeness. We implement the approach in a prototype system designated as BinMatch which analyzes IA-32 binary code on the Linux platform. We evaluate BinMatch with eight real-world projects compiled with different compilation configurations and commonly-used obfuscation methods, totally performing over 100 million pairs of function comparison. The experimental results show that BinMatch is robust to the semantics-equivalent code transformation. Besides, it not only covers all target functions for clone analysis, but also improves the detection accuracy comparing to the state-of-the-art solutions.

Motivation & Objective

• Address the challenge of semantics-equivalent code transformations (e.g., optimization, obfuscation) that break traditional syntax- and structure-based clone detection.
• Overcome the trade-off between detection accuracy and code coverage inherent in purely static or dynamic analysis methods.
• Develop a hybrid approach that leverages runtime semantics from executed templates and emulates target functions to ensure full coverage.
• Enable robust clone detection across diverse compilation configurations and obfuscation techniques commonly used in real-world binaries.

Proposed method

• Instrument and execute a template binary function with real test cases to capture its runtime behavior, including input values, memory accesses, and system calls.
• Migrate the runtime information (e.g., argument values, control flow) from the template to each candidate target function for execution emulation.
• Emulate each target function using the migrated runtime context to extract semantic signatures during execution.
• Extract semantic signatures based on read/write memory values, comparison operands, and library function invocations to represent functional behavior.
• Compare semantic signatures between the template and target functions using a similarity score to detect clones.
• Implement novel strategies to handle indirect calls, jumps, and global variable reads during emulation to preserve semantic fidelity.

Experimental results

Research questions

• RQ1 Can a hybrid approach combining dynamic execution and static emulation achieve both high detection accuracy and full code coverage in binary clone detection?
• RQ2 How robust is the proposed method to semantics-equivalent code transformations such as compiler optimizations and code obfuscation?
• RQ3 Can semantic signatures derived from runtime behavior and emulation outperform syntax- and structure-based features in clone detection?
• RQ4 To what extent does the method maintain accuracy when analyzing binaries compiled with different configurations or obfuscated with common techniques?

Key findings

• BinMatch demonstrated robustness to various semantics-equivalent code transformations, including link-time optimizations and common obfuscation techniques.
• The system achieved 100% coverage of all target functions by emulating each function using migrated runtime information from the template.
• BinMatch outperformed state-of-the-art tools like BinDiff and Kam1n0 in both detection accuracy and resilience to code transformations.
• The method successfully captured core functional semantics through semantic signatures derived from memory operations, comparisons, and library calls.
• Over 100 million function pairs were analyzed across eight real-world projects compiled with diverse configurations, validating scalability and effectiveness.
• The hybrid execution-emulation strategy enabled rich semantic capture without relying on syntactic features, improving detection reliability.