1-to-1 or 1-to-n? Investigating the Effect of Function Inlining on Binary Similarity Analysis

Abstract

Binary similarity analysis is critical to many code-reuse-related issues, where function matching is its fundamental task. “ 1-to-1 ” mechanism has been applied in most binary similarity analysis works, in which one function in a binary file is matched against one function in a source file or binary file. However, we discover that the function mapping is a more complex problem of “ 1-to-n ” (one binary function matches multiple source functions or binary functions) or even “ n-to-n ” (multiple binary functions match multiple binary functions) due to the existence of function inlining , different from traditional understanding. In this paper, we investigate the effect of function inlining on binary similarity analysis. We carry out three studies to investigate the extent of function inlining, the performance of existing works under function inlining, and the effectiveness of existing inlining-simulation strategies. Firstly, a scalable and lightweight identification method is designed to recover function inlining in binaries. 88 projects (compiled in 288 versions and resulting in 32,460,156 binary functions) are collected and analyzed to construct 4 inlining-oriented datasets for 4 security tasks in the software supply chain, including code search, OSS (Open Source Software) reuse detection, vulnerability detection, and patch presence test. Datasets reveal that the proportion of function inlining ranges from 30%-40% when using O3 and sometimes can reach nearly 70%. Then, we evaluate 4 existing works on our dataset. Results show most existing works neglect inlining and use the “1-to-1” mechanism. The mismatches cause a 30% loss in performance during code search and a 40% loss during vulnerability detection. Moreover, most inlined functions would be ignored during OSS reuse detection and patch presence test, thus leaving these functions risky. Finally, we analyze 2 inlining-simulation strategies on our dataset. It is shown that they miss nearly 40% of the inlined functions, and there is still a large space for promotion. By precisely recovering when function inlining happens, we discover that inlining is usually cumulative when optimization increases. Thus, conditional inlining and incremental inlining are recommended to design a low-cost and high-coverage inlining-simulation strategy.

Cross-Inlining Binary Function Similarity Detection

“…Jia [49] has conducted the first systematical empirical study to investigate the effect of function inlining on binary function similarity analysis. They evaluated four works on the dataset with inlining, and results show that most works suffer a 30%-40% performance loss when detecting the functions with inlining.…”

“…Recently, Jia [50] has proposed a method named O2NMatcher to investigate the binary2source matching method under function inlining. In binary2source matching, binary functions can be generated by several source functions.…”

“…We construct a cross-inlining dataset by using Binkit [54] and propose a cross-inlining labeling method leveraging the function inlining identification method in Jia [49].…”

“…We further construct the binary2source function mappings for these two datasets respectively. We follow the workflow in Jia [49]: we first extract the address-to-line mappings from the .debug_line section, then we extract the address-to-binary-function and lineto-source-function relation to get the functions that the address or line belongs to, and finally we construct the binary2source function mappings by aligning the binary functions with their mapped source functions.…”

“…Function inlining widely exists in binaries [48]. Though many works [25, 26, 29, 30, 37, 38, 51, 61, 63, 74, 76-79, 81, 82] are proposed to resolve the cross-optimization, cross-compiler, and crossarchitecture problems in binary code similarity, few works are targeted at cross-inlining.…”