Accurate and Scalable Cross-Architecture Cross-OS Binary Code Search with Emulation

Similar code search in binary executables faces big challenges due to the gigantic differences in syntax and structure of binary code that result from different configurations of compilers, architectures and OSs. In our previous study and the tool BINGO, to mitigate the huge gaps in CFG structures due to different compilation scenarios, we propose a selective inlining technique to capture the complete function semantics by inlining relevant library and user-defined functions. However, only features of input/output values are considered in BINGO. In this study, we propose to incorporate features from different categories (e.g., structural features and high-level semantic features) for accuracy improvement and emulation for efficiency improvement. We empirically compare our tool, BINGO-E, with the pervious tool BINGO and the available state-of-the-art tools of binary code search in terms of search accuracy and performance. Results show that BINGO-E achieve significantly better accuracies than BINGO for cross-architecture matching, cross-OS matching, cross-compiler matching and intra-compiler matching. Additionally, in the new task of matching binaries of forked projects, BINGO-E also exhibits a better accuracy than the existing benchmark tool. Meanwhile, BINGO-E takes less time than BINGO during the process of matching.