Analyzing the behavior of cryptographic functions in stripped binaries is a challenging but essential task. Cryptographic algorithms exhibit greater logical complexity compared to typical code, yet their analysis is unavoidable in areas such as virus analysis and legacy code inspection. Existing methods often rely on data or structural pattern matching, leading to suboptimal generalizability and suffering from manual work. In this paper, we propose a novel framework called FoC to Figure out the Cryptographic functions in stripped binaries. In FoC, we first build a binary large language model (FoC-BinLLM) to summarize the semantics of cryptographic functions in natural language. The prediction of FoC-BinLLM is insensitive to minor changes, such as vulnerability patches. To mitigate it, we further build a binary code similarity model (FoC-Sim) upon the FoC-BinLLM to create change-sensitive representations and use it to retrieve similar implementations of unknown cryptographic functions in a database. In addition, we construct a cryptographic binary dataset for evaluation and to facilitate further research in this domain. And an automated method is devised to create semantic labels for extensive binary functions. Evaluation results demonstrate that FoC-BinLLM outperforms ChatGPT by 14.61% on the ROUGE-L score. FoC-Sim outperforms the previous best methods with a 52% higher Recall@1. Furthermore, our method also shows practical ability in virus analysis and 1-day vulnerability detection.

翻译：分析脱壳二进制文件中密码学函数的行为是一项具有挑战性但至关重要的任务。相较于常规代码，密码算法展现出更高的逻辑复杂性，但其分析在病毒分析和遗留代码审查等领域不可避免。现有方法通常依赖于数据或结构模式匹配，导致泛化能力欠佳且依赖人工操作。本文提出了一种名为FoC的新型框架，用于识别脱壳二进制文件中的密码学函数。在FoC中，我们首先构建了一个二进制大语言模型（FoC-BinLLM），用于以自然语言概括密码学函数的语义。FoC-BinLLM的预测对微小变更（如漏洞补丁）不敏感。为缓解此问题，我们在FoC-BinLLM基础上进一步构建了二进制代码相似性模型（FoC-Sim），以生成对变更敏感的表示，并利用该模型在数据库中检索未知密码学函数的相似实现。此外，我们构建了密码学二进制数据集用于评估，并促进该领域的进一步研究。同时设计了一种自动化方法，为海量二进制函数生成语义标签。评估结果表明，FoC-BinLLM在ROUGE-L分数上较ChatGPT提升14.61%。FoC-Sim的Recall@1指标较先前最优方法提高52%。进一步地，我们的方法在病毒分析和一日漏洞检测中也展现出实际应用能力。