PaperlayerView exact revision on arXiv

Source-linked AI summary

Hieronym: Leveraging Hierarchical Multi-Source Information for Function Renaming in Stripped Binary

Xiaoling Zhang, Jian Sun, Dawei Wang, Chongyu Wang, Li Chen, Zhaoteng Yan, Peipei Liu, Lixiao Zhang, Dan Li

arXiv:2609.12457v1cs.SE

TL;DR

Stripped-binary function renaming requires recovering semantics and expressing them as concise names, while existing approaches have limitations in semantic coverage and generalization. Hieronym combines hierarchical summarization-based adaptation with multiple information sources and dual-layer evaluation. Across four architectures and four optimization levels, it improves token-level F1-score by 45.10% over state-of-the-art methods.

  • Problem

    Function renaming must recover binary-function semantics and express them as concise, meaningful natural-language names, while existing approaches have limited semantic coverage and generalization to unseen binaries.

    Source: §1 · p. 1

  • Method

    Hieronym adapts generative LLMs through hierarchical function summarization, integrates global binary context, local calling context, and the target function, and evaluates names at token and whole-name levels.

    Source: §1 · pp. 2–3

  • Results

    Across four architectures and O0–O3, Hieronym improves token-level F1-score by 45.10% over state-of-the-art function-renaming methods.

    Source: §1 · p. 2

  • Takeaways & Limitations

    Function names provide concise abstractions and cognitive anchors for program comprehension, and the paper reports practical utility on real-world malware binaries.

    Source: §1 · p. 1, §9 · p. 14

    Experiments use the same base model and setup as SymGen, while the model-agnostic approach could improve with larger or more advanced base models.

    Source: §7 · p. 12

Abstract

from arXiv · show

Function renaming in stripped binaries can substantially assist reverse engineers by improving code readability, yet it is a challenging task. The difficulty stems from the need to accurately capture function semantics from low-level binary code across diverse instruction sets, architectures, and compiler optimizations, and to express these semantics in concise, human-readable names. Existing approaches either inadequately capture comprehensive function semantics or exhibit limited generalization to previously unseen binaries. In this paper, we present Hieronym, a generative large language model (LLM)-based framework for stripped binary function renaming. Hieronym adopts a hierarchical summarization-driven domain adaptation strategy and integrates multi-source information, including global binary context, local calling context, and intrinsic function semantics, to enhance the LLM's understanding of binary code. To enable systematic evaluation, we further propose a dual-layer evaluation framework that incorporates both token-level and whole-name-level metrics. We evaluate Hieronym on binary functions compiled with four compiler optimization levels (O0-O3) for four architectures (x64, x86, ARM, and MIPS). Experimental results demonstrate that Hieronym significantly outperforms state-of-the-art methods, achieving token-level improvements of 50.12% in precision, 41.75% in recall, and 45.10% in F1-score, as well as a 79.94% improvement in name-level accuracy, while also exhibiting strong generalization capability. Moreover, experiments on real-world malware samples further validate the practical effectiveness of Hieronym in security-critical scenarios.

1 Introduction

Hieronym addresses the difficulty of recovering concise, meaningful function names from stripped binaries and the limits of prior evaluation and modeling approaches. It combines hierarchical summarization, multi-source context, and dual-layer evaluation; experiments report gains over prior methods across architectures and optimization levels.

1 Introduction

  • Stripped binaries obscure program intent, and address-based placeholders leave function naming dependent on time-consuming, labor-intensive expert analysis.Function names provide concise abstractions of program functionality and cognitive anchors for program comprehension.Source: §1 · pp. 1–2
  • Prior token-level evaluation can penalize unrecoverable project-specific details and produce distorted scores when tokenization is erroneous.For example, SymGen tokenizes c_isascii_string into {c, isa, sc, ii, string}, reducing its F1-score from 0.857 to 0.25.Source: §1 · p. 2
  • Stripped functions contain sparse semantics, while existing contextual representations can remain insufficient for context-specific identifiers and sensitive to architecture and optimization changes.General-purpose LLMs also have limited binary understanding, and function-level summaries alone may miss deep and comprehensive semantics.Source: §1 · p. 2
  • Across four architectures and O0–O3, Hieronym improves token-level precision by 50.12%, recall by 41.75%, and F1-score by 45.10%, and improves name-level accuracy by 79.94% over the best prior method.The evaluation also reports strong generalizability and practical utility on real-world malware binaries.Source: §1 · pp. 2–3
  • Hieronym combines global binary context, local calling context, and target-function semantics with hierarchical function summarization for domain adaptation.The paper also proposes token- and name-level evaluation; experiments report that individual components contribute to performance.Source: §1 · p. 3

2 Background and Motivation

Function renaming models generate natural-language names from binary functions, with generative LLMs producing names autoregressively. The background identifies weaknesses in prior evaluation, context modeling, and function-level summarization that motivate Hieronym.

2.1 Problem Definition

  • A generative renaming model maps binary-function tokens to natural-language name tokens, with each generated token conditioned on earlier tokens and the function semantics.This contrasts with classification approaches that select from a closed vocabulary.Source: §2.1 · p. 3

2.2 Existing Techniques and Our Motivations

  • Rule-based tokenization and limited semantic alignment can make token-level renaming evaluations unreliable, while prior methods lack whole-name evaluation.The cited examples include segmentation errors and weak coverage of out-of-vocabulary tokens.Source: §2.2 · p. 3
  • A target function alone may not reveal its name: callers, callees, and domain information can provide relevant cues, but prior context representations are sensitive to architecture and optimization settings.The passage reports a 60.2% F1-score drop for SymLM from O3 to O0.Source: §2.2 · pp. 3–4
  • Function-level summaries convey overall functionality, while statement-level summaries capture implementation logic; the two levels provide complementary semantic views.The passage states that function-level summaries alone are insufficient to capture fine-grained implementation details.Source: §2.2 · p. 4

3 Evaluation Framework

The framework evaluates function renaming at both token and whole-name levels. It combines hybrid tokenization and semantic alignment for token scoring with an LLM-assisted assessment of name-level semantic consistency.

3 Evaluation Framework

  • The dual-level framework pairs token-level evaluation with name-level evaluation to assess fine-grained recognition and holistic semantic expressiveness.It is designed to address limitations of relying on token-level metrics alone.Source: §3 · p. 4

3.1 Token-Level Evaluation

  • For unconventional function names, the framework combines rule-based tokenization with few-shot LLM segmentation and votes across three outputs.A boundary is retained when at least two outputs suggest it; the candidate with the largest intersection with retained boundaries is selected.Source: §3.1 · p. 4
  • Token alignment recognizes morphological variants, abbreviations, misspellings, and synonyms to account for lexical diversity.The framework uses lemmatization, Smith-Waterman similarity, Damerau-Levenshtein similarity, and embedding similarity for these relationships, respectively.Source: §3.1 · p. 4
  • Token-level precision, recall, and F1 count exact or semantically aligned predicted tokens as true positives and measure overlap with ground-truth tokens.False positives are predicted tokens absent from the ground truth; false negatives are ground-truth tokens not predicted.Source: §3.1 · p. 4

3.2 Name–Level Evaluation

  • Name-level accuracy uses GPT-4o judgments checked against embedding similarity, requiring both to agree that a prediction matches the ground-truth name.Evaluation samples 200 test functions per architecture–optimization pair, totaling 3,200 functions.Source: §3.2 · p. 5

4 Approach

Hieronym combines hierarchical binary summarization, multi-source function context, and renaming fine-tuning. The approach uses summaries at function and statement levels and fuses binary-wide context, direct callers and callees, and the target function.

4.1 Overview

  • Hieronym’s three stages are hierarchical domain adaptation, multi-source information fusion, and renaming fine-tuning for accurate, generalizable function renaming.The fused input includes global binary context, local calling context, and the target function.Source: §4.1 · p. 5

4.2 Hierarchical Domain Adaptation

  • Hierarchical domain adaptation uses function-level summaries for high-level intent and statement-level summaries for fine-grained implementation logic.Statements are extracted from AST control-flow constructs; generated summaries focus on stable features such as inputs, outputs, key steps, and logical structure.Source: §4.2 · pp. 5–6
  • Stripped and unstripped functions are paired by addresses, while statements are aligned using structural and semantic similarity rather than line numbers.Statement matching combines AST-path Jaccard similarity and CodeBERT cosine similarity, enforces statement-type consistency, and requires a score threshold.Source: §4.2 · p. 6

4.3 Multi-Source Information Fusion

  • The semantic fusion module combines global binary context, direct calling context, and the target function.Global context summarizes filtered strings alongside file-type and dynamic-dependency information to capture domain cues.Source: §4.3 · p. 6
  • Local calling context represents internal callers and callees with function summaries and external functions with their names.The target function is represented by decompiled code with address-based function names replaced by a [MASK] token.Source: §4.3 · p. 7

4.4 Function Renaming Fine-Tuning

  • Renaming fine-tuning adapts the binary-domain LLM to the task using developer-defined function names as ground truth and autoregressive generation.The input consists of global context, calling context, and target function information.Source: §4.4 · p. 7
  • LoRA freezes the pretrained attention weights and learns low-rank updates, reducing trainable parameters from d×d to 2×r×d when r≪d.The updates are incorporated through residual connections.Source: §4.4 · p. 7

5 Evaluation

The evaluation compares Hieronym with baselines and tests its components and generalization across settings. Hieronym outperforms SymGen on token- and name-level comparisons, while context and hierarchical adaptation improve performance.

5.1 Experimental Setup

  • Baselines are trained under the same settings, but XFL and BLens are evaluated only on x64 because of their design and representation dependencies.The study uses Code Llama as its base model, matching SymGen’s configuration.Source: §5.1 · p. 8, §5.3 · p. 9

5.2 Dataset Construction

  • The dataset covers 33 projects, 9,842 binaries, and 2,237,915 functions across four architectures and four optimization levels; Hieronym trains one model per architecture.Source-based splitting and strict deduplication are used, and the domain-adaptation data is constructed exclusively from the training set.Source: §5.2 · p. 8

5.3 RQ1: Overall Effectiveness

  • Weighted-macro precision, recall, and F1 are 0.4487, 0.4223, and 0.4339; performance is strongest on x64 and weakest on MIPS.Name-level accuracy is highest on x64 (0.4254) and lowest on MIPS (0.1709); the name-level results use a sampled test subset.Source: §5.3 · pp. 8–9

5.4 RQ2: Baseline Comparison

  • Against SymGen, Hieronym improves token-level precision by 50.12%, recall by 41.75%, and F1-score by 45.10%; name-level accuracy improves by 79.94%.The token-level comparison uses SymGen’s configuration; name-level evaluation compares Hieronym and SymGen.Source: Table 1 · p. 9, §5.4 · pp. 9–10, Table 2 · p. 9

5.3 RQ1: Overall Effectiveness

  • Manual evaluation of 1,600 predictions finds 89.8% agreement with human judgment for token-level semantic alignment and 89.2% for name-level evaluation.The name-level metric reduces GPT hallucinations by 11.28%.Source: §5.3 · p. 9

5.5 RQ3: Ablation Study

  • On x64 across O0–O3, hierarchical adaptation improves precision, recall, and F1 by 11.14%, 26.76%, and 18.83% over no adaptation, and by 8.49%, 9.43%, and 8.95% over function-only adaptation.The authors attribute the additional benefit to statement-level semantic learning complementing function-level understanding.Source: Figure 3 · p. 10, §5.5 · p. 10
  • Global context raises average F1 from 0.4117 to 0.5256, while calling context yields average gains of 10.52% in precision, 17.22% in recall, and 13.81% in F1.Calling-context gains are more pronounced at O0/O1 and diminish at O2/O3, where inlining can remove explicit call relationships.Source: Figure 4 · p. 10, §5.5 · pp. 10–11, Figure 5 · p. 10

5.6 RQ4: Generalizability Test

  • Across compilers, decompilers, projects, obfuscation, and languages, Hieronym consistently exceeds SymGen, with 49.68% cross-compiler F1 and 20.54% cross-decompiler F1 improvements.It also performs better on unseen projects, obfuscated binaries, C++ binaries, and Java method names.Source: §5.6 · p. 11, Table 5 · p. 11

6 Illustration

In sampled predictions and tokenization comparisons, Hieronym often captures function semantics and can recover project-specific tokens. Applied without additional fine-tuning to malware functions, it achieves an F1-score of 0.4876.

6.1 Qualitative Evaluation

  • Qualitative examples show Hieronym recovering project-specific tokens and semantically equivalent names, while tokenization choices can change an example’s F1 from 0.25 to 0.857.The higher score for c_isascii_string uses the paper’s tokenization rather than SymGen’s.Source: §6.1 · p. 12

6.2 Effectiveness on Real-world Binaries

  • Without additional fine-tuning, Hieronym achieves 0.4876 F1 on 2,478 malware functions, comparable to its performance on the primary evaluation dataset.The malware samples are an external test set with stripped symbol tables and ground-truth names retained from the originals.Source: §6.2 · p. 12

7 Limitation & Future Work

The authors identify constraints involving the base model, statement extraction, data quality, generated summaries, evaluators, and inference cost, and describe related future-work directions.

Base Model

  • Hieronym uses the same base model and experimental setup as SymGen, while larger or more advanced models remain a possible route to improved performance.The authors also identify integration with alternative base models as future work.Source: §7 · p. 12

Statement Extraction Effectiveness; Dataset Quality

  • Heuristic statement extraction lacks objective quality metrics, while decompiler inaccuracies and ambiguous function names can affect dataset quality.The authors identify improved extraction, higher-fidelity decompilation, and automated filtering of low-quality names as future directions.Source: §7 · p. 13

Domain-Adaptation Dataset

  • Qwen3-Coder-30B-generated training summaries may vary in quality and style, and proprietary alternatives are considered impractical for large-scale dataset construction because of cost.The authors expect more consistent code-snippet summaries could improve Hieronym.Source: §7 · p. 13

Evaluator Selection

  • Qwen3-Code-30B agrees with human judgments on 76.31% of 1,600 samples, compared with 87.56% for GPT.The authors note that local LLM evaluators similar to Hieronym may introduce bias and identify stronger open-source evaluators as future work.Source: §7 · p. 13

Inference Efficiency and Cost

  • Hieronym averages 20.69 tokens and 0.0333 seconds per function name, versus SymGen’s 14.86 tokens and 0.0245 seconds.On binaries with 2,284 functions, Hieronym processes 3.27 functions per second, or 0.3056 seconds per function end to end; its two summarization stages are parallelizable.Source: §7 · p. 13

8 Related Work

Prior work on binary function renaming spans traditional machine learning, neural models, and LLMs, while source-code summarization research informs Hieronym’s domain-adaptation data.

8.1 Function Renaming For Stripped Binaries

  • Earlier renaming methods use varied representations and models, but closed-vocabulary token selection restricts generalization to unseen or semantically novel names.LLM-based approaches include llasm and SymGen; Hieronym compares against SymLM, XFL, BLens, and SymGen.Source: §8.1 · p. 13

8.2 Source Code Summarization

  • Source-code summarization research progressed from data-driven encoder-decoder methods to structural approaches and LLM prompting, which Hieronym draws on to build domain-adaptation supervision.Prior work reports strong zero-shot LLM summaries [57] and few-shot prompting gains over supervised approaches [1].Source: §8.2 · pp. 13–14

9 Conclusion

Hieronym combines hierarchical summarization-driven domain adaptation with multi-source information for stripped-binary function renaming. The paper reports gains over prior methods and describes its prompt and evaluation designs.

9 Conclusion

  • 50.12% in token-level precision, 41.75% in recall, 45.10% in F1-score, and 79.94% in name-level accuracy are the reported improvements over prior methods.The conclusion also reports effective ablations and practical utility on real-world malware binaries.Source: §9 · p. 14

A Prompts for Global Context Summarization and Hierarchical Summary Generation

  • Global context uses extracted string literals, file-type metadata, and dynamic-linkage dependencies to prompt a 100–150-word summary, while function and statement prompts produce high- and low-level summaries.The function-level prompt masks the original name, and function- and statement-level prompts use one-shot examples.Source: A Prompts for Global Context… · pp. 16–17, Figure 6 · p. 16

B Prompt for Function Renaming Task Fine-Tuning

  • Fine-tuning prompts combine global binary context, selected local calling-context summaries, and masked decompiled code for the target function.For efficiency, only the five most salient internal caller and callee summaries are retained.Source: B Prompt for Function Renaming Task… · pp. 17–18

C Prompts for Evaluation

  • Evaluation pairs token-level scoring with whole-name semantic consistency judgments, using prompted LLM tokenization and global context for the name-level assessment.The name-level strategy is described as insensitive to incorrect tokenization.Source: C Prompts for Evaluation · p. 18

D Source Project and Binaries in Our Dataset

The dataset includes GCC-compiled binaries from open-source projects across four architectures and optimization levels, plus a Clang recompilation for cross-compiler evaluation.

D Source Project and Binaries in Our Dataset

  • The SymGen dataset comprises 33 open-source projects and 9,842 unique binaries compiled with GCC 9.4.0.The projects include GNU examples such as bash, wget, and coreutils.Source: D Source Project and Binaries in Our… · p. 19
  • The GCC binaries cover four optimization levels, O0–O3, and four architectures: x86, x64, ARM, and MIPS.The source projects are described as representative and widely used in binary-analysis research.Source: D Source Project and Binaries in Our… · p. 19
  • Recompiling the projects with Clang 14.0.0 across the same optimization levels and architectures produced 10,000 additional unique binaries for cross-compiler generalization evaluation.Source: D Source Project and Binaries in Our… · p. 19

E Re-evaluation Based on SymGen Metrics

Under SymGen’s evaluation setting, Hieronym outperforms SymGen; the re-evaluation uses SymGen’s metrics and treats semantically similar tokens as correct.

E Re-evaluation Based on SymGen Metrics

  • The re-evaluation adopts SymGen’s precision, recall, and F1-score metrics, with both exact and semantically similar tokens counted as correct.CodeWordNet is used by SymGen to capture relationships among morphologically or semantically related tokens.Source: E Re-evaluation Based on SymGen Metrics · p. 19
  • 53.23%, 44.33%, and 47.96% improvements in precision, recall, and F1-score, respectively, put Hieronym ahead of SymGen under SymGen’s evaluation setting.The reported comparisons cover different architectures and optimization levels.Source: Table 8 · p. 19, E Re-evaluation Based on SymGen Metrics · p. 19
  • Hieronym uses a multi-dimensional association mechanism for semantically equivalent tokens, whereas SymGen uses CodeWordNet to mitigate label noise.The passage states that Hieronym’s mechanism improves robustness to lexical variability.Source: E Re-evaluation Based on SymGen Metrics · p. 19

F Cross-Compiler Generalization Results

On Clang-compiled binaries, Hieronym outperforms SymGen across architectures and optimization levels, with comparable performance across compilers indicating strong cross-compiler generalization.

F Cross-Compiler Generalization Results

  • The Clang comparison uses the same test split and strict deduplication strategy as Section 5.2 and evaluates token-level metrics.Source: F Cross-Compiler Generalization Results · p. 20
  • 47.46%, 52.19%, and 49.68% relative improvements in weighted macro-average precision, recall, and F1-score, respectively, distinguish Hieronym from SymGen on Clang binaries.Hieronym’s weighted macro-average scores are 0.4694, 0.4499, and 0.4587; SymGen’s are 0.3344, 0.3028, and 0.3173.Source: F Cross-Compiler Generalization Results · p. 20
  • Comparable performance on Clang and GCC test sets indicates strong cross-compiler generalization for both methods.The passage suggests LLM-based approaches may reduce compiler-specific variation by operating on decompiled code.Source: F Cross-Compiler Generalization Results · p. 20
  • Both methods remain strong on x64 and x86 but drop substantially on ARM and MIPS in the Clang dataset.The passage reports architecture-dependent trends similar to those on the GCC-compiled dataset.Source: F Cross-Compiler Generalization Results · p. 20

G Cross-Decompiler Generalization Results

On binaries redecompiled with IDA Pro 9.0, Hieronym outperforms SymGen across architectures and optimization levels; recovered strings provide additional semantic cues, especially for SymGen.

G Cross-Decompiler Generalization Results

  • The test set is redecompiled using IDA Pro 9.0, with strict deduplication and token-level evaluation.Source: G Cross-Decompiler Generalization… · p. 20
  • 15.56%, 25.21%, and 20.54% relative improvements in weighted macro-average precision, recall, and F1, respectively, put Hieronym ahead of SymGen on IDA Pro 9.0 output.Hieronym’s weighted macro-average scores are 0.4867, 0.4433, and 0.4633; SymGen’s are 0.4219, 0.3557, and 0.3853.Source: Table 10 · p. 20, G Cross-Decompiler Generalization… · p. 20
  • The results indicate strong cross-decompiler generalization for both methods, with SymGen exhibiting particularly large gains over its original GCC test-set performance.Source: G Cross-Decompiler Generalization… · p. 20
  • IDA Pro often recovers referenced strings directly in decompiled ARM functions, while Ghidra typically represents the same content as memory addresses.Those recovered strings provide semantic cues; Hieronym’s global and call-context inputs make their contribution comparatively limited, while SymGen benefits more.Source: G Cross-Decompiler Generalization… · p. 20
  • The findings identify improved decompilation quality as an effective direction for enhancing function-renaming performance.Source: G Cross-Decompiler Generalization… · p. 20
Loading 2609.12457v1…