CCall: Recovering Indirect Call Targets from Binaries With Cross-Domain Fine-Tuning

Reconstructing control flow graphs from stripped binaries remains a conundrum. One of the crucial challenges is recovering the targets of indirect calls. Existing solutions rely heavily on expert knowledge or have limited generalization capability. In this paper, we propose CCall, a novel solution that combines neural network models with a cross-domain fine-tuning strategy to automatically identify the targets of indirect calls. To make up for the shortcomings of existing methods and obtain sufficient code semantics from binaries, we introduce the concept of Inter-procedural Control Flow Sub graph (ICFSG) to capture the complete execution flow and path-sensitive semantics. Additionally, we pre-train a representation model for fine-grained embedding of binary code and design a composite neural network to capture the contextual relationship between indirect call sites and their targets. To improve performance when dealing with binaries exhibiting diverse semantics, we integrate domain adaptation into binary analysis and conduct a cross-domain fine-tuning strategy, which allows the model to learn the distinctive distribution and semantics of unlabeled test binaries. Evaluated on groups of binaries with over 6 million indirect call samples, CCall achieves an Fl-score of 92.54%, outperforming existing solutions. We extended our evaluations to different optimization levels, architectures, and compiles to gain deeper insights into the cross-domain capability of our solution. The evaluation demonstrates that our cross-domain fine-tuning strategy enhances the model's generalization ability and can be applied to other AI-based binary analysis tasks.