Binary Code Similarity Detection via LLM-based Source Code Conversion

Binary Code Similarity Detection (BCSD), a technique for assessing the similarity between two given binary code snippets, holds significant value in searching for vulnerable functions within embedded device firmware, which is typically closed-source. However, existing BCSD approaches face two major challenges: the irreversible loss of semantic and structural information during the process of binary code compilation, which affects detection performance; and the inability to directly perform similarity detection between binary code and source code. In this paper, we present Bin2SrcSim, a novel BCSD approach that employs a Large Language Model (LLM) to convert binary code into source code representations. Bin2SrcSim fine-tunes an LLM at the function-level to transform assembly code and pseudocode into source code. Consequently, the similarity between any two binary code functions can be assessed by calculating the cosine similarity and Jaccard similarity of the transformed source code. The experimental results demonstrate that Bin2SrcSim outperforms all baselines, achieving Recall@1 scores of 0.82, 0.83, 0.93, and 0.81 across various scenarios involving cross-architecture, cross-compiler, and cross-optimization levels. Bin2SrcSim also demonstrates satisfactory performance in vulnerable function search within real-world IoT device firmware. Moreover, Bin2SrcSim supports similarity detection between binary code and source code, expanding the scope of detection applications.