CALLEECALLEE: Recovering Call Graphs for Binaries with Transfer and Contrastive Learning

Recovering call graphs of binary programs plays an instrumental role in facilitating inter-procedural analysis tasks and subsequent applications. A salient challenge inherent in this process is the identification of indirect call targets, i.e., indirect callees. Existing solutions all have high false positives and negatives, making call graphs inaccurate. In this paper, we introduce CALLEE, an approach combining transfer learning and contrastive learning. The key insight is that, deep neural networks (DNNs) can automatically identify patterns concerning indirect calls. Inspired by question-answering applications, we employ contrastive learning to answer the callsite-callee question. To overcome the data-intensive nature of DNNs, we use transfer learning to pre-train on easy-to-collect direct calls and then fine-tune with indirect calls. Upon evaluating CALLEE across various target sets, our findings underscored its efficacy, associating callsites with callees surpasses state-of-the-art solutions, achieving over seven to eight times higher performance in both MRR and Recall@5. Further, when implementing CALLEE within two distinct applications-binary code similarity detection and hybrid fuzzing-we observed a marked enhancement in their operational performance.