BINO: Automatic Recognition of Inline Binary Functions from Template Classes

In this paper, we propose BINO, a static analysis approach that relieves reverse engineers from the chal-lenging task of recognizing library functions that have been inlined. BINO recognizes inline calls of meth-ods of C++ template classes (even with unknown data types). We do this through a binary fingerprinting and matching approach. Our fingerprint model captures syntactic and semantic features of an assem-bly function, along with its Control-Flow Graph structure. Using these fingerprints and subgraph isomor-phism, it recognizes inline method calls in a target binary. BINO automates the fingerprints generation phase by parsing the source code of the template classes and automatically building appropriate bina-ries with representative inline calls of said methods. We evaluate BINO by performing experiments on a dataset of 555 GitHub C++ projects containing 10,600 inline functions, exploring several optimization levels that allow the compiler to inline function calls. We show that our approach can recognize inline function calls to the most used methods of well-known template classes with an F1-Score up to 63% with the-O2,-O3, and-Ofast optimizations levels.