3 ms·
I've been waiting to see something like this. There's certainly room to fine-tune an LLM for this task; in that vein, I wonder whether Ghidra's pcode would prod
by popinman322 4y ago
I've been waiting to see something like this. There's certainly room to fine-tune an LLM for this task; in that vein, I wonder whether Ghidra's pcode would produce better results? It's a bit better suited to this task in that the model wouldn't need to be tuned for each possible instruction set. Training on code compiled at different optimization levels might also produce interesting results.
You could probably also take the explanations from the LLM, convert those into embeddings, and then do semantic search over all functions in a binary. For example, searching for "get process handle and inject dll" and getting a list of prospects. It's less useful in an obfuscated binary, but for things like modding games or extending end-of-life software it could be very useful.
- TOMDM 4y agoI'd never considered semantic search for code vulnerabilities. Maybe this is the next generation of automated code scanning. Next feature on github: "Our LLM has scanned your code and found a potential buffer overflow. Please mark as a bug or a false report"
- popinman322 4y agoI know there's some active work on this (using LLMs, not traditional methods), not on the binary side but on the source analysis side. See https://grit.io/ https://grit.io/, which tries to detect bugs (and maybe vulnerabilities?) and automatically submits PRs to patch them for you. I think morgante is their contact on HN. It feels like it'd be difficult to acquire a large corpus of vulnerabilities to train on.
- ta988 4y agoThere are already systems for that in github enterprise. It works decently if you can massage your build to fit in their system. It is still more or less experimental for some languages.
- comon 4y agoSemmle (now GitHub CodeQL) ShiftLeft Oversecured etc. There are a few companies doing this.
- hoosieree 4y agoMy PhD research is about classifying functions in obfuscated binaries, and when I saw this I immediately wondered if it will make my work obsolete. I suspect obfuscation will give LLMs a hard time for a little while, at least until they start training on obfuscated code. But there is still the issue of whether companies doing this kind of RE want to send their code to OpenAI's servers. If you're reverse engineering in order to determine whether you should sue another company for copyright infringement, you are probably cautious about sharing code in the first place. For this use case there will always be a need for some kind of alternative that you can self-host without sharing your data with another party.