1-to-1 or 1-to-n? Investigating the Effect of Function Inlining on Binary Similarity Analysis

Binary similarity analysis is critical to many code-reuse-related issues, where function matching its fundamental task. “ 1-to-1 ” mechanism has been applied in most binary works, which one a file matched against source or file. However, we discover that the mapping more complex problem of 1-to-n (one matches multiple functions functions) even n-to-n (multiple match due existence inlining , different from traditional understanding. In this article, investigate effect on analysis. We carry out three studies extent inlining, performance existing works under and effectiveness inlining-simulation strategies. Firstly, scalable lightweight identification method designed recover binaries. 88 projects (compiled 288 versions resulting 32,460,156 are collected analyzed construct four inlining-oriented datasets for security tasks software supply chain, including code search, OSS (Open Source Software) reuse detection, vulnerability patch presence test. Datasets reveal proportion ranges 30–40% when using O3 sometimes can reach nearly 70%. Then, evaluate our dataset. Results show neglect use “1-to-1” mechanism. The mismatches cause 30% loss during search 40% detection. Moreover, inlined would be ignored detection test, thus leaving these risky. Finally, analyze two strategies It shown they miss functions, there still large space promotion. By precisely recovering happens, usually cumulative optimization increases. Thus, conditional incremental recommended design low-cost high-coverage strategy.