本地运行的代码大模型REx86,让逆向工程更高效安全。
REx86: A Local Large Language Model for Assisting in x86 Assembly Reverse Engineering
- 用5981条汇编样例微调开源模型,专攻x86逆向任务。
- 相比基线模型,交叉熵降低64.2%,语义相似度提升20.3%。
- 适合需隐私保护的封闭环境使用,减少幻觉且注释更准确。
x86二进制逆向工程对恶意软件和固件分析至关重要,但因元数据缺失和对抗性混淆而进展缓慢。大型语言模型(LLMs)有望通过自动化理解与注释提升效率,但云端托管、闭源权重的模型存在隐私与安全风险,无法在封闭网络中使用。本文评估了参数高效微调的本地LLM在该场景下的应用。选取代码大模型、Qwen2.5-Coder和CodeGemma系列共八款开源模型,在自建的5,981条x86汇编示例数据集上进行微调。定量评估显示,微调后的Qwen2.5-Coder-7B表现最佳,命名为REx86。其测试集交叉熵损失降低64.2%,语义余弦相似度相较基线提升20.3%。有限用户案例研究(n=43)表明,REx86显著提升逐行代码理解(p=0.031),正确解题率从31%增至53%(p=0.189),虽未达统计显著,但定性分析显示注释更准确、简洁,幻觉更少。REx86在本地开放权重模型中达到当前最优逆向辅助效果。研究证实领域微调的价值,并呼吁更多带注释的反汇编数据以进一步提升性能。REx86、数据集及LoRA适配器已公开于https://github.com/dlea8/REx86和https://zenodo.org/records/15420461。
原文摘要 · Abstract (English)
Reverse engineering (RE) of x86 binaries is indispensable for malware and firmware analysis, but remains slow due to stripped metadata and adversarial obfuscation. Large Language Models (LLMs) offer potential for improving RE efficiency through automated comprehension and commenting, but cloud-hosted, closed-weight models pose privacy and security risks and cannot be used in closed-network facilities. We evaluate parameter-efficient fine-tuned local LLMs for assisting with x86 RE tasks in these settings. Eight open-weight models across the CodeLlama, Qwen2.5-Coder, and CodeGemma series are fine-tuned on a custom curated dataset of 5,981 x86 assembly examples. We evaluate them quantitatively and identify the fine-tuned Qwen2.5-Coder-7B as the top performer, which we name REx86. REx86 reduces test-set cross-entropy loss by 64.2% and improves semantic cosine similarity against ground truth by 20.3\% over its base model. In a limited user case study (n=43), REx86 significantly enhanced line-level code understanding (p = 0.031) and increased the correct-solve rate from 31% to 53% (p = 0.189), though the latter did not reach statistical significance. Qualitative analysis shows more accurate, concise comments with fewer hallucinations. REx86 delivers state-of-the-art assistance in x86 RE among local, open-weight LLMs. Our findings demonstrate the value of domain-specific fine-tuning, and highlight the need for more commented disassembly data to further enhance LLM performance in RE. REx86, its dataset, and LoRA adapters are publicly available at https://github.com/dlea8/REx86 and https://zenodo.org/records/15420461.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。