New framework tackles binary code matching problem caused by compiler optimization

Identifying functionally equivalent sections of compiled code across different binaries is crucial for catching plagiarism, finding vulnerabilities, and analyzing malware—but compiler optimizations create a significant obstacle. A new research paper on arXiv proposes N2NMatcher, a framework designed to handle this challenge more effectively.

The inlining problem#

Binary code similarity analysis traditionally works by breaking down compiled programs using their function call graphs (which map how functions invoke one another) and then comparing the resulting modules. This approach breaks down when compilers apply function inlining—a common optimization that embeds frequently-called functions directly into their callers rather than keeping them as separate routines. Inlining alters both the graph structure and the internal logic of functions, rendering existing matching techniques less reliable.

How N2NMatcher works#

The new framework uses hierarchical graph neural networks to identify stable "anchor" functions—those that tend to remain distinguishable even after inlining occurs. These anchors serve as reliable boundaries for decomposing binaries into modules. The system learns to recognize anchors by analyzing three layers of binary information:

• Opcode sequences (the low-level machine instructions)
• Control flow patterns (how execution branches within functions)
• Call graph context (the broader network of function calls)

Once anchors are identified, N2NMatcher decomposes the binary around them and then compares modules using learned graph embeddings.

Significance#

The work demonstrates improved accuracy on both decomposition quality and module matching compared to prior approaches, potentially enabling more reliable program-level binary similarity searches across diverse compilation scenarios.