Academic Journal
Towards stack buffer overflow detection in stripped binaries with context-augmented LLMs.
| Τίτλος: | Towards stack buffer overflow detection in stripped binaries with context-augmented LLMs. |
|---|---|
| Συγγραφείς: | Smith, Colin, Keough, Nathan, Carter, Jason |
| Πηγή: | Journal of Computer Virology & Hacking Techniques; 8/24/2026, Vol. 22 Issue 1, p1-14, 14p |
| Θεματικοί όροι: | Language models, Reverse engineering, Computer software, Decompilers (Computer programs), Signal processing |
| Περίληψη: | The detection of vulnerabilities in stripped binaries remains a challenge in software security because stripping removes many of the contextual signals that both humans and automated systems use to identify and validate unsafe behavior. Detecting stack buffer overflows is particularly challenging: symbols are gone, types are absent, stack objects are poorly represented, and the decompiler output that replaces them is often noisy, incomplete, or incorrect. Prior work has applied LLMs to vulnerability analysis in binaries, but typically over decompiler output alone or with limited additional context. In this work, we take the position that the central problem is not whether an LLM can read decompiled code, but whether it can be given enough recovered program context to reason effectively about a stripped binary. We therefore introduce a static, decompiler-driven pipeline built on top of Ghidra that augments decompiled functions with binary-derived evidence including recovered stack regions, callgraph context, and p-code-derived features. This pipeline applies LLM agents in three progressively narrower stages of analysis designed to separate broad screening from expensive confirmation. We evaluate this pipeline using gpt-oss-120b [1] on a synthetic dataset compiled from a subset of NIST's Juliet [2] dataset and stress-test the pipeline using both gpt-oss-120b and gpt-5.4 on paired vulnerable and patched real-world binaries: 12 CVE pairs published after the model's training cutoff and 10 pre-cutoff pairs. The Juliet results show that context-augmented, staged LLM analysis can identify stack buffer overflow behavior in stripped binaries under controlled conditions. On real-world binaries, candidate generation usually surfaces the known-vulnerable target but at a high discovery burden, and final targeted reachability remains low; we therefore present the real-world evaluation as a diagnostic stress test rather than evidence of a deployable detector. [ABSTRACT FROM AUTHOR] |
| Copyright of Journal of Computer Virology & Hacking Techniques is the property of Springer Nature and its content may not be copied or emailed to multiple sites without the copyright holder's express written permission. Additionally, content may not be used with any artificial intelligence tools or machine learning technologies. However, users may print, download, or email articles for individual use. This abstract may be abridged. No warranty is given about the accuracy of the copy. Users should refer to the original published version of the material for the full abstract. (Copyright applies to all Abstracts.) | |
| Βάση Δεδομένων: | Complementary Index |
| FullText | Text: Availability: 0 |
|---|---|
| Header | DbId: edb DbLabel: Complementary Index An: 196414832 RelevancyScore: 1082 AccessLevel: 6 PubType: Academic Journal PubTypeId: academicJournal PreciseRelevancyScore: 1082.42517089844 |
| IllustrationInfo | |
| Items | – Name: Title Label: Title Group: Ti Data: Towards stack buffer overflow detection in stripped binaries with context-augmented LLMs. – Name: Author Label: Authors Group: Au Data: <searchLink fieldCode="AR" term="%22Smith%2C+Colin%22">Smith, Colin</searchLink><br /><searchLink fieldCode="AR" term="%22Keough%2C+Nathan%22">Keough, Nathan</searchLink><br /><searchLink fieldCode="AR" term="%22Carter%2C+Jason%22">Carter, Jason</searchLink> – Name: TitleSource Label: Source Group: Src Data: Journal of Computer Virology & Hacking Techniques; 8/24/2026, Vol. 22 Issue 1, p1-14, 14p – Name: Subject Label: Subject Terms Group: Su Data: <searchLink fieldCode="DE" term="%22Language+models%22">Language models</searchLink><br /><searchLink fieldCode="DE" term="%22Reverse+engineering%22">Reverse engineering</searchLink><br /><searchLink fieldCode="DE" term="%22Computer+software%22">Computer software</searchLink><br /><searchLink fieldCode="DE" term="%22Decompilers+%28Computer+programs%29%22">Decompilers (Computer programs)</searchLink><br /><searchLink fieldCode="DE" term="%22Signal+processing%22">Signal processing</searchLink> – Name: Abstract Label: Abstract Group: Ab Data: The detection of vulnerabilities in stripped binaries remains a challenge in software security because stripping removes many of the contextual signals that both humans and automated systems use to identify and validate unsafe behavior. Detecting stack buffer overflows is particularly challenging: symbols are gone, types are absent, stack objects are poorly represented, and the decompiler output that replaces them is often noisy, incomplete, or incorrect. Prior work has applied LLMs to vulnerability analysis in binaries, but typically over decompiler output alone or with limited additional context. In this work, we take the position that the central problem is not whether an LLM can read decompiled code, but whether it can be given enough recovered program context to reason effectively about a stripped binary. We therefore introduce a static, decompiler-driven pipeline built on top of Ghidra that augments decompiled functions with binary-derived evidence including recovered stack regions, callgraph context, and p-code-derived features. This pipeline applies LLM agents in three progressively narrower stages of analysis designed to separate broad screening from expensive confirmation. We evaluate this pipeline using gpt-oss-120b [1] on a synthetic dataset compiled from a subset of NIST's Juliet [2] dataset and stress-test the pipeline using both gpt-oss-120b and gpt-5.4 on paired vulnerable and patched real-world binaries: 12 CVE pairs published after the model's training cutoff and 10 pre-cutoff pairs. The Juliet results show that context-augmented, staged LLM analysis can identify stack buffer overflow behavior in stripped binaries under controlled conditions. On real-world binaries, candidate generation usually surfaces the known-vulnerable target but at a high discovery burden, and final targeted reachability remains low; we therefore present the real-world evaluation as a diagnostic stress test rather than evidence of a deployable detector. [ABSTRACT FROM AUTHOR] – Name: Abstract Label: Group: Ab Data: <i>Copyright of Journal of Computer Virology & Hacking Techniques is the property of Springer Nature and its content may not be copied or emailed to multiple sites without the copyright holder's express written permission. Additionally, content may not be used with any artificial intelligence tools or machine learning technologies. However, users may print, download, or email articles for individual use. This abstract may be abridged. No warranty is given about the accuracy of the copy. Users should refer to the original published version of the material for the full abstract.</i> (Copyright applies to all Abstracts.) |
| PLink | https://search.ebscohost.com/login.aspx?direct=true&site=eds-live&db=edb&AN=196414832 |
| RecordInfo | BibRecord: BibEntity: Identifiers: – Type: doi Value: 10.1007/s11416-026-00641-0 Languages: – Code: eng Text: English PhysicalDescription: Pagination: PageCount: 14 StartPage: 1 Subjects: – SubjectFull: Language models Type: general – SubjectFull: Reverse engineering Type: general – SubjectFull: Computer software Type: general – SubjectFull: Decompilers (Computer programs) Type: general – SubjectFull: Signal processing Type: general Titles: – TitleFull: Towards stack buffer overflow detection in stripped binaries with context-augmented LLMs. Type: main BibRelationships: HasContributorRelationships: – PersonEntity: Name: NameFull: Smith, Colin – PersonEntity: Name: NameFull: Keough, Nathan – PersonEntity: Name: NameFull: Carter, Jason IsPartOfRelationships: – BibEntity: Dates: – D: 24 M: 08 Text: 8/24/2026 Type: published Y: 2026 Identifiers: – Type: issn-print Value: 22638733 Numbering: – Type: volume Value: 22 – Type: issue Value: 1 Titles: – TitleFull: Journal of Computer Virology & Hacking Techniques Type: main |
| ResultId | 1 |