Disassemble Byte Sequence Using Graph Attention Network

Disassembly is the basis of static analysis binary code and used in malicious detection, vulnerability mining, software optimization, etc. arbitrary suspicious blocks (e.g., for traffic packets intercepted by network) a difficult task. Traditional disassembly methods require manual specification starting address cannot automate blocks. In this paper, we propose method based on extension selection network combining traditional linear sweep recursive traversal methods. First, each byte block as start address, all results (control flow graphs) are combined into single graph. Then graph attention trained to pick correct subgraph graph) final result. experiment, compiler-generated executable file, well file generated hand-written assembly code, data sequence segment were tested, accuracy was 93%, which can effectively distinguish from data.