Abstract:

In the field of software security analysis, binary program analysis technology faces the dual challenges of complex compiler optimization and a lack of structural information. Traditional toolchains commonly suffer from fragmented analysis processes, reliance on manual operations, and insufficient semantic expression, making them unable to meet the demands of structured, automated vulnerability discovery. This paper proposed an intelligent binary analysis method based on an enhanced Semantic Program Dependence Graph (SPDG). By uniformly modeling control flow (CFG), data dependency (DDG), and symbolic path constraint information, SPDG achieves a three-dimensional structured representation of program semantics. In experimental evaluations, SPDG demonstrates significant performance advantages. At the unoptimized level of the OpenSSL project, SPDG recoveres 60.5% more basic blocks and 42.5% more control edges than Ghidra. SPDG also improves data dependency tracing by 287.1% over Ghidra, recovering over 130,000 data dependency chains. Furthermore, SPDG achieves 64.7% symbolic execution coverage at the unoptimized level of OpenSSL, surpassing Angr’s 60%. In the vulnerability detection task, SPDG successfully identifies nine vulnerability examples with only one false positive, achieving an accuracy rate of 90.0%, which is significantly higher than other tools.

Key words: binary analysis, control flow, data flow, symbolic execution, program dependency graph