Edit Readme for clarity and style
#3
by ranieriargentini - opened
README.md
CHANGED
|
@@ -9,14 +9,14 @@ tags:
|
|
| 9 |
---
|
| 10 |
|
| 11 |
# Model Description
|
| 12 |
-
ASMTransformers is a
|
| 13 |
-
to aid in the process of reverse engineering.
|
| 14 |
|
| 15 |
# Status
|
| 16 |
Not actively maintained after publishing
|
| 17 |
|
| 18 |
# Relevant links
|
| 19 |
-
* [
|
| 20 |
|
| 21 |
# Version
|
| 22 |
2026-08-06
|
|
@@ -30,20 +30,15 @@ nor has it been tested on other downstream tasks.
|
|
| 30 |
|
| 31 |
# Architecture description
|
| 32 |
|
| 33 |
-
|
| 34 |
-
We also experimented with different training parameters during the Masked Language Modelling (MLM). For example, we set the
|
| 35 |
-
--mlm-prob parameter to 0.4 in accordance to [Wettig et al., 2023](https://aclanthology.org/2023.eacl-main.217.pdf). We have done some experiments with different mlm-probs
|
| 36 |
-
(namely 0.15, 0.3 and 0.4) and found that 0.4 yielded the best results.
|
| 37 |
|
| 38 |
-
|
| 39 |
-
MLM procedure, the model also has to predict jump targets: whenever there is a jump in the code, the model shouldn't only predict it to be a
|
| 40 |
-
jump instruction, but it should also predict to which line of code it's supposed to jump. The idea is that this leads to better understanding of the long-term relations
|
| 41 |
-
in the code, and as Wang et al yielded good results, we have adopted it.
|
| 42 |
|
| 43 |
-
|
| 44 |
-
|
| 45 |
-
ensure that the training task is not too easy.
|
| 46 |
|
|
|
|
|
|
|
| 47 |
|
| 48 |
**Estimated training time:**
|
| 49 |
|
|
@@ -70,8 +65,6 @@ finetuning: 4 hours on 1 NVIDIA H200
|
|
| 70 |
]
|
| 71 |
```
|
| 72 |
|
| 73 |
-
**Pretraining parameters used:**
|
| 74 |
-
|
| 75 |
```
|
| 76 |
{
|
| 77 |
"architectures": [
|
|
@@ -99,7 +92,7 @@ finetuning: 4 hours on 1 NVIDIA H200
|
|
| 99 |
}
|
| 100 |
```
|
| 101 |
|
| 102 |
-
**
|
| 103 |
|
| 104 |
```
|
| 105 |
{
|
|
@@ -113,21 +106,20 @@ finetuning: 4 hours on 1 NVIDIA H200
|
|
| 113 |
}
|
| 114 |
```
|
| 115 |
|
| 116 |
-
|
| 117 |
# Output
|
| 118 |
-
The model outputs embeddings of size 768
|
| 119 |
|
| 120 |
# Data
|
| 121 |
-
The dataset is
|
| 122 |
-
|
| 123 |
-
|
| 124 |
-
|
| 125 |
-
This results in a maximum of 24 (6 optimisation * 4 architectures) different functions
|
| 126 |
-
which are semantically similar. (i.e. they represent the same functionality but are written differently)
|
| 127 |
-
In practise, it was much easier to obtain amd64 functions than riscv64 functions. Thus, not all functions have 24 semantically similar functions.
|
| 128 |
|
| 129 |
-
|
| 130 |
-
|
|
|
|
|
|
|
|
|
|
| 131 |
|
| 132 |
**Total amount of functions per architecture**
|
| 133 |
|
|
@@ -170,27 +162,15 @@ either the train or the test set, not both.
|
|
| 170 |
----------------------------
|
| 171 |
|
| 172 |
# Preprocessing
|
| 173 |
-
Several preprocessing steps have been taken
|
| 174 |
-
|
| 175 |
-
|
| 176 |
-
|
| 177 |
-
Some operands have been normalized,
|
| 178 |
-
to reduce token explosion caused by raw numeric values. These numerical values are expressed as powers of two, such that
|
| 179 |
-
4096 would be 2 ** 12, so `#0x2^c`, so would 6000, but 9000 would be `#0x2^d`. As a consequence, small numbers are distinguishable
|
| 180 |
-
in the vocabulary list, but bigger numbers get one batched representation.
|
| 181 |
-
|
| 182 |
-
Finally, jump tokens are normalised to be relative `JUMP_ADDR_*` tokens. (* being the line number of the jump adress in the given
|
| 183 |
-
function, rather than in the full CFG)
|
| 184 |
-
|
| 185 |
-
|
| 186 |
|
| 187 |
# Performance
|
| 188 |
-
|
| 189 |
-
|
| 190 |
-
|
| 191 |
-
|
| 192 |
-
usually ranked first or second. Accuracy@1 shows how many times the positive example ranked first. It is a useful metric,
|
| 193 |
-
but it's also very strict, which is why we used it combined with MRR.
|
| 194 |
|
| 195 |
|model|ARM64 mrr|ARM64 acc|AMD64 mrr|AMD64 acc|RISC-V mrr|RISC-V acc|I386 mrr|I386 acc|crosslingual mrr|crosslingual acc|
|
| 196 |
|-----|---------|---------|---------|---------|----------|----------|--------|--------|----------------|----------------|
|
|
|
|
| 9 |
---
|
| 10 |
|
| 11 |
# Model Description
|
| 12 |
+
The ASMTransformers model is a machine learning model that calculates embeddings of assembly functions to enable comparison and similarity
|
| 13 |
+
operations. Instruction set architectures (ISAs) ARM, AMD64, RISC-V and i386 assembly are supported. The aim is to aid in the process of reverse engineering.
|
| 14 |
|
| 15 |
# Status
|
| 16 |
Not actively maintained after publishing
|
| 17 |
|
| 18 |
# Relevant links
|
| 19 |
+
* [ASMtransformers on GitHub](https://github.com/NetherlandsForensicInstitute/asmtransformers)
|
| 20 |
|
| 21 |
# Version
|
| 22 |
2026-08-06
|
|
|
|
| 30 |
|
| 31 |
# Architecture description
|
| 32 |
|
| 33 |
+
The model is a Bert-base architecture with 12 layers, 12 attention heads and a hidden size of 768. It uses a vocabulary of size 6161 derived from a custom assembler architecture-aware tokenizer.
|
|
|
|
|
|
|
|
|
|
| 34 |
|
| 35 |
+
The model is trained in two phases - a masked language modeling (MLM) pretraining phase and a fine-tuning phase for function similarity.
|
|
|
|
|
|
|
|
|
|
| 36 |
|
| 37 |
+
The MLM pre-training phase uses a loss function that includes jump target prediction (see [Wang et al.](https://arxiv.org/pdf/2205.12713)).
|
| 38 |
+
This pretraining was perfomed using a masking probability of 0.4 that was determined through ablation experiments. This is in line with the findings of [Wettig et al., 2023](https://aclanthology.org/2023.eacl-main.217.pdf).
|
|
|
|
| 39 |
|
| 40 |
+
We perform the finetuning phase using [Batched Semi Hard Triplet Loss](https://sbert.net/docs/package_reference/sentence_transformer/losses.html#batchsemihardtripletloss) on batches of size 1024.
|
| 41 |
+
The training set for this phase includes triplets that are formed using versions of the same function compiled for different instruction set architectures.
|
| 42 |
|
| 43 |
**Estimated training time:**
|
| 44 |
|
|
|
|
| 65 |
]
|
| 66 |
```
|
| 67 |
|
|
|
|
|
|
|
| 68 |
```
|
| 69 |
{
|
| 70 |
"architectures": [
|
|
|
|
| 92 |
}
|
| 93 |
```
|
| 94 |
|
| 95 |
+
**Pre-training parameters used:**
|
| 96 |
|
| 97 |
```
|
| 98 |
{
|
|
|
|
| 106 |
}
|
| 107 |
```
|
| 108 |
|
|
|
|
| 109 |
# Output
|
| 110 |
+
The model outputs embeddings of size 768.
|
| 111 |
|
| 112 |
# Data
|
| 113 |
+
The dataset is derived from the official [Debian Repository](https://wiki.debian.org/DebianRepository). We used the distribution's build and packaging system `apt` to
|
| 114 |
+
cross-compile source packages for multiple ISAs and optimisation levels. We used the standard optimisation levels supported by the distribution's compiler, O0, O1, O2, O3 and Os.
|
| 115 |
+
We also added an optimization level that includes vectorization and cryptographic instructions that we refer to as Optimized-custom, or Oc.
|
| 116 |
+
The binary files from each source package are disassembled using Ghidra and the resulting control-flow graphs (CFGs) are exported.
|
|
|
|
|
|
|
|
|
|
| 117 |
|
| 118 |
+
This results in a maximum of 24 (6 optimisation levels and 4 ISAs) potentially CFGs which are semantically identical, i.e. they represent the same functionality.
|
| 119 |
+
However, because not all source packages can be built for all ISAs and because some optimisation levels result in identical code, the actual number is often lower than that.
|
| 120 |
+
|
| 121 |
+
The dataset is split into a train, test and an evaluation set. This in done on source package basis, so all binaries and functions belonging to one source package are part of
|
| 122 |
+
either the training set or the test set, not both.
|
| 123 |
|
| 124 |
**Total amount of functions per architecture**
|
| 125 |
|
|
|
|
| 162 |
----------------------------
|
| 163 |
|
| 164 |
# Preprocessing
|
| 165 |
+
Several preprocessing steps have been taken. CFGs are processed into a flat token list using ISA aware tokenizers.
|
| 166 |
+
Immediate operands and addresses have been normalized to the nearest power-of-two reduce token explosion caused by raw numeric values.
|
| 167 |
+
Finally, target addresses of jumps, conditional branches or call instructions are normalised to fucntion-relative `JUMP_ADDR_*` tokens.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| 168 |
|
| 169 |
# Performance
|
| 170 |
+
We report two performance metrics: Mean Reciprocal Rank (MRR) and Accuracy@1.
|
| 171 |
+
|
| 172 |
+
These metrics are suitable for evaluating tasks where a single example is retrieved from a large collection.
|
| 173 |
+
Accuracy@1 shows how many times the positive example ranked first. It is a useful metric, but it's also very strict, which is why we used it combined with MRR.
|
|
|
|
|
|
|
| 174 |
|
| 175 |
|model|ARM64 mrr|ARM64 acc|AMD64 mrr|AMD64 acc|RISC-V mrr|RISC-V acc|I386 mrr|I386 acc|crosslingual mrr|crosslingual acc|
|
| 176 |
|-----|---------|---------|---------|---------|----------|----------|--------|--------|----------------|----------------|
|