We propose VEXIR2Vec, a code embedding framework for finding similar functions in binaries. Our representations rely on VEX IR, the intermediate representation used by binary analysis tools like Valgrind and angr. Our proposed embeddings encode both syntactic and semantic information to represent a function, and is both application and architecture independent. We also propose POV, a custom Peephole Optimization engine that normalizes the VEX IR for effective similarity analysis. We design several optimizations like copy/constant propagation, constant folding, common subexpression elimination and load-store elimination in POV. We evaluate our framework on two experiments -- diffing and searching -- involving binaries targeting different architectures, compiled using different compilers and versions, optimization sequences, and obfuscations. We show results on several standard projects and on real-world vulnerabilities. Our results show that VEXIR2Vec achieves superior precision and recall values compared to the state-of-the-art works. Our framework is highly scalable and is built as a multi-threaded, parallel library by only using open-source tools. VEXIR2Vec achieves about $3.2 \times$ speedup on the closest competitor, and orders-of-magnitude speedup on other tools.

我们提出了VEXIR2Vec，这是一个代码嵌入框架，用于在二进制文件中查找相似函数。我们的表示依赖于VEX IR，它是二进制分析工具（如Valgrind和angr）使用的中间表示。我们的嵌入方法编码了函数的语法和语义信息，并且在应用程序和架构上都是独立的。我们还提出了POV，一个自定义的Peephole优化引擎，用于对VEX IR进行有效的相似性分析。我们在涉及针对不同架构、使用不同编译器和版本、优化序列和混淆的二进制文件的两个实验中评估了我们的框架。我们展示了在几个标准项目和真实世界漏洞上的结果。我们的结果显示，与现有最先进的工作相比，VEXIR2Vec实现了更高的精确度和召回率。我们的框架具有高度的可扩展性，只使用了开源工具构建为一个多线程、并行库。VEXIR2Vec在最接近的竞争对手上实现了约3.2倍的加速，并在其他工具上实现了数量级的加速。

VEXIR2Vec：一个针对二进制相似性的通用嵌入框架