It Must Be Nice

The talk comes from a team at Johns Hopkins APL working under a DARPA program on assured micropatching for embedded systems. The speakers argue that embedded firmware has seen few of the security gains found in enterprise software, and that reverse engineers rarely feed their analysis back into development. Their goal is to recover the object-file structure of a fully linked firmware image so it can be decompiled, patched and rebuilt.

The core technique, called Code Cut, finds where object files start and stop inside a linked binary. The earlier signal-processing heuristic was noisy, so the team treats function calls as a graph and trains a graph neural network to predict whether connected functions share a module. Training drew on a large corpus of packaged software with build metadata. A modularity-based partitioning step then turns those predictions into contiguous boundaries. Reported results reach about 97 percent accuracy on call-edge classification and roughly 93 percent on boundary recovery, a sevenfold gain over the old method.

Additional tools let analysts rename, move and merge recovered modules, guess module names from strings, and export module maps. One component unlinks a single library into a relocatable object file, and another emits recompilable C with workarounds for external symbols, decompiler intrinsics and undefined types. Limits remain: stack canary handling is unresolved, and the approach suits ordinary commercial firmware rather than packed or obfuscated malware. The takeaway is that reverse engineers can work at the object-file level, and the tooling is publicly released.