Compiling the World - A Binary Dataset Built from nixpkgs
Where
NixVegas
DEF CON 34
Duration
27 min
Presents a dataset of tens of millions of x86_64 functions, paired with source code, built from tens of thousands of nixpkgs packages.
Summary
The talk starts from a practical problem: reverse engineering binaries is slow, and machine learning for binary analysis needs real-world training data where each compiled function is linked to its source. Existing datasets fall into two camps. Some pair source with binaries but are small, C and C++ only programs. Others are large and realistic but have no source alignment. The speaker, from MIT Lincoln Laboratory, chose nixpkgs for its package coverage, reproducible builds, and instrumentable build environments.
The middle of the talk walks through the pipeline. Packages are enumerated, filtered by the language GitHub reports for their repositories, and rebuilt with a debug overlay that keeps debug information and line tables and turns off link-time optimization. The ELF objects are then disassembled with Binary Ninja, and each function is recorded with its disassembly, control-flow graph, decompiled output, and matching source. A local small language model writes a short summary per function. Running this on a shared HPC cluster brought its own problems: gated internet access, a store path that could not live in the default location, Lustre's weakness with small files, SQLite locking on a distributed filesystem, and job coordination through Slurm and Dask.
The result is roughly 50 million functions. The scope is currently x86_64 Linux at one optimization level, with plans to add other architectures, optimization settings, and older package versions. The code is public, and a dataset release on Hugging Face is planned once licensing is settled. The takeaway for practitioners is that Nix's reproducibility makes large, labeled binary corpora feasible to build.
Materials
Related talks
HackersTown·29 min
Erica Andrews · Abbie Gonzalez
Shows how a Springfield, Massachusetts nonprofit turns discarded laptops into Linux learning machines to counter digital redlining.
Main Stage·28 min
Assaf Morag
Traces how the FirewallFalcon VPN and SSH management toolkit was weaponized to backdoor its own operators and enable man-in-the-middle interception.
AI Village·14 min
Aditi Narasimhan · Farzaan Kaiyom
Shows how a pre-implementation security context step and a small fine-tuned model can make coding agents produce more secure code.


