iResolveX: Multi-Layered Indirect Call Resolution via Static Reasoning and Learning-Augmented Refinement

TL;DR

iResolveX addresses indirect call resolution in CFG recovery for stripped/optimized binaries by introducing a hybrid three-layer framework that combines sound static analysis (Layer1 BPA) with learning-based refinement (Layer2: iScoreGen and iScoreRefine) and a confidence-annotated output (p-IndirectCFG). The approach achieves substantial AICT reductions (up to $44.3\%$ over BPA) with minimal recall loss ($\approx$ $0.4\%$ in recall-preserving modes) and maintains high recall in conservative configurations (up to $98.1\%$). It introduces a separation between generalizable function-signature features and context-rich backward traces, enabling robust generalization from direct to indirect calls without heavy dynamic supervision. The policy-controllable p-IndirectCFG supports downstream analyses with recall- or precision-focused objectives, improving practical CFG quality for security analysis, symbolic execution, and vulnerability triage in real-world binaries.

Abstract

Indirect call resolution remains a key challenge in reverse engineering and control-flow graph recovery, especially for stripped or optimized binaries. Static analysis is sound but often over-approximates, producing many false positives, whereas machine-learning approaches can improve precision but may sacrifice completeness and generalization. We present iResolveX, a hybrid multi-layered framework that combines conservative static analysis with learning-based refinement. The first layer applies a conservative value-set analysis (BPA) to ensure high recall. The second layer adds a learning-based soft-signature scorer (iScoreGen) and selective inter-procedural backward analysis with memory inspection (iScoreRefine) to reduce false positives. The final output, p-IndirectCFG, annotates indirect edges with confidence scores, enabling downstream analyses to choose appropriate precision--recall trade-offs. Across SPEC CPU2006 and real-world binaries, iScoreGen reduces predicted targets by 19.2% on average while maintaining BPA-level recall (98.2%). Combined with iScoreRefine, the total reduction reaches 44.3% over BPA with 97.8% recall (a 0.4% drop). iResolveX supports both conservative, recall-preserving and F1-optimized configurations and outperforms state-of-the-art systems.

Figures (6)

• Figure 1: System Overview of the iResolveX
• Figure 2: Example of L2b analysis using backward traversal, cross-reference resolution, and global memory sweep.
• Figure 3: Effect of L2b Pruning Strength on AICT: Aggressive vs. Conservative Across Recall Levels.
• Figure 4: Ablation study with average AICT and AICT_recall annotated on each bar.
• Figure 5: Threshold sensitivity analysis showing variation of Recall, F1, and AICT with threshold. Left axis: AICT_Recall or AICT_F1; right axis: AICT.