Revisiting Control Flow Recovery from Binaries: An Abstract Interpretation-based Approach

Static program analysis requires control flow graphs to be reconstructed from binary code. However, instruction recovery is challenging due to statically unknown targets of indirect branches, leading to incomplete or impractically over-approximated control flow graphs. This paper presents a context-sensitive approach to interproce-dural control flow graph recovery from binary code that employs abstract interpretation to handle indirect jumps. The algorithm can be applied to arbitrary binary code. We introduce such a concept of function that allows us to identify subroutines with irregular call and return patterns. Experiments indicate that the proposed technique produces more precise control flow graphs compared to state-of-the-art tools like IDA Pro and Cutter.