From P-Code to GNN Extracting Binary Code Semantics

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: http://blog.quarkslab.com/from-p-code-to-gnn-extract-binary-code-semantics.html
• Blog Title: From P-Code to GNN: Extracting Binary Code Semantics
• Suggested Section: Reversing > Reversing Tools & Basic Methods > Architecture-Neutral Semantic Binary Analysis with Ghidra P-Code and Graph Neural Networks

🎯 Content Summary

Overview

The post introduces pcode_graph, an open-source Python library developed by Quarkslab to abstract binary-code semantics. It lifts a function, basic block, or arbitrary byte sequence into Ghidra P-Code and builds visualizable Control & Data Flow Graphs (CDGs). The resulting representation is intended for obfuscation identification, ROP gadget indexing or automatic chaining, binary diffing, function identification, vulnerability discovery, and ...

🔧 Technical Details

Architecture-neutral semantic extraction: Lift raw machine code through SLEIGH/pypcode into Ghidra P-Code, then perform instruction indexing, unreachable-code detection, and reaching-definition analysis. Replace temporary P-Code variables with dependency edges, remove redundant nodes, and retain meaningful inputs, constants, operations, memory effects, Phi nodes, outputs, and termination nodes. Add control-flow dependencies where data flow alone cannot express the condition selecting a value. This produces a compact representation that is less dependent on instruction mnemonics, compiler output, and optimization level. Useful commands include cdg pcode binary, cdg table binary, cdg html --dataflow-only binary -o graph.html, and cdg md --dataflow-only binary.

Cross-architecture function and vulnerability matching: Convert CDGs into PyTorch Geometric tensors and encode physical reg...

🤖 Agent Actions

Updated src/reversing/reversing-tools-basic-methods/README.md with:

• pcode_graph installation and CLI examples
• P-Code lifting and CDG construction workflow
• Cross-architecture function/vulnerability matching
• GNN tensor export and ABI-aware register encoding
• Semantic ROP gadget modeling
• Analysis limitations and validation caveats
• Numbered references to the upstream repository and Quarkslab research

Validation passed: git diff --check, Markdown fence/reference checks, and source URL reachability. mdbook was unavailable locally.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: http://blog.quarkslab.com/from-p-code-to-gnn-extract-binary-code-semantics.html

Content Categories: Based on the analysis, this content was categorized under "Reversing > Reversing Tools & Basic Methods > Architecture-Neutral Semantic Binary Analysis with Ghidra P-Code and Graph Neural Networks".

Repository Maintenance:

• MD Files Formatting: 1029 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0