{"id":"https://openalex.org/W4384948641","doi":"https://doi.org/10.1109/sp46215.2023.10179314","title":"QueryX: Symbolic Query on Decompiled Code for Finding Bugs in COTS Binaries","display_name":"QueryX: Symbolic Query on Decompiled Code for Finding Bugs in COTS Binaries","publication_year":2023,"publication_date":"2023-05-01","ids":{"openalex":"https://openalex.org/W4384948641","doi":"https://doi.org/10.1109/sp46215.2023.10179314"},"language":"en","primary_location":{"id":"doi:10.1109/sp46215.2023.10179314","is_oa":false,"landing_page_url":"https://doi.org/10.1109/sp46215.2023.10179314","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2023 IEEE Symposium on Security and Privacy (SP)","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5035614471","display_name":"Hyung-Seok Han","orcid":"https://orcid.org/0000-0003-4138-4197"},"institutions":[{"id":"https://openalex.org/I157485424","display_name":"Korea Advanced Institute of Science and Technology","ror":"https://ror.org/05apxxy63","country_code":"KR","type":"education","lineage":["https://openalex.org/I157485424"]},{"id":"https://openalex.org/I4210099236","display_name":"Kootenay Association for Science & Technology","ror":"https://ror.org/011pv9p44","country_code":"CA","type":"nonprofit","lineage":["https://openalex.org/I4210099236"]}],"countries":["CA","KR"],"is_corresponding":false,"raw_author_name":"HyungSeok Han","raw_affiliation_strings":["Theori Inc","KAIST"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Theori Inc","institution_ids":[]},{"raw_affiliation_string":"KAIST","institution_ids":["https://openalex.org/I157485424","https://openalex.org/I4210099236"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5092512410","display_name":"JeongOh Kyea","orcid":null},"institutions":[{"id":"https://openalex.org/I157485424","display_name":"Korea Advanced Institute of Science and Technology","ror":"https://ror.org/05apxxy63","country_code":"KR","type":"education","lineage":["https://openalex.org/I157485424"]},{"id":"https://openalex.org/I4210099236","display_name":"Kootenay Association for Science & Technology","ror":"https://ror.org/011pv9p44","country_code":"CA","type":"nonprofit","lineage":["https://openalex.org/I4210099236"]}],"countries":["CA","KR"],"is_corresponding":false,"raw_author_name":"JeongOh Kyea","raw_affiliation_strings":["KAIST"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"KAIST","institution_ids":["https://openalex.org/I157485424","https://openalex.org/I4210099236"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5073983052","display_name":"Yonghwi Jin","orcid":null},"institutions":[{"id":"https://openalex.org/I157485424","display_name":"Korea Advanced Institute of Science and Technology","ror":"https://ror.org/05apxxy63","country_code":"KR","type":"education","lineage":["https://openalex.org/I157485424"]},{"id":"https://openalex.org/I4210099236","display_name":"Kootenay Association for Science & Technology","ror":"https://ror.org/011pv9p44","country_code":"CA","type":"nonprofit","lineage":["https://openalex.org/I4210099236"]}],"countries":["CA","KR"],"is_corresponding":false,"raw_author_name":"Yonghwi Jin","raw_affiliation_strings":["KAIST"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"KAIST","institution_ids":["https://openalex.org/I157485424","https://openalex.org/I4210099236"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5108443205","display_name":"J.\u2010B. KANG","orcid":null},"institutions":[{"id":"https://openalex.org/I157485424","display_name":"Korea Advanced Institute of Science and Technology","ror":"https://ror.org/05apxxy63","country_code":"KR","type":"education","lineage":["https://openalex.org/I157485424"]},{"id":"https://openalex.org/I4210099236","display_name":"Kootenay Association for Science & Technology","ror":"https://ror.org/011pv9p44","country_code":"CA","type":"nonprofit","lineage":["https://openalex.org/I4210099236"]}],"countries":["CA","KR"],"is_corresponding":false,"raw_author_name":"Jinoh Kang","raw_affiliation_strings":["KAIST"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"KAIST","institution_ids":["https://openalex.org/I157485424","https://openalex.org/I4210099236"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5068102604","display_name":"Brian Pak","orcid":null},"institutions":[{"id":"https://openalex.org/I157485424","display_name":"Korea Advanced Institute of Science and Technology","ror":"https://ror.org/05apxxy63","country_code":"KR","type":"education","lineage":["https://openalex.org/I157485424"]},{"id":"https://openalex.org/I4210099236","display_name":"Kootenay Association for Science & Technology","ror":"https://ror.org/011pv9p44","country_code":"CA","type":"nonprofit","lineage":["https://openalex.org/I4210099236"]}],"countries":["CA","KR"],"is_corresponding":false,"raw_author_name":"Brian Pak","raw_affiliation_strings":["KAIST"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"KAIST","institution_ids":["https://openalex.org/I157485424","https://openalex.org/I4210099236"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5059899443","display_name":"Insu Yun","orcid":"https://orcid.org/0000-0001-8931-2833"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Insu Yun","raw_affiliation_strings":["Theori Inc"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Theori Inc","institution_ids":[]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":1.1785,"has_fulltext":false,"cited_by_count":6,"citation_normalized_percentile":{"value":0.83426029,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":90,"max":98},"biblio":{"volume":null,"issue":null,"first_page":"3279","last_page":"3295"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10743","display_name":"Software Testing and Debugging Techniques","score":0.9998000264167786,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10743","display_name":"Software Testing and Debugging Techniques","score":0.9998000264167786,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10260","display_name":"Software Engineering Research","score":0.9995999932289124,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9994000196456909,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.863113522529602},{"id":"https://openalex.org/keywords/callback","display_name":"Callback","score":0.7224732637405396},{"id":"https://openalex.org/keywords/symbolic-execution","display_name":"Symbolic execution","score":0.6931937336921692},{"id":"https://openalex.org/keywords/programming-language","display_name":"Programming language","score":0.6876353025436401},{"id":"https://openalex.org/keywords/scalability","display_name":"Scalability","score":0.6119240522384644},{"id":"https://openalex.org/keywords/dead-code","display_name":"Dead code","score":0.5535057783126831},{"id":"https://openalex.org/keywords/code","display_name":"Code (set theory)","score":0.5454360842704773},{"id":"https://openalex.org/keywords/program-analysis","display_name":"Program analysis","score":0.4902940094470978},{"id":"https://openalex.org/keywords/control-flow","display_name":"Control flow","score":0.48183050751686096},{"id":"https://openalex.org/keywords/static-program-analysis","display_name":"Static program analysis","score":0.4696091115474701},{"id":"https://openalex.org/keywords/unreachable-code","display_name":"Unreachable code","score":0.4679730534553528},{"id":"https://openalex.org/keywords/symbolic-data-analysis","display_name":"Symbolic data analysis","score":0.4432370364665985},{"id":"https://openalex.org/keywords/static-analysis","display_name":"Static analysis","score":0.4415972828865051},{"id":"https://openalex.org/keywords/binary-code","display_name":"Binary code","score":0.43907830119132996},{"id":"https://openalex.org/keywords/theoretical-computer-science","display_name":"Theoretical computer science","score":0.4374270737171173},{"id":"https://openalex.org/keywords/source-code","display_name":"Source code","score":0.4342450499534607},{"id":"https://openalex.org/keywords/redundant-code","display_name":"Redundant code","score":0.4305807948112488},{"id":"https://openalex.org/keywords/legacy-code","display_name":"Legacy code","score":0.41237184405326843},{"id":"https://openalex.org/keywords/binary-number","display_name":"Binary number","score":0.37091606855392456},{"id":"https://openalex.org/keywords/code-generation","display_name":"Code generation","score":0.28511685132980347},{"id":"https://openalex.org/keywords/database","display_name":"Database","score":0.26273247599601746},{"id":"https://openalex.org/keywords/operating-system","display_name":"Operating system","score":0.17566147446632385},{"id":"https://openalex.org/keywords/software","display_name":"Software","score":0.1629541516304016},{"id":"https://openalex.org/keywords/set","display_name":"Set (abstract data type)","score":0.15509772300720215},{"id":"https://openalex.org/keywords/software-development","display_name":"Software development","score":0.12977781891822815}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.863113522529602},{"id":"https://openalex.org/C204495577","wikidata":"https://www.wikidata.org/wiki/Q1205349","display_name":"Callback","level":2,"score":0.7224732637405396},{"id":"https://openalex.org/C2779639559","wikidata":"https://www.wikidata.org/wiki/Q7661178","display_name":"Symbolic execution","level":3,"score":0.6931937336921692},{"id":"https://openalex.org/C199360897","wikidata":"https://www.wikidata.org/wiki/Q9143","display_name":"Programming language","level":1,"score":0.6876353025436401},{"id":"https://openalex.org/C48044578","wikidata":"https://www.wikidata.org/wiki/Q727490","display_name":"Scalability","level":2,"score":0.6119240522384644},{"id":"https://openalex.org/C47434764","wikidata":"https://www.wikidata.org/wiki/Q1770035","display_name":"Dead code","level":5,"score":0.5535057783126831},{"id":"https://openalex.org/C2776760102","wikidata":"https://www.wikidata.org/wiki/Q5139990","display_name":"Code (set theory)","level":3,"score":0.5454360842704773},{"id":"https://openalex.org/C98183937","wikidata":"https://www.wikidata.org/wiki/Q2112188","display_name":"Program analysis","level":2,"score":0.4902940094470978},{"id":"https://openalex.org/C160191386","wikidata":"https://www.wikidata.org/wiki/Q868299","display_name":"Control flow","level":2,"score":0.48183050751686096},{"id":"https://openalex.org/C137287247","wikidata":"https://www.wikidata.org/wiki/Q1329550","display_name":"Static program analysis","level":4,"score":0.4696091115474701},{"id":"https://openalex.org/C50951305","wikidata":"https://www.wikidata.org/wiki/Q2482534","display_name":"Unreachable code","level":5,"score":0.4679730534553528},{"id":"https://openalex.org/C65620979","wikidata":"https://www.wikidata.org/wiki/Q7661176","display_name":"Symbolic data analysis","level":2,"score":0.4432370364665985},{"id":"https://openalex.org/C97686452","wikidata":"https://www.wikidata.org/wiki/Q7604153","display_name":"Static analysis","level":2,"score":0.4415972828865051},{"id":"https://openalex.org/C63435697","wikidata":"https://www.wikidata.org/wiki/Q864135","display_name":"Binary code","level":3,"score":0.43907830119132996},{"id":"https://openalex.org/C80444323","wikidata":"https://www.wikidata.org/wiki/Q2878974","display_name":"Theoretical computer science","level":1,"score":0.4374270737171173},{"id":"https://openalex.org/C43126263","wikidata":"https://www.wikidata.org/wiki/Q128751","display_name":"Source code","level":2,"score":0.4342450499534607},{"id":"https://openalex.org/C151578736","wikidata":"https://www.wikidata.org/wiki/Q1251793","display_name":"Redundant code","level":4,"score":0.4305807948112488},{"id":"https://openalex.org/C85687889","wikidata":"https://www.wikidata.org/wiki/Q445962","display_name":"Legacy code","level":3,"score":0.41237184405326843},{"id":"https://openalex.org/C48372109","wikidata":"https://www.wikidata.org/wiki/Q3913","display_name":"Binary number","level":2,"score":0.37091606855392456},{"id":"https://openalex.org/C133162039","wikidata":"https://www.wikidata.org/wiki/Q1061077","display_name":"Code generation","level":3,"score":0.28511685132980347},{"id":"https://openalex.org/C77088390","wikidata":"https://www.wikidata.org/wiki/Q8513","display_name":"Database","level":1,"score":0.26273247599601746},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.17566147446632385},{"id":"https://openalex.org/C2777904410","wikidata":"https://www.wikidata.org/wiki/Q7397","display_name":"Software","level":2,"score":0.1629541516304016},{"id":"https://openalex.org/C177264268","wikidata":"https://www.wikidata.org/wiki/Q1514741","display_name":"Set (abstract data type)","level":2,"score":0.15509772300720215},{"id":"https://openalex.org/C529173508","wikidata":"https://www.wikidata.org/wiki/Q638608","display_name":"Software development","level":3,"score":0.12977781891822815},{"id":"https://openalex.org/C33923547","wikidata":"https://www.wikidata.org/wiki/Q395","display_name":"Mathematics","level":0,"score":0.0},{"id":"https://openalex.org/C94375191","wikidata":"https://www.wikidata.org/wiki/Q11205","display_name":"Arithmetic","level":1,"score":0.0},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/sp46215.2023.10179314","is_oa":false,"landing_page_url":"https://doi.org/10.1109/sp46215.2023.10179314","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2023 IEEE Symposium on Security and Privacy (SP)","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":61,"referenced_works":["https://openalex.org/W17195072","https://openalex.org/W1480909796","https://openalex.org/W1563577331","https://openalex.org/W1578723138","https://openalex.org/W1600965014","https://openalex.org/W1966982815","https://openalex.org/W2003299277","https://openalex.org/W2028820179","https://openalex.org/W2047226031","https://openalex.org/W2090554354","https://openalex.org/W2091939272","https://openalex.org/W2096659083","https://openalex.org/W2106972913","https://openalex.org/W2113864883","https://openalex.org/W2119251836","https://openalex.org/W2156858199","https://openalex.org/W2295367909","https://openalex.org/W2320211919","https://openalex.org/W2408027109","https://openalex.org/W2509067210","https://openalex.org/W2514974017","https://openalex.org/W2654868256","https://openalex.org/W2767373589","https://openalex.org/W2773223713","https://openalex.org/W2792181598","https://openalex.org/W2793974819","https://openalex.org/W2794889478","https://openalex.org/W2795052548","https://openalex.org/W2795422216","https://openalex.org/W2883950365","https://openalex.org/W2891748016","https://openalex.org/W2946130184","https://openalex.org/W2955008836","https://openalex.org/W2964232059","https://openalex.org/W3033606455","https://openalex.org/W3048272215","https://openalex.org/W3096174798","https://openalex.org/W4235785239","https://openalex.org/W4239813889","https://openalex.org/W4240738830","https://openalex.org/W4253587022","https://openalex.org/W4253872762","https://openalex.org/W4281387902","https://openalex.org/W4288349907","https://openalex.org/W6606430823","https://openalex.org/W6628365534","https://openalex.org/W6637688222","https://openalex.org/W6639981184","https://openalex.org/W6677742562","https://openalex.org/W6723270624","https://openalex.org/W6743843626","https://openalex.org/W6754022011","https://openalex.org/W6762083219","https://openalex.org/W6765285382","https://openalex.org/W6766922533","https://openalex.org/W6767602453","https://openalex.org/W6781538887","https://openalex.org/W6794321951","https://openalex.org/W6800066360","https://openalex.org/W6903381972","https://openalex.org/W6981267346"],"related_works":["https://openalex.org/W2161969548","https://openalex.org/W2036000779","https://openalex.org/W116913286","https://openalex.org/W4244016640","https://openalex.org/W2112669344","https://openalex.org/W3008325674","https://openalex.org/W1141223778","https://openalex.org/W2103816232","https://openalex.org/W2029981993","https://openalex.org/W4384948641"],"abstract_inverted_index":{"Extensible":[0],"static":[1],"checking":[2],"tools,":[3],"such":[4,100,219],"as":[5,26,87,101],"Sys":[6],"and":[7,43,66,127,142,199,240,262,277],"CodeQL,":[8],"have":[9],"successfully":[10],"discovered":[11],"bugs":[12,183,273],"in":[13,145,184,248],"source":[14],"code.":[15,95,186,212],"These":[16,28],"tools":[17,50],"allow":[18],"analysts":[19,106,154,176,223],"to":[20,25,53,155,181,224,254],"write":[21,156,225],"application-specific":[22],"rules,":[23],"referred":[24],"queries.":[27,250],"queries":[29,138,157,226],"can":[30,177],"leverage":[31],"the":[32,39,46,68,90,149,185,207,210,249,255,258,281],"domain":[33],"knowledge":[34],"of":[35,48,93,160,164,209,228],"analysts,":[36],"thereby":[37],"making":[38],"analysis":[40,98,130,134,180,202],"more":[41],"accurate":[42],"scalable.":[44],"However,":[45,77],"majority":[47],"these":[49],"are":[51,115,246],"inapplicable":[52],"binary-only":[54],"analysis.":[55],"One":[56],"exception,":[57],"joern,":[58],"translates":[59],"a":[60,125,267],"binary":[61,97,140],"code":[62,65,70,75,141,162,193],"into":[63,71,194],"decompiled":[64,69,94,119,161,172,192,211],"feeds":[67],"an":[72,263],"ordinary":[73],"C":[74],"analyzer.":[76],"this":[78,121,144],"approach":[79],"is":[80,215],"not":[81],"sufficiently":[82],"precise":[83,126,188],"for":[84,139],"symbolic":[85,104,129,133,179,201],"analysis,":[86,105,189],"it":[88,221],"overlooks":[89],"unique":[91,272],"characteristics":[92,208],"While":[96],"platforms,":[99],"angr,":[102],"support":[103],"must":[107],"understand":[108],"their":[109],"intermediate":[110],"representations":[111],"(IRs)":[112],"although":[113],"they":[114],"mostly":[116],"working":[117],"with":[118],"code.In":[120],"paper,":[122],"we":[123,190,269],"propose":[124],"scalable":[128],"called":[131],"fearless":[132],"that":[135,220,245],"uses":[136],"intuitive":[137],"implement":[143],"QueryX.":[146],"To":[147],"make":[148],"query":[150],"intuitive,":[151],"QueryX":[152,168,233,253],"enables":[153],"on":[158,171,203],"top":[159],"instead":[163],"IRs.":[165],"In":[166],"particular,":[167],"supports":[169],"callbacks":[170,239,244],"code,":[173],"using":[174,229,238],"which":[175],"control":[178],"discover":[182],"For":[187,231],"lift":[191],"our":[195],"IR":[196],"named":[197],"DNR":[198,204,214],"perform":[200],"while":[205],"considering":[206],"Notably,":[213],"only":[216],"used":[217],"internally":[218],"allows":[222],"regardless":[227],"DNR.":[230],"scalability,":[232],"automatically":[234],"reduces":[235],"control-flow":[236],"graphs":[237],"ordering":[241],"dependencies":[242],"between":[243],"specified":[247],"We":[251],"applied":[252],"Windows":[256,259],"kernel,":[257],"system":[260],"service,":[261],"automotive":[264],"binary.":[265],"As":[266],"result,":[268],"found":[270],"15":[271],"including":[274],"10":[275],"CVEs":[276],"earned":[278],"$180,000":[279],"from":[280],"Microsoft":[282],"bug":[283],"bounty":[284],"program.":[285]},"counts_by_year":[{"year":2026,"cited_by_count":2},{"year":2025,"cited_by_count":3},{"year":2024,"cited_by_count":1}],"updated_date":"2026-07-30T17:31:21.811387","created_date":"2025-10-10T00:00:00"}