Identifying Function Parameters in Binaries


Betreuer: Cornelius Aschermann

Beginn: as soon as possible

Dauer: 3 month

Weitere Details:


Compilers use a vast amount of different calling conventions. Additionally to functions with fixed arity, there are also variadic functions that can take any number of arguments. To make the matter worse, compilers will heavily optimize argument passing if the called function is not exported. However, identifying function arguments and especially their order is relevant for many different analysis tasks.

The thesis' goal is to develop a stable tool that is able to infer which memory locations / registers are used as arguments and in which order, using a combination of more formal techniques such as backward slicing and heuristics such as machine learning to deal with functions where the calling convention have been optimized. This tool will be relevant for different ongoing research projects.

  • Identify different calling conventions and ways they are optimized
  • Build a tool for argument identification
  • Evaluate the precision of the tool on different binaries


  • Experience with binary analysis / reverse engineering
  • Experience with simple Machine Learning