From TinyGo to gc Compiler: Extending Zorya's Concolic Framework to Real-World Go Binaries

• URL: http://arxiv.org/abs/2605.03492v1
• Date: Tue, 05 May 2026 08:31:22 GMT
• Title: From TinyGo to gc Compiler: Extending Zorya's Concolic Framework to Real-World Go Binaries
• Abstract summary: Zorya is a framework that lifts compiled binaries to Ghidra's P-Code intermediate representation.<n>We extend Zorya to multi-threaded binaries produced by Go's standard gc compiler.
• Score: 0.9969996646145329
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Zorya is a concolic execution framework that lifts compiled binaries to Ghidra's P-Code intermediate representation and uses the Z3 SMT solver to detect vulnerabilities by reasoning over both concrete and symbolic values. Previous versions supported only single-threaded TinyGo binaries. In this paper, we extend Zorya to multi-threaded binaries produced by Go's standard gc compiler. This is achieved by restoring OS thread states from gdb dumps, neutralizing runtime preemption, and introducing overlay path analysis with copy-on-write semantics to detect silent vulnerabilities on untaken branches. We rigorously assess Zorya on 11 real-world vulnerabilities from production Go projects such as Kubernetes, Go-Ethereum, and CoreDNS. Our evaluation shows that Zorya detects seven bugs at the binary level, including a silent integer overflow detects no other evaluated tool finds without a manually written oracle.

Related papers

• SCDBench: A Benchmark for LLM-Based Smart Contract Decompilers [55.39407031861402]
  We introduce SCDBench, a dataset and benchmark methodology for smart contract decompilation.<n>The dataset contains 600 real-world Solidity contracts with paired bytecode inputs, ground-truth source code, and replayable semantic checkpoints.<n>We evaluate Claude Opus 4.7, GPT-5.3-Codex, and GLM-5 in a zero-shot decompilation setting, including GLM-5 variants with and without extended reasoning.
  arXiv  Detail & Related papers  (2026-05-27T20:08:47Z)
• ASSEMBLAGE-DEEPHISTORY: A Cross-Build Binary Dataset with Temporal Coverage [35.66555702085075]
  We present ASSEMBLAGE-DEEPHISTORY, which consolidates cross-build diversity, cross-version history, and CVE labels into a queryable structure.<n>ASSEMBLAGE-DEEPHISTORY comprises 73,610 binaries spanning 248 open-source projects, compiled across GCC, Clang, and MSVC.<n>Each binary is indexed in a database that links it to its source code, functions, debug info, variant builds, historical versions, and vulnerable functions.
  arXiv  Detail & Related papers  (2026-05-20T18:23:17Z)
• Memory Forensics Techniques for Automated Detection and Analysis of Go Malware [0.73493417424903]
  We present the first memory forensics framework for runtime analysis of Go binaries.<n>Our framework reconstructs type and function metadata, recovers heap-allocated and static strings, and distinguishes application-level functions.
  arXiv  Detail & Related papers  (2026-05-13T18:34:00Z)
• Decaf: Improving Neural Decompilation with Automatic Feedback and Search [64.02615739798277]
  High-level syntax, identifiers, and custom data types are generally lost as the compiler translates human-readable code to low-level machine code.<n>Generative AI models are a natural fit for reconstructing high-level syntax, identifiers, and types.<n>We argue that compiler feedback can be used to dramatically improve the semantic correctness of neural decompiler outputs via search.
  arXiv  Detail & Related papers  (2026-05-12T04:21:26Z)
• SCRIBE: Practical Static Binary Patching via Binary-Aware Recompilation of Decompiled Code [9.623962750101006]
  We present SCRIBE, a patching framework that handles syntactic and semantic issues in decompiled code.<n> SCRIBE's novel "binary-aware" recompilation approach repairs semantic inaccuracies in decompiler output.<n>We show that, using SCRIBE, it is possible to patch 13 of 14 real-world CVEs without access to the original source code.
  arXiv  Detail & Related papers  (2026-05-04T00:59:29Z)
• Constraint-Guided Multi-Agent Decompilation for Executable Binary Recovery [47.704311990064554]
  Decompilation is essential for security analysis, malware reverse engineering, and legacy software maintenance.<n>We present a multi-agent framework that transforms decompiled code into re-executable source through Multi-level Constraint-Guided Decompilation (MCGD)<n>Our framework achieves 84-97% re-executability, improving baseline decompiler output by 28-89 percentage points.
  arXiv  Detail & Related papers  (2026-04-27T01:28:11Z)
• Superset Decompilation [7.989066784325648]
  decompilation is the reverse of compilation and can be structured as a sequence of modular passes.<n>We formalize this as provenance-guided superset decompilation (PGSD), a framework that monotonically derives facts about the binary into a relation store.<n>Mandel implements PGSD as a declarative reverse engineering framework that lifts Linux ELF binaries to C99 through a granular intermediate representation in 35K lines of Rust and Datalog.
  arXiv  Detail & Related papers  (2026-03-30T03:47:19Z)
• Zorya: Automated Concolic Execution of Single-Threaded Go Binaries [1.0696270564342327]
  We build upon Zorya, a concolic execution framework that translates Go binaries to Ghidra's P-Code intermediate representation.<n>We add the detection of bugs in concretely not taken paths and a multi-layer filtering mechanism to concentrate symbolic reasoning on panic-relevant paths.
  arXiv  Detail & Related papers  (2025-12-11T16:43:51Z)
• The Trojan Example: Jailbreaking LLMs through Template Filling and Unsafety Reasoning [47.85771791033142]
  TrojFill is a black-box jailbreak that reframes unsafe instruction as a template-filling task.<n>We evaluate TrojFill on standard jailbreak benchmarks across leading Large Language Models.<n> generated prompts exhibit improved interpretability and transferability compared with prior black-box optimization approaches.
  arXiv  Detail & Related papers  (2025-10-24T06:43:10Z)
• Decompiling Smart Contracts with a Large Language Model [51.49197239479266]
  Despite Etherscan's 78,047,845 smart contracts deployed on (as of May 26, 2025), a mere 767,520 ( 1%) are open source.<n>This opacity necessitates the automated semantic analysis of on-chain smart contract bytecode.<n>We introduce a pioneering decompilation pipeline that transforms bytecode into human-readable and semantically faithful Solidity code.
  arXiv  Detail & Related papers  (2025-06-24T13:42:59Z)
• Exposing Go's Hidden Bugs: A Novel Concolic Framework [2.676686591720132]
  We present Zorya, a novel methodology to evaluate Go programs comprehensively.<n>By systematically exploring execution paths to uncover vulnerabilities beyond conventional testing, symbolic execution offers distinct advantages.<n>Our solution employs Ghidra's P-Code as an intermediate representation (IR)
  arXiv  Detail & Related papers  (2025-05-26T16:26:20Z)
• ReF Decompile: Relabeling and Function Call Enhanced Decompile [50.86228893636785]
  The goal of decompilation is to convert compiled low-level code (e.g., assembly code) back into high-level programming languages.<n>This task supports various reverse engineering applications, such as vulnerability identification, malware analysis, and legacy software migration.
  arXiv  Detail & Related papers  (2025-02-17T12:38:57Z)
• JailbreakBench: An Open Robustness Benchmark for Jailbreaking Large Language Models [123.66104233291065]
  Jailbreak attacks cause large language models (LLMs) to generate harmful, unethical, or otherwise objectionable content. evaluating these attacks presents a number of challenges, which the current collection of benchmarks and evaluation techniques do not adequately address. JailbreakBench is an open-sourced benchmark with the following components.
  arXiv  Detail & Related papers  (2024-03-28T02:44:02Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.