Search papers, labs, and topics across Lattice.
This paper introduces Symbolicate-Enrich-Sample, a novel pipeline designed to enhance target selection in Windows vulnerability research by efficiently prioritizing functions from a vast corpus of binaries. By recovering function-level symbols and applying deterministic structural features, the method utilizes a low-cost language model to assign risk levels and bug-class hypotheses, ultimately narrowing down the function set to a manageable shortlist of approximately 22,000 candidates. The results demonstrate significant selectivity in labeling, which is crucial for optimizing the vulnerability analysis process in a landscape filled with irrelevant data.
A new pipeline can reduce the overwhelming task of vulnerability research from millions of functions to a targeted shortlist of 22,000 candidates, streamlining the analysis process significantly.
The attack surface of a modern operating system is a haystack: thousands of signed binaries and millions of functions, almost none relevant to any given vulnerability. A human analyst or an LLM agent must pick the function worth reading before analyzing it. At whole-OS scope, this target selection, not the analysis, is the binding constraint. We present Symbolicate-Enrich-Sample, a low-cost batch pipeline that turns a corpus of production Windows binaries into a queryable, priority-ranked research queue. We (i) recover function-level symbols for stripped vendor binaries by auto-fetching the public symbol files and joining them to a recovered call graph; (ii) attach cheap, deterministic structural features to each named function and, conditioned on those features, use a low-cost language model to assign a reachability tier, a risk level, a bug-class hypothesis, and a rationale; and (iii) draw diverse, prioritized batches via a priority-weighted importance sampler. The contribution is a selection substrate: the prioritization layer a downstream detector or LLM agent runs on top of. Across a whole Windows image of 7,231,419 functions, the labels are markedly selective, and stacking deterministic filters on them leaves a ~22K-function shortlist: the candidate needles, few enough for a human or agent to work through. We characterize the pipeline's selectivity and its failure modes, describe the methodology, and report aggregate statistics; we withhold the derived dataset for legal and dual-use reasons.
