StellaOps.BinaryIndex.Semantic

Generates call-ngram fingerprints from lifted IR for cross-compiler resilient matching. Call-ngrams capture function call sequences which are more stable across different compilers and optimization levels than raw instruction sequences.

Creates a new call-ngram generator.

Interface for call-ngram generation.

Generates a call-ngram fingerprint for a lifted function.

Computes similarity between two fingerprints.

Call-ngram generator options.

Configuration section name.

N-gram sizes to generate (default: 2, 3, 4).

Whether to include the full call sequence in output.

Minimum call count to generate fingerprint.

Call-ngram fingerprint result.

Empty fingerprint for functions with no calls.

SHA-256 hash of all n-grams.

Total call count in function.

Number of unique call targets.

N-gram count per size.

Original call sequence (if included).

Extended symbol signature with call-ngram and bom-ref.

Function identifier (module:bom-ref:offset:canonical-IR-hash).

Human-readable function name.

Demangled name.

Module name.

SBOM bom-ref linking to component.

Function offset within module.

Canonical IR hash (Weisfeiler-Lehman).

Call-ngram fingerprint hash.

Target architecture.

IR lifter used.

IR version for cache invalidation.

Generates the func_id in advisory format.

Service for lifting disassembled instructions to intermediate representation.

Lift a disassembled function to B2R2 LowUIR intermediate representation.

Disassembled instructions. Name of the function. Start address of the function. CPU architecture. Lifting options. Cancellation token. The lifted function with IR statements and CFG.

Transform a lifted function to SSA form for dataflow analysis.

The lifted function. Cancellation token. The function in SSA form with def-use chains.

Checks if the service supports the given architecture.

CPU architecture to check. True if the architecture is supported.

Canonicalizes semantic graphs for deterministic comparison.

Canonicalize a semantic graph by assigning deterministic node IDs.

The graph to canonicalize. Canonicalized graph with node mapping.

Compute a canonical string representation of a graph for hashing.

The graph to serialize. Canonical string representation.

Weisfeiler-Lehman graph hashing for deterministic semantic fingerprints. Uses iterative label refinement to capture graph structure.

Creates a new Weisfeiler-Lehman hasher.

Number of WL iterations (default: 3).

Compute a deterministic hash of the semantic graph.

The semantic graph to hash. SHA-256 hash of the graph.

Compute canonical labels for all nodes (useful for graph comparison).

The semantic graph. Array of canonical labels indexed by node ID.

Default implementation of IR lifting service. Note: This implementation provides a basic IR model transformation. For full B2R2 LowUIR lifting, use the B2R2-specific adapter.

Creates a new IR lifting service.

Logger instance.

Service for generating semantic fingerprints from key-semantics graphs.

Generate a semantic fingerprint from a key-semantics graph.

The key-semantics graph. Function start address. Fingerprint generation options. Cancellation token. The generated semantic fingerprint.

Generate a semantic fingerprint from a lifted function (convenience method).

The lifted function. Graph extractor to use. Fingerprint generation options. Cancellation token. The generated semantic fingerprint.

Gets the algorithm used by this generator.

Service for extracting key-semantics graphs from lifted IR.

Extract a key-semantics graph from a lifted function. Captures: data dependencies, control dependencies, memory operations.

The lifted function. Graph extraction options. Cancellation token. The extracted key-semantics graph.

Extract a key-semantics graph from an SSA function. More precise due to explicit def-use information.

The SSA function. Graph extraction options. Cancellation token. The extracted key-semantics graph.

Canonicalize a graph for deterministic comparison.

The graph to canonicalize. Cancellation token. The canonicalized graph with node mappings.

Service for computing semantic similarity between functions.

Compute semantic similarity between two fingerprints.

First fingerprint. Second fingerprint. Matching options. Cancellation token. The match result with similarity scores.

Find the best matches for a fingerprint in a corpus.

The query fingerprint. The corpus of fingerprints to search. Minimum similarity threshold. Maximum number of results to return. Cancellation token. Best matching fingerprints ordered by similarity.

Compute similarity between two semantic graphs directly.

First graph. Second graph. Cancellation token. Graph similarity score (0.0 to 1.0).

Pooled B2R2 lifter for resource management. Bounds concurrent lifter instances to prevent memory exhaustion.

Acquires a pooled lifter instance.

Cancellation token. Pooled lifter lease.

Gets pool statistics.

Default B2R2 lifter pool implementation.

Creates a new B2R2 lifter pool.

Returns a lifter to the pool.

Pooled B2R2 lifter instance.

Unique ID for tracking.

When this lifter was created.

Number of times this lifter has been used.

Lifts a binary to IR.

Resets lifter state for reuse.

RAII lease for pooled lifter.

Gets the lifter.

B2R2 pool configuration.

Minimum pool size.

Maximum pool size.

Timeout for acquiring a lifter.

Maximum uses before recycling a lifter.

B2R2 pool statistics.

Total lifters created.

Total acquisitions.

Total returns.

Currently available.

Max pool size.

Lifted function result.

Function name.

Target architecture.

Base address.

IR statements.

Basic blocks.

IR statement placeholder.

Basic block placeholder.

Block address.

Statements in block.

Target architecture.

x86-64.

ARM64/AArch64.

MIPS32.

MIPS64.

RISC-V 64.

A semantic fingerprint for a function, used for similarity matching.

Name of the source function. Start address of the function. SHA-256 hash of the canonical semantic graph. Hash of the operation sequence. Hash of data dependency patterns. Number of nodes in the semantic graph. Number of edges in the semantic graph. McCabe cyclomatic complexity. External API/function calls (semantic anchors). Algorithm used to generate this fingerprint. Additional algorithm-specific metadata.

A semantic fingerprint for a function, used for similarity matching.

Name of the source function.

Start address of the function.

SHA-256 hash of the canonical semantic graph.

Hash of the operation sequence.

Hash of data dependency patterns.

Number of nodes in the semantic graph.

Number of edges in the semantic graph.

McCabe cyclomatic complexity.

External API/function calls (semantic anchors).

Algorithm used to generate this fingerprint.

Additional algorithm-specific metadata.

Gets the graph hash as a hexadecimal string.

Gets the operation hash as a hexadecimal string.

Gets the data flow hash as a hexadecimal string.

Checks if this fingerprint equals another (by hash comparison).

Algorithm used for semantic fingerprint generation.

Unknown algorithm.

Key-Semantics Graph v1 with Weisfeiler-Lehman hashing.

Pure Weisfeiler-Lehman graph hashing.

Graphlet counting-based similarity.

Random walk-based fingerprint.

SimHash for approximate similarity.

Options for semantic fingerprint generation.

Default fingerprint generation options.

Algorithm to use for fingerprint generation.

Number of Weisfeiler-Lehman iterations.

Whether to include API call hashes in the fingerprint.

Whether to compute separate data flow hash.

Hash algorithm (SHA256, SHA384, SHA512).

Result of semantic similarity matching between two functions.

Name of the first function. Name of the second function. Overall similarity score (0.0 to 1.0). Graph structure similarity. Data flow pattern similarity. API call pattern similarity. Confidence level of the match. Detected differences between functions. Additional match details.

Result of semantic similarity matching between two functions.

Name of the first function.

Name of the second function.

Overall similarity score (0.0 to 1.0).

Graph structure similarity.

Data flow pattern similarity.

API call pattern similarity.

Confidence level of the match.

Detected differences between functions.

Additional match details.

Confidence level for a semantic match.

Very high confidence: highly likely the same function.

High confidence: likely the same function with minor changes.

Medium confidence: possibly related functions.

Low confidence: weak similarity detected.

Very low confidence: minimal similarity.

A detected difference between matched functions.

Type of the delta. Human-readable description. Impact on similarity score (0.0 to 1.0). Location in function A (if applicable). Location in function B (if applicable).

A detected difference between matched functions.

Type of the delta. Human-readable description. Impact on similarity score (0.0 to 1.0). Location in function A (if applicable). Location in function B (if applicable).

Type of the delta.

Human-readable description.

Impact on similarity score (0.0 to 1.0).

Location in function A (if applicable).

Location in function B (if applicable).

Type of difference between matched functions.

Unknown delta type.

Node added in target function.

Node removed from source function.

Node modified between functions.

Edge added in target function.

Edge removed from source function.

Operation changed (same structure, different operation).

API call added.

API call removed.

Control flow structure changed.

Data flow pattern changed.

Constant value changed.

Options for semantic matching.

Default matching options.

Minimum similarity threshold to consider a match.

Weight for graph structure similarity.

Weight for data flow similarity.

Weight for API call similarity.

Whether to compute detailed deltas (slower but more informative).

Maximum number of deltas to report.

Options for lifting instructions to IR.

Default lifting options.

Whether to recover control flow graph.

Whether to transform to SSA form.

Whether to simplify IR (constant folding, dead code elimination).

Maximum instructions to lift (0 = unlimited).

A corpus match result when searching against a function corpus.

The query function name. The matched function from corpus. Library containing the matched function. Library version. Similarity score. Match confidence. Rank in result set.

A corpus match result when searching against a function corpus.

The query function name. The matched function from corpus. Library containing the matched function. Library version. Similarity score. Match confidence. Rank in result set.

The query function name.

The matched function from corpus.

Library containing the matched function.

Library version.

Similarity score.

Match confidence.

Rank in result set.

A key-semantics graph capturing the semantic structure of a function. Abstracts away syntactic details to represent computation, data flow, and control flow.

Name of the source function. Semantic nodes in the graph. Semantic edges connecting nodes. Computed graph properties.

A key-semantics graph capturing the semantic structure of a function. Abstracts away syntactic details to represent computation, data flow, and control flow.

Name of the source function. Semantic nodes in the graph. Semantic edges connecting nodes. Computed graph properties.

Name of the source function.

Semantic nodes in the graph.

Semantic edges connecting nodes.

Computed graph properties.

A node in the key-semantics graph representing a semantic operation.

Unique node ID within the graph. Node type classification. Operation name (e.g., add, mul, cmp, call). Operand descriptors (normalized). Additional attributes for matching.

A node in the key-semantics graph representing a semantic operation.

Unique node ID within the graph. Node type classification. Operation name (e.g., add, mul, cmp, call). Operand descriptors (normalized). Additional attributes for matching.

Unique node ID within the graph.

Node type classification.

Operation name (e.g., add, mul, cmp, call).

Operand descriptors (normalized).

Additional attributes for matching.

Type of semantic node.

Unknown node type.

Computation: arithmetic, logic, comparison operations.

Memory load operation.

Memory store operation.

Conditional branch.

Function/procedure call.

Function return.

PHI node (SSA merge point).

Constant value.

Input parameter.

Address computation.

Type cast/conversion.

String reference.

External symbol reference.

An edge in the key-semantics graph.

Source node ID. Target node ID. Edge type. Optional edge label for additional context.

An edge in the key-semantics graph.

Source node ID. Target node ID. Edge type. Optional edge label for additional context.

Source node ID.

Target node ID.

Edge type.

Optional edge label for additional context.

Type of semantic edge.

Unknown edge type.

Data dependency: source produces value consumed by target.

Control dependency: target execution depends on source branch.

Memory dependency: target depends on memory state from source.

Call edge: source calls target function.

Return edge: source returns to target.

Address-of: source computes address used by target.

Phi input: source is an input to a PHI node.

Computed properties of a semantic graph.

Total number of nodes. Total number of edges. McCabe cyclomatic complexity. Maximum path depth. Count of each node type. Count of each edge type. Number of detected loops. Number of branch points.

Computed properties of a semantic graph.

Total number of nodes. Total number of edges. McCabe cyclomatic complexity. Maximum path depth. Count of each node type. Count of each edge type. Number of detected loops. Number of branch points.

Total number of nodes.

Total number of edges.

McCabe cyclomatic complexity.

Maximum path depth.

Count of each node type.

Count of each edge type.

Number of detected loops.

Number of branch points.

Options for semantic graph extraction.

Default extraction options.

Whether to include constant nodes.

Whether to include NOP operations.

Whether to extract control dependencies.

Whether to extract memory dependencies.

Maximum nodes before truncation (0 = unlimited).

Whether to normalize operation names to a canonical form.

Whether to merge equivalent constant nodes.

Result of graph canonicalization.

The canonicalized graph. Mapping from original node IDs to canonical IDs. Canonical labels for each node.

Result of graph canonicalization.

The canonicalized graph. Mapping from original node IDs to canonical IDs. Canonical labels for each node.

The canonicalized graph.

Mapping from original node IDs to canonical IDs.

Canonical labels for each node.

A subgraph pattern for matching.

Unique pattern identifier. Pattern name (e.g., "loop_counter", "memcpy_pattern"). Pattern nodes. Pattern edges.

A subgraph pattern for matching.

Unique pattern identifier. Pattern name (e.g., "loop_counter", "memcpy_pattern"). Pattern nodes. Pattern edges.

Unique pattern identifier.

Pattern name (e.g., "loop_counter", "memcpy_pattern").

Pattern nodes.

Pattern edges.

A node in a graph pattern (with wildcards).

Node ID within pattern. Required node type (null = any). Operation pattern (null = any, supports wildcards). Whether this node should be captured in match results. Name for captured node.

A node in a graph pattern (with wildcards).

Node ID within pattern. Required node type (null = any). Operation pattern (null = any, supports wildcards). Whether this node should be captured in match results. Name for captured node.

Node ID within pattern.

Required node type (null = any).

Operation pattern (null = any, supports wildcards).

Whether this node should be captured in match results.

Name for captured node.

An edge in a graph pattern.

Source node ID in pattern. Target node ID in pattern. Required edge type (null = any).

An edge in a graph pattern.

Source node ID in pattern. Target node ID in pattern. Required edge type (null = any).

Source node ID in pattern.

Target node ID in pattern.

Required edge type (null = any).

Result of pattern matching against a graph.

The matched pattern. All matches found.

Result of pattern matching against a graph.

The matched pattern. All matches found.

The matched pattern.

All matches found.

A single pattern match instance.

Mapping from pattern node IDs to graph node IDs. Named captures from the match.

A single pattern match instance.

Mapping from pattern node IDs to graph node IDs. Named captures from the match.

Mapping from pattern node IDs to graph node IDs.

Named captures from the match.

A function lifted to intermediate representation.

Function name (may be empty for unnamed functions). Start address of the function. IR statements comprising the function body. Basic blocks in the function. Control flow graph.

A function lifted to intermediate representation.

Function name (may be empty for unnamed functions). Start address of the function. IR statements comprising the function body. Basic blocks in the function. Control flow graph.

Function name (may be empty for unnamed functions).

Start address of the function.

IR statements comprising the function body.

Basic blocks in the function.

Control flow graph.

A function transformed to Static Single Assignment (SSA) form.

Function name. Start address of the function. SSA statements comprising the function body. SSA basic blocks in the function. Definition-use chains for dataflow analysis.

A function transformed to Static Single Assignment (SSA) form.

Function name. Start address of the function. SSA statements comprising the function body. SSA basic blocks in the function. Definition-use chains for dataflow analysis.

Function name.

Start address of the function.

SSA statements comprising the function body.

SSA basic blocks in the function.

Definition-use chains for dataflow analysis.

An intermediate representation statement.

Unique statement ID within the function. Original instruction address. Statement kind. Operation name (e.g., add, sub, load). Destination operand (if any). Source operands. Additional metadata.

An intermediate representation statement.

Unique statement ID within the function. Original instruction address. Statement kind. Operation name (e.g., add, sub, load). Destination operand (if any). Source operands. Additional metadata.

Unique statement ID within the function.

Original instruction address.

Statement kind.

Operation name (e.g., add, sub, load).

Destination operand (if any).

Source operands.

Additional metadata.

Kind of IR statement.

Unknown statement kind.

Assignment: dest = expr.

Binary operation: dest = src1 op src2.

Unary operation: dest = op src.

Memory load: dest = [addr].

Memory store: [addr] = src.

Unconditional jump.

Conditional jump.

Function call.

Function return.

No operation.

PHI node (for SSA form).

System call.

Interrupt.

Cast/type conversion.

Comparison.

Sign/zero extension.

An operand in an IR statement.

Operand kind. Name (for temporaries and registers). Constant value (for immediates). Size in bits. Whether this is a memory reference.

An operand in an IR statement.

Operand kind. Name (for temporaries and registers). Constant value (for immediates). Size in bits. Whether this is a memory reference.

Operand kind.

Name (for temporaries and registers).

Constant value (for immediates).

Size in bits.

Whether this is a memory reference.

Kind of IR operand.

Unknown operand kind.

CPU register.

IR temporary variable.

Immediate constant value.

Memory address.

Program counter / instruction pointer.

Stack pointer.

Base pointer / frame pointer.

Flags/condition register.

Undefined value (for SSA).

Label / address reference.

A basic block in the intermediate representation.

Unique block ID within the function. Block label/name. Start address of the block. End address of the block (exclusive). IDs of statements in this block. IDs of predecessor blocks. IDs of successor blocks.

A basic block in the intermediate representation.

Unique block ID within the function.

Block label/name.

Start address of the block.

End address of the block (exclusive).

IDs of statements in this block.

IDs of predecessor blocks.

IDs of successor blocks.

Control flow graph for a function.

ID of the entry block. IDs of exit blocks. CFG edges.

Control flow graph for a function.

ID of the entry block. IDs of exit blocks. CFG edges.

ID of the entry block.

IDs of exit blocks.

CFG edges.

An edge in the control flow graph.

Source block ID. Target block ID. Edge kind. Condition for conditional edges.

An edge in the control flow graph.

Source block ID. Target block ID. Edge kind. Condition for conditional edges.

Source block ID.

Target block ID.

Edge kind.

Condition for conditional edges.

Kind of CFG edge.

Sequential fall-through.

Unconditional jump.

Conditional branch taken.

Conditional branch not taken.

Function call edge.

Function return edge.

Indirect jump (computed target).

Exception/interrupt edge.

An SSA statement with versioned variables.

Unique statement ID within the function. Original instruction address. Statement kind. Operation name. Destination SSA variable (if any). Source SSA variables. For PHI nodes: mapping from predecessor block to variable version.

An SSA statement with versioned variables.

Unique statement ID within the function.

Original instruction address.

Statement kind.

Operation name.

Destination SSA variable (if any).

Source SSA variables.

For PHI nodes: mapping from predecessor block to variable version.

An SSA variable (versioned).

Original variable/register name. SSA version number. Size in bits. Variable kind.

An SSA variable (versioned).

Original variable/register name. SSA version number. Size in bits. Variable kind.

Original variable/register name.

SSA version number.

Size in bits.

Variable kind.

Kind of SSA variable.

CPU register.

IR temporary.

Memory location.

Immediate constant.

PHI result.

An SSA basic block.

Unique block ID. Block label. PHI nodes at block entry. Non-PHI statements. Predecessor block IDs. Successor block IDs.

An SSA basic block.

Unique block ID. Block label. PHI nodes at block entry. Non-PHI statements. Predecessor block IDs. Successor block IDs.

Unique block ID.

Block label.

PHI nodes at block entry.

Non-PHI statements.

Predecessor block IDs.

Successor block IDs.

Definition-use chains for SSA form.

Maps variable to its defining statement. Maps variable to statements that use it.

Definition-use chains for SSA form.

Maps variable to its defining statement. Maps variable to statements that use it.

Maps variable to its defining statement.

Maps variable to statements that use it.

Default implementation of semantic fingerprint generation.

Creates a new semantic fingerprint generator.

Logger instance.

Default implementation of semantic graph extraction from lifted IR.

Creates a new semantic graph extractor.

Logger instance.

Default implementation of semantic similarity matching.

Creates a new semantic matcher.

Logger instance.

Extension methods for registering semantic analysis services.

Adds semantic analysis services to the service collection.

The service collection. The service collection for chaining.