{"data":{"id":"10.48550/arxiv.2610.25071","type":"dois","attributes":{"doi":"10.48550/arxiv.2610.25071","prefix":"10.48550","suffix":"arxiv.2610.25071","identifiers":[{"identifier":"2610.25071","identifierType":"arXiv"}],"alternateIdentifiers":[{"alternateIdentifierType":"arXiv","alternateIdentifier":"2610.25071"}],"creators":[{"name":"Wang, Huaijin","nameType":"Personal","givenName":"Huaijin","familyName":"Wang","affiliation":[],"nameIdentifiers":[]},{"name":"Wang, Tongda","nameType":"Personal","givenName":"Tongda","familyName":"Wang","affiliation":[],"nameIdentifiers":[]},{"name":"Liu, Zhibo","nameType":"Personal","givenName":"Zhibo","familyName":"Liu","affiliation":[],"nameIdentifiers":[]},{"name":"Zhang, Yue","nameType":"Personal","givenName":"Yue","familyName":"Zhang","affiliation":[],"nameIdentifiers":[]},{"name":"Wang, Shuai","nameType":"Personal","givenName":"Shuai","familyName":"Wang","affiliation":[],"nameIdentifiers":[]},{"name":"Hu, Pengfei","nameType":"Personal","givenName":"Pengfei","familyName":"Hu","affiliation":[],"nameIdentifiers":[]},{"name":"Liu, Jianzhong","nameType":"Personal","givenName":"Jianzhong","familyName":"Liu","affiliation":[],"nameIdentifiers":[]},{"name":"Zhong, Fangtian","nameType":"Personal","givenName":"Fangtian","familyName":"Zhong","affiliation":[],"nameIdentifiers":[]},{"name":"Wang, Shaohua","nameType":"Personal","givenName":"Shaohua","familyName":"Wang","affiliation":[],"nameIdentifiers":[]}],"titles":[{"title":"Locate, Then Reason: End-to-End Patch Presence Testing in Stripped Binaries"}],"publisher":"arXiv","container":{},"publicationYear":2026,"subjects":[{"lang":"en","subject":"Cryptography and Security (cs.CR)","subjectScheme":"arXiv"},{"subject":"FOS: Computer and information sciences","subjectScheme":"Fields of Science and Technology (FOS)"}],"contributors":[],"dates":[{"date":"2026-10-18T07:27:48Z","dateType":"Submitted","dateInformation":"v1"},{"date":"2026-10-20T01:09:59Z","dateType":"Updated","dateInformation":"v1"},{"date":"2026-10","dateType":"Available","dateInformation":"v1"}],"language":null,"types":{"ris":"GEN","bibtex":"misc","citeproc":"article","schemaOrg":"CreativeWork","resourceType":"Article","resourceTypeGeneral":"Preprint"},"relatedIdentifiers":[],"relatedItems":[],"sizes":[],"formats":[],"version":"1","rightsList":[{"rights":"arXiv.org perpetual, non-exclusive license","rightsUri":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/"}],"descriptions":[{"description":"Binary patch presence testing (PPT) determines whether a security fix is present in a stripped binary. Prior systems often assume that patch-relevant code is known or successfully matched. Function-level matching is brittle to compilation changes, inlining, finite model context, and missing usage context; moreover, similarity suppresses the patch-sized distinction needed for the verdict. We present PatchAlign, an end-to-end binary PPT workflow, which performs large-scale localization that maximizes recall economically, then the final verdict reasons for patch-specific evidence. PatchAlign uses instruction-aligned retrieval and caller-callee context to accurately locate patch-relevant binary code pieces, then screens the shortlist and compares target binary code with vulnerable and patched references using an LLM. Our experiments indicate that PatchAlign can precisely localize patch-relevant code and determine patch status without a target-location oracle.","descriptionType":"Abstract"}],"geoLocations":[],"fundingReferences":[],"xml":"PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz4KPHJlc291cmNlIHhtbG5zPSJodHRwOi8vZGF0YWNpdGUub3JnL3NjaGVtYS9rZXJuZWwtNCIgeG1sbnM6eHNpPSJodHRwOi8vd3d3LnczLm9yZy8yMDAxL1hNTFNjaGVtYS1pbnN0YW5jZSIgeHNpOnNjaGVtYUxvY2F0aW9uPSJodHRwOi8vZGF0YWNpdGUub3JnL3NjaGVtYS9rZXJuZWwtNCBodHRwOi8vc2NoZW1hLmRhdGFjaXRlLm9yZy9tZXRhL2tlcm5lbC00LjMvbWV0YWRhdGEueHNkIj4KICA8aWRlbnRpZmllciBpZGVudGlmaWVyVHlwZT0iRE9JIj4xMC40ODU1MC9BUlhJVi4yNjEwLjI1MDcxPC9pZGVudGlmaWVyPgogIDxhbHRlcm5hdGVJZGVudGlmaWVycz4KICAgIDxhbHRlcm5hdGVJZGVudGlmaWVyIGFsdGVybmF0ZUlkZW50aWZpZXJUeXBlPSJhclhpdiI+MjYxMC4yNTA3MTwvYWx0ZXJuYXRlSWRlbnRpZmllcj4KICA8L2FsdGVybmF0ZUlkZW50aWZpZXJzPgogIDxjcmVhdG9ycz4KICAgIDxjcmVhdG9yPgogICAgICA8Y3JlYXRvck5hbWUgbmFtZVR5cGU9IlBlcnNvbmFsIj5XYW5nLCBIdWFpamluPC9jcmVhdG9yTmFtZT4KICAgICAgPGdpdmVuTmFtZT5IdWFpamluPC9naXZlbk5hbWU+CiAgICAgIDxmYW1pbHlOYW1lPldhbmc8L2ZhbWlseU5hbWU+CiAgICA8L2NyZWF0b3I+CiAgICA8Y3JlYXRvcj4KICAgICAgPGNyZWF0b3JOYW1lIG5hbWVUeXBlPSJQZXJzb25hbCI+V2FuZywgVG9uZ2RhPC9jcmVhdG9yTmFtZT4KICAgICAgPGdpdmVuTmFtZT5Ub25nZGE8L2dpdmVuTmFtZT4KICAgICAgPGZhbWlseU5hbWU+V2FuZzwvZmFtaWx5TmFtZT4KICAgIDwvY3JlYXRvcj4KICAgIDxjcmVhdG9yPgogICAgICA8Y3JlYXRvck5hbWUgbmFtZVR5cGU9IlBlcnNvbmFsIj5MaXUsIFpoaWJvPC9jcmVhdG9yTmFtZT4KICAgICAgPGdpdmVuTmFtZT5aaGlibzwvZ2l2ZW5OYW1lPgogICAgICA8ZmFtaWx5TmFtZT5MaXU8L2ZhbWlseU5hbWU+CiAgICA8L2NyZWF0b3I+CiAgICA8Y3JlYXRvcj4KICAgICAgPGNyZWF0b3JOYW1lIG5hbWVUeXBlPSJQZXJzb25hbCI+WmhhbmcsIFl1ZTwvY3JlYXRvck5hbWU+CiAgICAgIDxnaXZlbk5hbWU+WXVlPC9naXZlbk5hbWU+CiAgICAgIDxmYW1pbHlOYW1lPlpoYW5nPC9mYW1pbHlOYW1lPgogICAgPC9jcmVhdG9yPgogICAgPGNyZWF0b3I+CiAgICAgIDxjcmVhdG9yTmFtZSBuYW1lVHlwZT0iUGVyc29uYWwiPldhbmcsIFNodWFpPC9jcmVhdG9yTmFtZT4KICAgICAgPGdpdmVuTmFtZT5TaHVhaTwvZ2l2ZW5OYW1lPgogICAgICA8ZmFtaWx5TmFtZT5XYW5nPC9mYW1pbHlOYW1lPgogICAgPC9jcmVhdG9yPgogICAgPGNyZWF0b3I+CiAgICAgIDxjcmVhdG9yTmFtZSBuYW1lVHlwZT0iUGVyc29uYWwiPkh1LCBQZW5nZmVpPC9jcmVhdG9yTmFtZT4KICAgICAgPGdpdmVuTmFtZT5QZW5nZmVpPC9naXZlbk5hbWU+CiAgICAgIDxmYW1pbHlOYW1lPkh1PC9mYW1pbHlOYW1lPgogICAgPC9jcmVhdG9yPgogICAgPGNyZWF0b3I+CiAgICAgIDxjcmVhdG9yTmFtZSBuYW1lVHlwZT0iUGVyc29uYWwiPkxpdSwgSmlhbnpob25nPC9jcmVhdG9yTmFtZT4KICAgICAgPGdpdmVuTmFtZT5KaWFuemhvbmc8L2dpdmVuTmFtZT4KICAgICAgPGZhbWlseU5hbWU+TGl1PC9mYW1pbHlOYW1lPgogICAgPC9jcmVhdG9yPgogICAgPGNyZWF0b3I+CiAgICAgIDxjcmVhdG9yTmFtZSBuYW1lVHlwZT0iUGVyc29uYWwiPlpob25nLCBGYW5ndGlhbjwvY3JlYXRvck5hbWU+CiAgICAgIDxnaXZlbk5hbWU+RmFuZ3RpYW48L2dpdmVuTmFtZT4KICAgICAgPGZhbWlseU5hbWU+Wmhvbmc8L2ZhbWlseU5hbWU+CiAgICA8L2NyZWF0b3I+CiAgICA8Y3JlYXRvcj4KICAgICAgPGNyZWF0b3JOYW1lIG5hbWVUeXBlPSJQZXJzb25hbCI+V2FuZywgU2hhb2h1YTwvY3JlYXRvck5hbWU+CiAgICAgIDxnaXZlbk5hbWU+U2hhb2h1YTwvZ2l2ZW5OYW1lPgogICAgICA8ZmFtaWx5TmFtZT5XYW5nPC9mYW1pbHlOYW1lPgogICAgPC9jcmVhdG9yPgogIDwvY3JlYXRvcnM+CiAgPHRpdGxlcz4KICAgIDx0aXRsZT5Mb2NhdGUsIFRoZW4gUmVhc29uOiBFbmQtdG8tRW5kIFBhdGNoIFByZXNlbmNlIFRlc3RpbmcgaW4gU3RyaXBwZWQgQmluYXJpZXM8L3RpdGxlPgogIDwvdGl0bGVzPgogIDxwdWJsaXNoZXI+YXJYaXY8L3B1Ymxpc2hlcj4KICA8cHVibGljYXRpb25ZZWFyPjIwMjY8L3B1YmxpY2F0aW9uWWVhcj4KICA8c3ViamVjdHM+CiAgICA8c3ViamVjdCB4bWw6bGFuZz0iZW4iIHN1YmplY3RTY2hlbWU9ImFyWGl2Ij5DcnlwdG9ncmFwaHkgYW5kIFNlY3VyaXR5IChjcy5DUik8L3N1YmplY3Q+CiAgICA8c3ViamVjdCBzdWJqZWN0U2NoZW1lPSJGaWVsZHMgb2YgU2NpZW5jZSBhbmQgVGVjaG5vbG9neSAoRk9TKSI+Rk9TOiBDb21wdXRlciBhbmQgaW5mb3JtYXRpb24gc2NpZW5jZXM8L3N1YmplY3Q+CiAgPC9zdWJqZWN0cz4KICA8ZGF0ZXM+CiAgICA8ZGF0ZSBkYXRlVHlwZT0iU3VibWl0dGVkIiBkYXRlSW5mb3JtYXRpb249InYxIj4yMDI2LTEwLTE4VDA3OjI3OjQ4WjwvZGF0ZT4KICAgIDxkYXRlIGRhdGVUeXBlPSJVcGRhdGVkIiBkYXRlSW5mb3JtYXRpb249InYxIj4yMDI2LTEwLTIwVDAxOjA5OjU5WjwvZGF0ZT4KICAgIDxkYXRlIGRhdGVUeXBlPSJBdmFpbGFibGUiIGRhdGVJbmZvcm1hdGlvbj0idjEiPjIwMjYtMTA8L2RhdGU+CiAgPC9kYXRlcz4KICA8cmVzb3VyY2VUeXBlIHJlc291cmNlVHlwZUdlbmVyYWw9IlByZXByaW50Ij5BcnRpY2xlPC9yZXNvdXJjZVR5cGU+CiAgPHZlcnNpb24+MTwvdmVyc2lvbj4KICA8cmlnaHRzTGlzdD4KICAgIDxyaWdodHMgcmlnaHRzVVJJPSJodHRwOi8vYXJ4aXYub3JnL2xpY2Vuc2VzL25vbmV4Y2x1c2l2ZS1kaXN0cmliLzEuMC8iPmFyWGl2Lm9yZyBwZXJwZXR1YWwsIG5vbi1leGNsdXNpdmUgbGljZW5zZTwvcmlnaHRzPgogIDwvcmlnaHRzTGlzdD4KICA8ZGVzY3JpcHRpb25zPgogICAgPGRlc2NyaXB0aW9uIGRlc2NyaXB0aW9uVHlwZT0iQWJzdHJhY3QiPkJpbmFyeSBwYXRjaCBwcmVzZW5jZSB0ZXN0aW5nIChQUFQpIGRldGVybWluZXMgd2hldGhlciBhIHNlY3VyaXR5IGZpeCBpcyBwcmVzZW50IGluIGEgc3RyaXBwZWQgYmluYXJ5LiBQcmlvciBzeXN0ZW1zIG9mdGVuIGFzc3VtZSB0aGF0IHBhdGNoLXJlbGV2YW50IGNvZGUgaXMga25vd24gb3Igc3VjY2Vzc2Z1bGx5IG1hdGNoZWQuIEZ1bmN0aW9uLWxldmVsIG1hdGNoaW5nIGlzIGJyaXR0bGUgdG8gY29tcGlsYXRpb24gY2hhbmdlcywgaW5saW5pbmcsIGZpbml0ZSBtb2RlbCBjb250ZXh0LCBhbmQgbWlzc2luZyB1c2FnZSBjb250ZXh0OyBtb3Jlb3Zlciwgc2ltaWxhcml0eSBzdXBwcmVzc2VzIHRoZSBwYXRjaC1zaXplZCBkaXN0aW5jdGlvbiBuZWVkZWQgZm9yIHRoZSB2ZXJkaWN0LiBXZSBwcmVzZW50IFBhdGNoQWxpZ24sIGFuIGVuZC10by1lbmQgYmluYXJ5IFBQVCB3b3JrZmxvdywgd2hpY2ggcGVyZm9ybXMgbGFyZ2Utc2NhbGUgbG9jYWxpemF0aW9uIHRoYXQgbWF4aW1pemVzIHJlY2FsbCBlY29ub21pY2FsbHksIHRoZW4gdGhlIGZpbmFsIHZlcmRpY3QgcmVhc29ucyBmb3IgcGF0Y2gtc3BlY2lmaWMgZXZpZGVuY2UuIFBhdGNoQWxpZ24gdXNlcyBpbnN0cnVjdGlvbi1hbGlnbmVkIHJldHJpZXZhbCBhbmQgY2FsbGVyLWNhbGxlZSBjb250ZXh0IHRvIGFjY3VyYXRlbHkgbG9jYXRlIHBhdGNoLXJlbGV2YW50IGJpbmFyeSBjb2RlIHBpZWNlcywgdGhlbiBzY3JlZW5zIHRoZSBzaG9ydGxpc3QgYW5kIGNvbXBhcmVzIHRhcmdldCBiaW5hcnkgY29kZSB3aXRoIHZ1bG5lcmFibGUgYW5kIHBhdGNoZWQgcmVmZXJlbmNlcyB1c2luZyBhbiBMTE0uIE91ciBleHBlcmltZW50cyBpbmRpY2F0ZSB0aGF0IFBhdGNoQWxpZ24gY2FuIHByZWNpc2VseSBsb2NhbGl6ZSBwYXRjaC1yZWxldmFudCBjb2RlIGFuZCBkZXRlcm1pbmUgcGF0Y2ggc3RhdHVzIHdpdGhvdXQgYSB0YXJnZXQtbG9jYXRpb24gb3JhY2xlLjwvZGVzY3JpcHRpb24+CiAgPC9kZXNjcmlwdGlvbnM+CjwvcmVzb3VyY2U+","url":"https://arxiv.org/abs/2610.25071","contentUrl":null,"metadataVersion":0,"schemaVersion":"http://datacite.org/schema/kernel-4","source":"mds","isActive":true,"state":"findable","reason":null,"viewCount":0,"viewsOverTime":[],"downloadCount":0,"downloadsOverTime":[],"referenceCount":0,"citationCount":0,"citationsOverTime":[],"partCount":0,"partOfCount":0,"versionCount":0,"versionOfCount":0,"created":"2026-10-20T04:28:46.000Z","registered":"2026-10-20T04:28:46.000Z","published":"2026","updated":"2026-10-20T04:28:46.000Z"},"relationships":{"client":{"data":{"id":"arxiv.content","type":"clients"}},"provider":{"data":{"id":"arxiv","type":"providers"}},"media":{"data":{"id":"10.48550/arxiv.2610.25071","type":"media"}},"references":{"data":[]},"citations":{"data":[]},"parts":{"data":[]},"partOf":{"data":[]},"versions":{"data":[]},"versionOf":{"data":[]}}}}