Chengyue Liu

Fork-based development enables parallel evolution of software, but unsynchronized contributions create persistent divergence: security patches, bug fixes, and quality improvements often fail to propagate across fork families, leaving downstream users exposed to known vulnerabilities or bugs and missing massive opportunities to improve the other repositories in the family. We present the first large-scale empirical study of fork synchronization, analyzing popular GitHub fork families with 3,820 actively maintained forks, and developed a monitoring platform to mine the valuable commits and promote their swift merging. Our findings reveal a synchronization paradox: while 90% of submitted pull requests are merged, only 6.92% of fork commits ever appear in PRs, leaving massive fork development permanently unsynchronized across the families. Synchronization delay is pervasive and structurally uneven where fork propagation accounts for 72.9% of end-to-end commit lifecycle delay. Contrary to common assumptions, PR rejection is rarely caused by technical incorrectness; instead, 65% of rejections stem from superseded contributions, process violations, or maintainer policy decisions. Based on these insights, we develop a three-stage syncability assessment pipeline that identifies fork-local commits that are both sync-worthy (broadly beneficial) and sync-eligible (technically and policy-compatibly portable). Applied to 0.5 million fork-local commits, our pipeline surfaces 12,284 sync-ready commit--repository pairs, demonstrating that our approach identifies practically valuable changes. To further validate the security impact, we manually reviewed 153 security-related commit--repository pairs and confirmed 83 as potential 1-day vulnerabilities, for which we produced 35 proof-of-concept of exploit demonstrations and filed issues to the affected repositories. Our monitoring platform enables continuous, near-real-time detection of synchronization opportunities across fork families, improving the sustainability of fork-based open-source ecosystems.

Detecting third-party libraries (TPLs) in C/C++ binaries is essential for software supply chain security, enabling vulnerability identification and license compliance. Existing methods predominantly rely on similarity matching: extracting features from binaries and comparing them against library databases. However, similarity scores alone cannot reliably determine library presence. Low similarity causes false negatives when matchable features are limited. More critically, high similarity does not guarantee accuracy: libraries often share features through shared dependencies, forks, or similar functionality, causing multiple candidates to match even when only one is present. These issues suggest that similarity matching is effective for narrowing candidates but insufficient as the final decision mechanism. Rather than relying solely on similarity scores, reliable detection requires multi-source evidence to verify each candidate. To this end, we propose BLADE, which reframes TPL detection as evidence-based candidate verification. Instead of relying on similarity scores to make final decisions, BLADE retrieves candidates broadly to mitigate false negatives, and then collects evidence from multiple sources, which an LLM analyzes through structured verification workflows to filter false positives: first confirming candidates with clear identity markers, then systematically checking remaining candidates against common false positive patterns. To evaluate BLADE, we build the largest C/C++ binary TPL benchmark to date, comprising 3,403 binaries and 1,016 libraries. Results show that BLADE achieves 97.60% precision and 93.74% recall (F1: 95.63%), improving F1-score by 41.83 percentage points over the best baseline. The average cost is $0.0378 per binary. BLADE has been deployed in a commercial software composition analysis product, demonstrating practical feasibility at scale.

Locating a known source function in a stripped binary is a prerequisite for many security and software engineering tasks, including Software Composition Analysis (SCA) false-positive elimination, patch presence verification, malware analysis, code plagiarism detection, and license compliance auditing. We formalize this need as source-to-binary function localization: given the source code of a target function and its encompassing source package, determine whether the function is present in a stripped binary and, if so, report its address. Two fundamental challenges arise: cross-modal alignment, as source code and stripped binary reside in vastly different representation spaces; and similar function disambiguation, as compilation erases the symbolic features that distinguish functionally similar functions. We present XLoc, a recall-then-verify framework built on two insights. First, cross-modal alignment does not require costly and error-prone compilation; it only demands token-level alignment, a process that can be reliably approximated. Second, the information needed to disambiguate similar functions is already available on the source side and can be extracted ahead of time to guide verification. Building on these insights, XLoc implements a multi-stage recall module in which an LLM transforms source code into pseudo-decompiled representations aligned with binary decompilation output, bridging the cross-modal gap. For verification, XLoc identifies potentially confusing similar functions, extracts differential summaries, and uses them to guide the verification process toward the specific distinguishing evidence for each candidate, producing definitive accept/reject verdicts rather than similarity rankings. We evaluate XLoc on two complementary datasets spanning 196 CVEs, 480 vulnerable functions, and 756 binaries. XLoc achieves up to 84.4% localization accuracy (4.2× over the best baseline) and HM=87.1% for positive/negative discrimination (vs. 35.1% for the best baseline). These results demonstrate that XLoc can locate target functions with high accuracy, reliably discriminate between positive and negative cases, and produce definitive verdicts.

Detecting third-party libraries (TPLs) in C/C++ binaries is essential for ensuring software security and compliance, particularly in safety- and performance-critical domains. While numerous academic and commercial Software Composition Analysis (SCA) tools have been proposed, their true capabilities remain unclear due to the absence of large-scale benchmarks and systematic evaluation. Equally lacking is a deeper understanding of why these tools often underperform, which limits both research progress and practical adoption. We address this gap with a large-scale study of binary SCA tools. We construct the largest publicly available benchmark to date, encompassing 38,228 test cases across 1,873 libraries drawn from a defined scope of 13,675 libraries. Using this benchmark, we systematically evaluate 11 representative tools, covering all open source research prototypes and widely adopted commercial solutions, across versions, architectures, and feature-database scales. Beyond aggregate performance metrics, we perform the first fine-grained, feature-level analysis to identify the intrinsic challenges of binary TPL detection. Our results show that existing tools perform unsatisfactorily, with average recall below 60% and precision around 75%. Feature-level analysis reveals fundamental obstacles: binaries lose most source-code features during compilation, and libraries exhibit high feature overlap due to functional similarity and dependency propagation. These findings explain current shortcomings, and we build on them to provide design recommendations, research directions, and practical guidance for managing open-source risks in binary software.