asmsense: naming functions in stripped x86-64 binaries

Open a stripped binary in Ghidra or IDA and you get hundreds of FUN_00401a30. Much of reverse engineering is figuring out what each one does and giving it a name. This dataset pairs assembly of a single function, with project-internal symbols hidden, with the real function name from the source code, so models can be trained and evaluated on that first step.

• Code, pipeline and results: https://github.com/krxi/asmsense
• Kaggle mirror: https://www.kaggle.com/datasets/krxiii/asmsense
• default config: 19 permissively licensed open-source C projects, compiled for x86-64 at -O0 and -O2.
• v4 config: 228,177 functions from 341 projects at five optimization levels (see below).
• Fine-tuned model: krxi123/asmsense-qwen3-8b-lora

Splits

split	projects	functions
train	zlib, libpng, sqlite, lua, mbedtls, zstd, libsodium, expat, brotli, jansson, lz4, libyaml, xxhash, cJSON	16,804
test	tomlc17, cyaml, mu_json_x, sajs, picomatch	777
eval_115 (config)	balanced subset of test: up to 12 per project × opt level, leaky rows removed	115

The split is by project: no project contributes to both sides. Test projects are intentionally obscure (2–190 GitHub stars, mostly started in 2024–2025), so large models are unlikely to have memorized them. This matters: with the same pipeline, turning on "thinking" for MiMo-v2.6-pro raises exact matches on zlib from 9 to 28 (of 115), but not on the obscure test set (4 → 3). That gap points to memorization of famous code, not understanding.

Fields

field	meaning
id	project/file.c:opt:function
proje	source project
surum	source commit the binary was built from
dosya	source file
opt	-O0 or -O2
ad	target: the real function name
komut_sayisi	number of instructions (6–300)
sizinti	true if the name still leaks into the assembly (e.g. via a string); filter these out for evaluation
asm	Intel-syntax assembly of the function
baglam	(v2) call context: one-line summaries (imports, internal calls, strings) of the internal functions this one calls; empty if it calls none
baglam_derin	(v2) deeper context: full assembly of short callees (≤40 instructions), two-level summaries of longer ones
aciklama	(v2) one-sentence Turkish description written by a teacher model that saw the C source (distillation target); null for 6 truncated outputs
aciklama_model	(v2) which teacher model wrote aciklama
lisans	(v2) license of the source project
olcum_seti	(v2) true for the 115 rows in eval_115
egitimle_ayni_asm	(v2) true for 17 test rows whose normalized assembly also appears in train (mostly tiny wrappers); exclude them for strict evaluation

Field names are Turkish because the project is developed in Turkish.

Versions

• v2 (current, tag v2): adds baglam, baglam_derin, aciklama, aciklama_model, lisans, olcum_seti, egitimle_ayni_asm. Same 17,581 functions and splits as v1. The teacher descriptions never contain the target name (checked). About 3% of baglam/baglam_derin rows contain a real internal symbol name, almost always from assert/debug strings that would also be visible in a real stripped binary.
• v1 (tag v1): asm + ad only. Load with revision="v1".

v4: scaled, project-disjoint corpus

The v4 config scales the corpus to 228,177 functions from a 473-project permissive-source pool; 341 projects produced rows that survived compilation and filtering. Each source file is compiled at five optimization levels (-O0, -O1, -O2, -O3, -Os) into a real linked binary, followed by strip -x, before function extraction.

split	functions
train	196,117
validation	19,770
test	12,290

The split is by project: a project appears in exactly one split. Normalized-assembly duplicates are removed, cross-split assembly matches are excluded from training, and vendored (file, function) copies are excluded from validation and test. Fields are id, proje, surum, dosya, opt, kip, ad, kimlik, export, komut_sayisi, sizinti, asm, baglam, and lisans. The source license is carried in every row's lisans field; project revisions and licenses are listed in licenses/SOURCES.md.

v5: source-aware teacher labels

The v5 config contains the same 228,177 functions and project-disjoint splits as v4, with nullable teacher-label columns added. The teachers saw the C source code when writing the labels: codex/gpt-5.6-luna for the Turkish descriptions and most detailed fields, codex/gpt-5.6-sol for the detailed labels that failed automatic checks or a later audit with the first teacher (aciklama_model records the teacher of the Turkish sentence only); it did not infer them from assembly. A judge model (mimo-v2.6-pro) compared 2,883 sampled labels with the C source (0 wrong, 1 partial/generic, 2 correct): Turkish aciklama 1.96 (96.1% correct), girdiler 1.94, donus 1.94, yan_etki 1.93, aciklama_en 1.92, kategori 1.65 (72.3% correct, 7.2% wrong). Treat kategori as a coarse hint. Full report: rapor/OGRETMEN_DENETIM.md.

coverage	rows	share
any teacher label	228,022	99.9%
Turkish one-sentence aciklama + aciklama_model	227,892	99.9%
detailed fields (aciklama_en, kategori, girdiler, donus, yan_etki)	228,022	99.9%

Rows without a matching project/file:function teacher key contain null in the corresponding columns. Duplicate teacher keys keep their first occurrence (short: 0; detailed: 0). All v4 columns are retained unchanged.

How the assembly looks

• Project-internal functions are renamed sub_NNNN, so the target name never appears directly.
• Calls to external libraries (memcpy, malloc, …) stay visible, as they would through a real binary's import table.
• String constants and loc_N: labels are included, similar to what Ghidra shows.
• Relocations, static variable names, file paths, and compiler .cold fragments were scrubbed after a leak audit.

push   rbp
mov    rbp, rsp
...
call   loc_1    ; -> sub_0009

Results (from the repo)

Name token-F1 (1.0 = exact match). Full tables and error analysis: GitHub README, Results.

model	eval set	n	name F1	exact names
MiMo-v2.6-pro (best large open model, reasoning)	eval_115	115	~0.20	3 / 115
Qwen3-8B + LoRA (krxi123/asmsense-qwen3-8b-lora)	v4 test, fixed 2,000-row sample	2,000	0.106	25 / 2,000
Qwen3-8B + LoRA	eval_115	115	0.094	1 / 115
Qwen2.5-Coder-1.5B + LoRA, with call context	first 500 of the fixed sample	500	0.044	0
Qwen2.5-Coder-0.5B + LoRA	eval_115	112	0.01–0.02	0

• The 8B LoRA, trained on rows from the v4 train split, is the first small model clearly above zero, but it is still about half of the best large model on eval_115.
• Wrappers that only forward to another function are 0 for every model, because the name cannot be recovered without call-graph context.
• Small models below 8B memorized project prefixes or collapsed onto a few names.

Licenses

The assembly is derived from the listed projects and each part stays under its project's license. Only permissive licenses are used (MIT, BSD, ISC, zlib, libpng, Apache-2.0, public domain); for dual-licensed projects the permissive option applies. Full texts are in licenses/, sources and commits in licenses/SOURCES.md. Pipeline code is MIT.

Citation

@misc{asm_adlandirma_2026,
  title  = {asmsense: Stripped x86-64 Function Naming Dataset},
  author = {krxi},
  year   = {2026},
  url    = {https://github.com/krxi/asmsense}
}

Teacher descriptions (aciklama config)

One-sentence Turkish description of what each function does, for all 17,581 functions in train + test (avg. ~12.5 words). Written by a teacher model (mimo-v2.6-pro) that saw the source code, not the assembly, so it can be used as a distillation target for small models. Join on id.

field	meaning
id	same id as in train / test
aciklama	Turkish description
model	teacher model
proje	project

from datasets import load_dataset
load_dataset("krxi123/asmsense", "aciklama")