# Lifting Network Protocol Implementation to Precise Format Specification with Security Applications

> NetLifter statically lifts source-available C protocol parsers into BNF-style message grammars and first-order constraints between packet fields. It analyzes annotated LLVM bitcode using abstract format graphs, localized path-sensitive analysis, unfolding and reordering. The resulting field boundaries, constraints and names can support packet generation and parser construction.

- Authors: Qingkai Shi; Junyang Shao; Yapeng Ye; Mingwei Zheng; Xiangyu Zhang
- Venue: ACM CCS 2023
- Status: Conference paper
- Publication / posting date: November 15, 2023
- Date source: ACM’s Crossref deposit records published/print publication on 2023-11-15 and a separate online/publication-history date of 2023-11-21. This entry uses the published/print date, not the November 26–30 conference dates.
- First arXiv submission: May 19, 2023
- arXiv: 2305.11781
- Reviewed arXiv version: v1
- DOI: 10.1145/3576915.3616614
- Sources reviewed: 2026-10-17
- Added to the catalog: 2026-10-18
- Original paper: <https://dl.acm.org/doi/10.1145/3576915.3616614>
- PDF: <https://qingkaishi.github.io/public_pdfs/CCS23.pdf>
- Code: <https://github.com/qingkaishi/netlifter>
- BibTeX: <https://awesomerea.org/papers/citations/paper-netlifter.bib>
- Catalog page: <https://awesomerea.org/papers/paper-netlifter/>
- Record JSON: <https://awesomerea.org/papers/paper-netlifter/record.json>
- Chinese version: [简体中文](https://awesomerea.org/zh/papers/paper-netlifter/index.md)

## Scope and limitations

Requires source/LLVM IR and packet-buffer/length annotations; it is not closed-binary or traffic-only recovery. The paper targets common top-down C parsers and does not support C++, inline assembly or libraries without available code. Pointer/loop analysis remains approximate; checksum fields can be identified while some checksum constraints are omitted, and fields ignored by an implementation may be missed. Precision/recall was manually checked on ten selected protocols. The reported fuzzing evaluation used three-hour runs repeated twenty times and bypassed checksum checks. It infers formats, not protocol state machines or proof of implementation equivalence.

## Why it fits this collection

Adds source-to-format inference with cross-field constraints, complementing traffic-based and binary-assisted protocol reconstruction research.

## Publication and review notes

The final author PDF and Crossref establish the five-author order, CCS 2023 DOI and pages. The 19-page arXiv v1 retains an old CCS 2022 submission template and placeholder DOI; publication identity follows the final 15-page paper. The repository calls its prototype Popeye and warns of rough edges. Its reviewed 2025-04-21 snapshot declares AGPL-3.0-or-later in source headers. CMake requires 3.10+, LLVM 12.x and Z3>=4.8.12; README recommends LLVM 12.0.1 and the author’s modified Z3 4.8.12-popeye branch. Vectorized IR is unsupported: README documents -fno-vectorize and -fno-slp-vectorize, and recommends debug information and removal of optimization flags for field naming. Dependencies and target code retain separate terms.

## Primary sources

1. <https://dl.acm.org/doi/10.1145/3576915.3616614>
2. <https://api.crossref.org/works/10.1145/3576915.3616614>
3. <https://qingkaishi.github.io/public_pdfs/CCS23.pdf>
4. <https://arxiv.org/abs/2305.11781>
5. <https://arxiv.org/pdf/2305.11781v1>
6. <https://github.com/qingkaishi/netlifter/blob/362fe1edc2c2027d6e404c5d27cf9fee8a6b6a48/README.md>
7. <https://github.com/qingkaishi/netlifter/blob/362fe1edc2c2027d6e404c5d27cf9fee8a6b6a48/LICENSE.txt>
8. <https://github.com/qingkaishi/netlifter/blob/362fe1edc2c2027d6e404c5d27cf9fee8a6b6a48/CMakeLists.txt>
9. <https://github.com/qingkaishi/netlifter/blob/362fe1edc2c2027d6e404c5d27cf9fee8a6b6a48/tools/popeye/popeye.cpp>
10. <https://github.com/qingkaishi/netlifter/blob/362fe1edc2c2027d6e404c5d27cf9fee8a6b6a48/tools/popeye/LiftingPass.cpp>
11. <https://github.com/qingkaishi/netlifter/blob/362fe1edc2c2027d6e404c5d27cf9fee8a6b6a48/benchmarks/popeye/readme.txt>
12. <https://github.com/qingkaishi/netlifter/blob/362fe1edc2c2027d6e404c5d27cf9fee8a6b6a48/benchmarks/popeye/regression.sh>
13. <https://github.com/qingkaishi/z3/blob/b42b2d6d6994f593976cb8cc7eb6b093532954c9/README-CMake.md>
14. <https://github.com/qingkaishi/z3/blob/b42b2d6d6994f593976cb8cc7eb6b093532954c9/LICENSE.txt>

## About this entry

Reviewed against the paper and its primary sources. Cite the original authors using the linked paper or BibTeX.
Original editorial content: MIT. Linked projects, papers and assets retain their own rights and licenses.