Source-linked AI summary
The Evolution of Binary Decompilation in the Modern Era: A Taxonomy, Literature Review, and Future Perspectives
Omar Abusabha, Sungjae Hwang
TL;DR
Decompilation research lacks reliable ground truth and standardized benchmarks, making systematic understanding and rigorous evaluation difficult. This paper conducts a systematic literature review and develops a taxonomy spanning methodologies, evaluation, tools, and benchmarks. It synthesizes developments, identifies 14 open challenges, and highlights ML—particularly LLMs—as a promising direction for more adaptive and semantically informed decompilation.
Problem
Reliable ground truth remains unsolved, while decompilation analyses may overlook semantic inaccuracies and type errors.
Method
The paper conducts a systematic literature review and synthesizes studies across decompilation approaches, evaluation capabilities, technical foundations, benchmarks, and compilation settings.
Results
The review identifies 14 open challenges and highlights the increasing role of ML, particularly LLMs, in future decompilation research.
Takeaways & Limitations
ML and LLMs are identified as promising directions for enabling more adaptive and semantically informed decompilation.
Takeaways & Limitations
As with systematic reviews generally, the study is subject to potential biases in its search.
Abstract
from arXiv · showhide
Decompilation has become a foundational technique in software engineering and security analysis, and it is now advancing through the integration of modern machine learning (ML) approaches. This article presents a systematic review of decompilation studies published over the past decades and develops a comprehensive taxonomy of methodologies employed in contemporary research. We further examine trends in evaluation metrics, tools, and benchmarks used to assess state-of-the-art approaches. Our review reveals key challenges, such as the lack of reliable ground truth and the absence of standardized benchmarks, which hinder rigorous comparison. Finally, we outline future research directions.
1 Introduction
Modern binary decompilation evolved from foundational staged systems into diverse task-oriented and neural approaches for recovering source-level information. This review frames the field’s challenges, research questions, workflows, and broader analytical applications.
- Recovered representations support downstream activities including malware analysis, binary translation, porting, code similarity analysis, vulnerability detection, exploitation, patching, validation, and root-cause analysis.
- Modern binary decompilation is defined here as beginning in the 1990s, when research shifted toward systematic, multi-stage frameworks for source-level recovery.
- Traditional decompilers use staged workflows spanning disassembly, IR lifting, CFG recovery, data-flow analysis, type inference, structuring, optimization, and source-like code generation.
- Neural decompilers instead use learned models as the primary mechanism for recovering source-level representations directly from binary instructions.
- Compilation is lossy because it discards semantic cues such as variable types, function boundaries, and control structures, with difficulty amplified by compiler diversity, platform conventions, and obfuscation.
- The review asks how architectures, task-oriented techniques, evaluation methods, capabilities, metrics, tools, frameworks, and benchmarks have shaped decompilation research.
2 Research Methodology
The study applies a Kitchenham-guided systematic literature review to identify, screen, classify, and synthesize binary-decompilation research. Its selected literature shows growth after 2013, a sharp increase after 2020, and concentration in conference and security venues.
- Review methodology: The review follows Kitchenham et al.’s systematic-literature-review guidelines and organizes evidence around research trends, design choices, evaluation patterns, and open challenges.
- Search Strategy: Searches combined Google Scholar with IEEE Xplore and the ACM Digital Library to improve coverage across publishers, disciplines, gray literature, and peer-reviewed sources.
- Search Strategy: Keyword refinement reduced 210 candidate keywords to 64 decompilation-specific keywords, while broad terms were retained to improve recall despite retrieving adjacent binary-analysis work.
- Screening of Retrieved Studies: The screening process manually assessed more than 120 retrieved studies using defined inclusion and exclusion criteria, including peer-reviewed C-binary studies addressing core decompilation challenges.
- Distribution of Studies: The review focus begins in the 1990s, activity remained limited until around 2013, and publication volume rose sharply after 2020.
- Distribution of Studies: The highest publication volume occurred in 2025, with 13 peer-reviewed studies, while most studies appeared in conference venues.
- Distribution of Publication Venues: USENIX Security was the most frequent venue with 10 studies, followed by NDSS, while ESEC/FSE and ISSTA demonstrate cross-disciplinary participation.
3 RQ1: Research Trends in Full-Pipeline Binary Decompilation
Full-pipeline decompilation has evolved across four architectural generations, from staged compiler-inspired representations toward dynamic, byte-equivalent, and neural approaches. These designs prioritize different objectives, including extensibility, readability, semantic preservation, and adaptability.
- Architectural evolution: Figure 3 organizes full-pipeline decompilers into four generations according to their dominant architectural paradigms.Individual systems may combine characteristics from multiple designs.
- G1: Traditional decompilation: dcc progressively transforms low-level machine information into higher-level representations through dual-level IRs and staged analyses.Its analyses include idiom recognition, data-flow analysis, control-flow structuring, and library-signature matching.
- IR-driven architectures: IR-centered systems reuse common representations to support multiple analyses or architectures, while optimization-driven systems simplify IR before code generation.Boomerang centers SSA for downstream analyses, whereas Hex-Rays emphasizes microcode simplification and optimization.
- Architectural priorities: Other traditional systems emphasize readable abstractions, retargetability, extensibility, or verified recompilable output as their dominant architectural priorities.C-Decompiler targets readable C, RetDec separates target-specific decoding from reusable analyses, REcompile supports new passes, and FoxDec prioritizes verified transformations.
- G2: Dynamic decompilation: Dynamic and human-guided systems incorporate runtime evidence or analyst interpretation to address static ambiguities and refine semantically accurate output.Decompetition defines perfect decompilation through byte-equivalent recompilation and provides a correctness-based stopping criterion.
- G4: Neural decompilation: Neural methods recast binary-to-source translation as learning, improving architectural adaptability while reducing interpretability and depending on training-data quality.Sequence, Transformer, and structure-aware models progressively add context, language independence, and syntactic or semantic structure, but retain accuracy and preprocessing constraints.
4 RQ2: Research Trends in Task-Oriented Binary Decompilation
The review organizes task-oriented decompilation into eight source-recovery tasks spanning core decompiler stages, post-structuring optimization, and post-generation processing. Across type recovery and control-flow structuring, approaches combine static, dynamic, hybrid, formal, and learned evidence with distinct coverage and dependency trade-offs.
- Taxonomy: The taxonomy covers eight source-recovery tasks, with Tasks 1–2 corresponding to core stages, Tasks 3–6 to post-structuring optimization, and Tasks 7–8 to post-generation processing.Figure 4 presents each task as T#.
- Type recovery: The review extends an existing organization of 38 C/C++ type-inference systems with 13 additional systems and groups approaches into two categories.Type recovery concerns unavailable, incomplete, or unreliable source-level type information.
- Program-analysis-based approaches: Program-analysis-based type recovery offers broad coverage and interpretable type relations but remains sensitive to optimization, aliasing, and incomplete interprocedural analysis.These methods derive types from constraints, data flow, memory behavior, and runtime evidence.
- Dynamic analysis: Dynamic type recovery provides precise observed propagation evidence, while value-based analysis is effective for aggregate and recursive structures; both depend on executed paths and inputs.Dynamic approaches use flow-based or value-based analysis of concrete runtime behavior.
- Hybrid analysis: Hybrid analysis reduces ambiguity by combining static relations with runtime evidence, but increases complexity and depends on representative executions.Examples combine value-set constraints, memory-access patterns, repeated executions, and flow-sensitive evidence.
- Learning-based approaches: Learning-based type recovery models semantic regularities through dynamic traces, static sequences, engineered features, or program graphs, but depends on representative training data and representations.Dynamic learning also incurs runtime instrumentation overhead, while static learning avoids execution.
- Control-flow structuring: Control-flow structuring uses semantics-preserving CFG transformations, with interval, virtualization, rule-based, graph-decomposition, and artifact-aware methods addressing different irregularities.The review groups existing approaches into six categories and excludes compiler-side methods.
- Control-flow structuring: Structuring methods remain bounded by irreducible control, incomplete structuring, recovered-CFG quality, or the substantial transformations required before reconstruction.These limitations differ across interval-based, Phoenix, DREAM, and Combing approaches.
4.3 T3: Expression Simplification
Expression simplification reduces low-level syntactic complexity while preserving semantics, using artifact removal, data-flow reasoning, and compiler-idiom recovery. More advanced symbolic and graph-based techniques improve simplification but increase computational cost and depend on accurate intermediate representations and data-flow information.
- Expression simplification rewrites low-level expressions, redundant temporaries, and opaque predicates into simpler forms while preserving program semantics.
- Early transformations remove compilation or obfuscation artifacts, including junk instructions and semantic no-ops, to reconstruct coherent local code regions.
- Data-flow methods use IR, often SSA-based, for expression propagation and redundant-computation elimination, with systems adding constant propagation, symbolic reasoning, and pointer transformation.
- Richer symbolic and graph-based reasoning can simplify expressions beyond conventional propagation and elimination, but may increase computational cost.
- Compiler-idiom recovery reconstructs high-level operations from optimized instruction sequences through expert-defined patterns or synthesized pattern discovery.
- PIdARCI improves idiom coverage and updates across compiler versions and optimization settings, while constant-recovery rules still require manual derivation.
4.6 T6: Variable Name Recovery
Variable-name recovery reconstructs source-level identifiers using rules, statistical alignment, structured prediction, contextual representations, and learned models. These approaches gain semantic and contextual coverage but remain limited by pattern maintenance, training data, recovered program information, and mapping reliability.
- Variable-name recovery reconstructs meaningful identifiers unavailable after compilation through heuristic rules or learning-based inference.
- Rule- and API-guided naming assigns interpretable names from structural patterns and known API semantics, but generalizes poorly beyond recognized patterns.
- Statistical alignment treats decompiled code as noisy source translation, exploiting recurring naming patterns while providing limited modeling of deeper program structure.
- Feature-based and context-aware systems jointly use engineered features, lexical or AST context, types, data layout, and broader program information.
- Richer representations improve contextual modeling but increase complexity and remain sensitive to inaccuracies in recovered program information.
- VarBERT obtains large-scale supervision by mapping variables between debug and stripped binaries, but depends on reliable mapping and representative training data.
5 RQ3: Research Trends in Evaluation of Decompiler Effectiveness
The review organizes full-pipeline decompiler evaluation into correctness, usability, and readability objectives. Studies use execution, static and symbolic comparison, human-centered analysis, and automated readability metrics, each with distinct coverage and practical limitations.
- Full-pipeline evaluation is organized into three objectives: correctness, usability, and readability.
- Correctness studies compare runtime behavior or semantic representations, sometimes after syntactic repair or recompilation.
- Execution-based methods include EMI differential testing, language-agnostic CFG testing, and broader mutation across compilers, optimizations, platforms, and executable formats.
- Symbolic approaches range from state-level differentiation and return-oriented equivalence to abstract comparison without recompilation, trading diagnostic detail or flexibility against recompilation and traceability requirements.
- Usability research examines analyst interactions, community engagement, and decompiled-code artifacts, including Ghidra discussions involving 1,590 threads and 688 users over six months.
6 RQ4: Research Trends in Evaluating Decompilation Capabilities
Decompilation studies evaluate capabilities including compactness, structuredness, readability, correctness, completeness, and usability through code metrics, semantic tests, human judgments, and task performance. Because these capabilities capture orthogonal aspects of quality, no single measure fully represents decompiler effectiveness.
- The review analyzes eight decompiler capabilities by asking what each means, how it is quantified, and what it implies for reverse-engineering workflows.
- Compactness: Compactness measures reductions in code volume and redundancy using lines of code, expression counts, and temporary-variable counts.
- Structuredness: Structuredness is assessed through goto counts, CFG edit distance, structured-region coverage, cyclomatic complexity, nesting depth, and control-flow similarity.
- Correctness: Correctness is evaluated through simulation, online judges, execution-based validation, basic-block semantic equivalence, and return-value or side-effect checks.
- Completeness: Completeness tracks recovered types, functions, and feasible control transfers, with broader CFG coverage trading precision for completeness.
- Usability: Usability is measured through perceived structural quality, task success, completion time, errors, analysis time, and subjective feedback.
7 RQ5: Research Trends in Implementation and Benchmarks
The review maps the implementation and evaluation infrastructure of decompilation research across analysis tools, ML models, benchmark suites, and compiler configurations. It finds diverse toolchains and growing use of generative models, while benchmark and compilation-setting choices remain uneven.
- Analysis Toolchains: Decompilation studies rely on toolchains spanning static analysis, binary lifting, parsing, solving, decompilers, and dynamic execution.These components support different workflow stages and trade semantic precision, integration, execution cost, and analysis complexity.
- Analysis Toolchains: IDA Pro dominates disassembler usage, while angr dominates binary-lifter usage with five studies.IDA Pro supports interactive analysis and scripting; angr provides VEX-based IR, a Python interface, and program-analysis support.
- ML Architectures: Generative models account for 20 surveyed models, compared with eight discriminative models, and support more open-ended reconstruction.Their larger output space also permits syntactic or semantic errors.
- ML Architectures: Encoder–decoder architectures dominate with 13 studies, while transformers and LLMs each appear in six models.Recurrent models appear four times, and hybrid designs twice.
- ML Architectures: Seven models operate at ≤512 tokens, indicating that many surveyed systems use limited input contexts.Limited context can constrain processing of long functions and low-level representations.
- Benchmarks and Compilation Settings: Decompile-Bench uses large-scale binary–source pairs from real-world repositories to provide more systematic and reproducible benchmark construction.The review also reports that standard -O0–-O3 settings dominate compiler configurations, with -O0 and -O3 particularly common.
8 Open Challenges and Future Research Directions
The review identifies 14 open issues across coverage, technical, and socio-technical dimensions. It emphasizes unreliable ground truth, nonrepresentative benchmarks, fidelity and validation gaps, limited neural-model context, weak error awareness, poor reproducibility, and unaddressed legal or ethical implications.
- Overview: 14 critical open issues are organized into coverage, technical, and socio-technical dimensions.The issues were synthesized from the review’s systematization and summarized in Figure 10.
- Coverage: Insufficient coverage limits generalization, motivating explicit input assumptions and benchmarks with broad program coverage and controlled compiler variation.Recommended benchmark properties include consistent granularity, compilation metadata, and controlled transformations.
- Coverage: Most studies evaluate well-formed, unpacked, unobfuscated binaries from standard compiler toolchains, excluding many practical binary conditions.Packed, malformed, partially recovered, JIT-generated, and post-compilation-modified binaries largely fall outside existing evaluations.
- Coverage: Reliable ground truth remains unsolved because debug information, instrumentation, harnessed pipelines, and modified compiler internals compromise accuracy or realism.The review calls for standardized, high-fidelity, diverse ground-truth datasets for evaluation and training.
- Coverage: Evaluations rarely isolate individual compilation settings, so standard optimization levels can miss failures triggered by specific transformations or flags.Bin2Wrong systematically varies compiler configurations to study their effects on decompiler correctness.
- Technical Challenges: Traditional decompilers can produce plausible outputs with subtle semantic inaccuracies because type inference and control-flow structuring remain incomplete or readability-oriented.The review recommends modular integration of static, dynamic, and ML-based techniques capable of validating and refining outputs.
- Technical Challenges: Semantic validation after decompilation remains underexplored, especially for summarization and refinement that further transform decompiler output.Suggested directions include equivalence checking, compiler-assisted validation, and feedback mechanisms.
- Evaluation: Only one dedicated decompilation metric, R2I, was identified, while generic metrics are not tailored to decompilation and R2I targets readability.R2I is unsuitable for malware analysis when semantic understanding outweighs readability.
9 Threats to Validity
The systematic review acknowledges threats from search, selection, classification, and generalizability limitations. Its conclusions primarily reflect peer-reviewed C-language decompilation literature and may not extend to other ecosystems or industrial settings.
- Biases: Search, selection, and classification processes may have introduced bias into the review and affected sample representativeness.The authors mitigated these risks through protocol refinement, pilot reviews, transparent methodology, and established SLR guidelines.
- Search Bias: Search limitations in query expressiveness, keyword coverage, and indexing inconsistencies may have caused relevant studies to be overlooked.The search covered records through December 2025 from Google Scholar, IEEE Xplore, and the ACM Digital Library.
- Selection and Classification Bias: Manual categorization and borderline inclusion decisions involved subjective judgment and may have influenced classification, especially across multiple research domains.This limitation applies to both study categorization and selection decisions.
- Generalizability: The findings primarily target C-language decompilation and peer-reviewed academic literature, limiting generalizability to Java, Python, and industrial settings.Other ecosystems and nonacademic practice are not represented to the same extent.
10 Conclusion
This systematic review synthesizes decompilation approaches, evaluation capabilities, technical foundations, benchmarks, and compilation settings, identifying 14 open challenges. It highlights ML—especially LLMs—as promising for more adaptive and semantically informed systems, while aiming to support robust, transparent, and practically deployable decompilers.
- Conclusion: The review synthesizes developments across decompilation approaches, evaluation capabilities, benchmarks, and compilation settings.It identifies 14 open challenges that frame future research.
- Conclusion: ML, particularly LLMs, is identified as a promising direction for more adaptive and semantically informed decompilation.This conclusion follows the review’s analysis of contemporary research trends.
- Conclusion: The survey is intended as a foundation for developing more robust, transparent, and practically deployable decompiler systems.The authors position the review as support for future research.
11 Ethical Concerns
The survey used AI-assisted tools for literature organization, data extraction, language refinement, manuscript organization, and consistency checking, while researchers retained responsibility for study selection, analysis, classification, and final decisions.
- NotebookLM supported literature organization and data extraction.
- ChatGPT assisted with language refinement, manuscript organization, and consistency checking.
- Researchers conducted and verified all study selection, classification, technical analysis, and final decisions.