Source-linked AI summary
Decoupling is a Necessity: Transformation-Agnostic Decompiled Code Recovery under Optimization and Obfuscation
Zhiping Zhou, Xiaohong Li, Ruitao Feng, Yao Zhang, Yuekang Li, Wenbu Feng
TL;DR
Aggressive optimization and obfuscation create structural and semantic distortions that current LLM decompilers struggle to recover reliably. ReSource decouples recovery into semantic guidance, structural repair, and lexical refinement, achieving robust retrieval-based performance across diverse transformations. The framework is evaluated at function level and remains dependent on database coverage and available interprocedural context.
Problem
Existing LLM-based recovery methods overfit benign transformations and struggle with semantic hallucinations and structural collapse under aggressive optimization and obfuscation.
Method
ReSource decouples source recovery into lexical, syntactic, and semantic tiers using a Semantic Distortion Database, a control-flow predictor, and contextual lexical finalization.
Results
83% Top-5 retrieval accuracy and 0.66 average source-level similarity are reported across optimization levels and obfuscation schemes.
Takeaways & Limitations
ReSource demonstrates that explicitly decoupling structural and semantic constraints can improve decompilation fidelity for source-level security analysis.
Takeaways & Limitations
Performance generalization remains tied to database diversity, with highly customized obfuscation schemes untested and function-level recovery limited by external state and cross-function data flows.
Abstract
from arXiv · showhide
Reverse engineering is essential for software security analysis and vulnerability detection. Decompilation, the process of lifting binaries to high-level pseudocode, is central to this task. However, production binaries are hostile environments: aggressive compiler optimizations and adversarial obfuscation jointly mangle control structures, obscure variable intents, and disguise high-level program logic. Consequently, existing LLM-based decompilation tools frequently suffer from structural collapse and semantic hallucinations. We present ReSource, the first multi-phase LLM framework designed for transformation-agnostic source recovery. To tackle these intertwined distortions, ReSource conceptualizes the binary-to-source discrepancies into three orthogonal tiers, namely lexical, syntactic, and semantic, and decouples the recovery process accordingly. First, to ground the LLM and prevent logic drift, it retrieves empirical priors from a curated Semantic Distortion Database. Second, to resolve control-flow flattening, it integrates a lightweight predictor to reconstruct the source-level structural skeleton. Finally, a contextual lexical deduction stage refines identifiers to restore human readability. Evaluated on a massive benchmark of over 80,000 decompiled-source function pairs across three optimization levels and four obfuscation techniques, ReSource achieves an 83% Top-5 source retrieval accuracy and an average similarity score of 0.66. By maintaining robust semantic identifiability where state-of-the-art baselines (DeGPT, LLM4Decompile, and FidelityGPT) severely overfit or degrade, ReSource provides a scalable and reliable foundation for downstream security analysis.
1 Introduction
ReSource frames decompilation as transformation-agnostic, multi-dimensional source recovery for hostile optimized and obfuscated binaries. It decouples semantic, structural, and lexical reconstruction, then evaluates semantic identifiability through source retrieval.
- Production binaries combine aggressive optimization and adversarial obfuscation, causing existing LLM recovery systems to overfit benign transformations and hallucinate hazardous logic.
- The framework identifies unified recovery, semantic fidelity, structural reconstruction, and shallow evaluation as four core challenges.
- ReSource decouples recovery across lexical, syntactic, and semantic tiers using empirical semantic priors, a control-flow skeleton predictor, and lexical finalization.
- 83% average Top-5 retrieval accuracy is achieved on over 80,000 function pairs spanning three optimization levels and four obfuscation schemes.
- The paper contributes a transformation-agnostic multi-stage framework, an 80,000+ pair benchmark, and retrieval-based evaluation of global semantic identifiability.
2 Background & Motivation
The background motivates ReSource by showing how optimization and obfuscation create lexical, syntactic, and semantic divergence that defeats direct LLM recovery. The framework addresses these failures with semantic guidance, structural repair, and lexical finalization, alongside retrieval-based evaluation.
- Aggressive transformations create a severe semantic gap, leaving fragmented pseudocode that hinders source-level security tasks.
- Control-flow flattening can replace sequential loops with deeply nested state-machine-like structures, producing massive visual and logical divergence.
- Without semantic context, vanilla LLMs may invent nonexistent behavior, skip required operations, and miss boundary guards.
- Direct sequence-to-sequence recovery fails to restore deep structure under flattened control flow, motivating explicit source-level skeleton prediction.
- ReSource organizes recovery into semantic guidance, structural repair, and lexical finalization, while retrieval-based evaluation targets functional identifiability beyond token overlap.
3 Methodology
ReSource uses staged recovery to inject semantic, structural, and lexical constraints into decompilation. Its database-driven retrieval and learned control-flow prediction are designed to generalize across diverse transformations while improving readable source alignment.
- ReSource separates decompilation into guided semantic recovery, structure-oriented repair, and lexical finalization.
- Guided Semantic Recovery: The Semantic Distortion Database supplies context-aware empirical suggestions that constrain reasoning toward intended semantics and reduce hallucinations.
- Semantic Distortion Database: The database is constructed through taxonomy initialization, line-level alignment, and semantic guidance generation with signature construction.
- Semantic Suggestion Retrieval: Decompilation Semantic Signatures compare syntax, variable dependencies, control flow, and contextual role to match structurally diverse snippets contextually.
- Structure-Oriented Repair: Learned transformation-invariant correlations allow plausible skeleton inference for unseen obfuscation schemes or optimization patterns.
- Lexical Finalization: The finalization phase jointly refines lexical, syntactic, and semantic dimensions to improve readability and source-level alignment.
4 Evaluation
ReSource is evaluated on a broad benchmark using complementary similarity and retrieval-based measures. It remains robust across optimization and obfuscation, with semantic and structural stages contributing distinct, complementary gains.
- Evaluation Setup: Over 80,000 decompiled-source function pairs cover three optimization levels and four obfuscation schemes.The corpus contains real-world C/C++ programs and includes binaries decompiled with IDA Pro 7.5.
- Evaluation Setup: ReSource combines multi-level code similarity with retrieval-based semantic identifiability to evaluate recovery quality.Similarity examines interface, structure, control flow, Halstead, and token dimensions, while retrieval tests whether recovered functions identify the original source.
- RQ1: Code Similarity: 0.66 average similarity makes ReSource the highest-scoring system, ahead of FidelityGPT at 0.62, LLM4Decompile at 0.61, and DeGPT at 0.58.Its performance remains stable under O3 optimization and adversarial obfuscation such as CFF.
- RQ2: Function Retrieval Accuracy: 83% average Top-5 retrieval accuracy exceeds FidelityGPT at 77%, DeGPT at 65%, and LLM4Decompile at 61%.ReSource maintains resilient identifiability under aggressive transformations, including a 70% Obf-AVG Top-1 accuracy.
- RQ2: Function Retrieval Accuracy: Token similarity can overstate fidelity: LLM4Decompile reaches 0.69 under O1 while achieving lower retrieval accuracy than ReSource’s 0.66.The results support retrieval accuracy as a more rigorous proxy for semantic consistency than superficial token overlap.
- RQ3: Effect of Each Phase: Structural prediction reaches 86% Top-5 accuracy under CFF, whereas semantic guidance reaches 79% under O3.The structural module is strongest against control-flow flattening, while semantic guidance is strongest when optimization strips semantic cues.
- RQ3: Effect of Each Phase: 83% full-pipeline Top-5 accuracy exceeds the best isolated variant at 81%, while lexical-only recovery reaches 76%.Removing either semantic guidance or structural prediction reduces accuracy, indicating complementary rather than redundant contributions.
5 Discussion and Limitations
ReSource addresses the mismatch between token-level similarity and semantic recovery by decoupling semantic and structural constraints, while its practical scope remains bounded by function-level context, database coverage, and proxy-based evaluation.
- Practical Implications: ReSource may ease binary analysis by producing readable source representations compatible with source-level tools such as CodeQL and Fortify.This can let analysts inspect logic and vulnerabilities in a more intuitive domain.
- Discussion: ReSource’s semantic and structural decoupling targets distinct failure modes: semantic hallucinations and structural collapse.The ablation study supports targeted treatments for these separate problems.
- Limitations: Formal functional equivalence is often ill-posed for isolated functions because global headers, variables, and external prototypes may be unavailable.ReSource therefore uses semantic fidelity and preservation of security-critical properties as proxies for correctness.
- Limitations: The Semantic Distortion Database primarily covers mainstream compilers and common obfuscators, leaving customized or proprietary schemes untested.Generalization is tied to the diversity of the underlying database.
- Limitations: Function-level operation can struggle when semantics depend deeply on external state or complex cross-function data flows.Interprocedural reasoning and global type inference are identified as future directions.
6 Related Work
Related work progresses from low-level binary representations to decompiled pseudocode and LLM-assisted recovery, improving structural matching, readability, identifier recovery, and code refinement while retaining source-level limitations.
- From Binary Analysis to Decompiled Understanding: Early binary-recovery methods use instruction sequences, control-flow graphs, intermediate representations, and graph neural networks for transformation-invariant structural matching.These approaches remain focused on low-level representations.
- From Binary Analysis to Decompiled Understanding: Low-level methods lack access to types, variables, and logical intent, preventing recovery of readable, source-like representations.This motivates moving toward decompiled code as a higher-level reasoning substrate.
- From Decompiled Code to Type and Identifier Recovery: Modern decompiler-based work combines pseudocode with LLMs and static analysis to infer stripped identifiers and reconstruct composite types.ReSym and TypeForge improve surface readability and provide groundwork for later recovery systems.
- LLM-Based Decompilation and Code Refinement: Recent LLM systems pursue end-to-end decompilation or post-processing, including assembly-to-C fine-tuning, variable renaming, and structural simplification.LLM4Decompile targets standard optimizations, while DeGPT and FidelityGPT emphasize refinement quality.
7 Conclusion
ReSource decouples semantic and structural recovery for binaries transformed by optimization and obfuscation, combining empirical priors with structural skeletons. Across diverse transformations, it reports 0.66 average source-level similarity and 83% Top-5 retrieval accuracy.
- Conclusion: ReSource integrates a Semantic Distortion Database with a control-flow predictor to address semantic hallucinations and structural collapse.The combination is presented as enabling transformation-agnostic robustness.
- Conclusion: 0.66 average source-level similarity and 83% Top-5 retrieval accuracy were achieved across diverse optimization levels and obfuscation schemes.The evaluation supports the paper’s claim that explicit structural and semantic decoupling improves decompilation fidelity.