PaperlayerView exact revision on arXiv

Source-linked AI summary

Echo: Learning-based Matching Decompilation using Trusted Back Translation

Jun Bi, Xiangxin Fang, Aarsh Chaube, José Wesley De Souza Magalhães, Rodrigo C. O. Rocha, Michael O'Boyle

arXiv:2609.18706v1cs.CRcs.AI

TL;DR

Neural decompilers can produce readable, recompilable code, but correctness remains difficult to establish, especially for optimized binaries with unknown compilation configurations. Echo uses compilation as trusted feedback to search for and refine source candidates. It produces more exact matches than the strongest baseline and achieves the highest source-level structural similarity on the reported evaluations.

  • Problem

    Decompilation predictions are difficult to trust, and matching optimized real-world binaries under unknown compilation configurations remains underexplored.

    Source: §1 · pp. 1–2

  • Method

    Echo recompiles candidate decompilations under synthesized configurations and uses assembly mismatches to guide iterative selection and rule-based, neural, and reasoning-based refinement.

    Source: §1 · p. 2, §3.2 · p. 5

  • Results

    2.43× more exact matches on average than the strongest baseline; Echo also achieves the highest source-level structural similarity and matches 2.75× and 7.4× as many Mirai functions as GPT-5.6 and Codex.

    Source: §1 · p. 2, §9 · p. 13

  • Takeaways & Limitations

    Trusted back-translation is a practical and useful system mechanism for efficient matching decompilation.

    Source: §9 · p. 13

    Behavioral equivalence is only an auxiliary metric: benchmark harnesses test finite inputs and are generally unavailable for real-world binaries.

    Source: §6.3 · p. 9

Abstract

from arXiv · show

Neural decompilers can recover readable and recompilable source code from binaries, but their predictions remain difficult to trust. Matching decompilation addresses this problem by searching for source code whose recompiled assembly exactly matches the target, providing stronger evidence of correctness. However, exact matching remains challenging for optimized binaries under unknown compilation configurations. We present Echo, a matching decompilation system based on trusted back-translation. Our key insight is to use compilation not only for verification, but also as trusted feedback to guide iterative search. Echo first uses a domain-specific model to generate candidate programs and compilation configurations. It recompiles these candidates, measures assembly-level similarity, and synthesizes promising code-configuration pairs. Remaining mismatches are then progressively repaired using rule-based rewriting, neural refinement, and reasoning-based refinement. We evaluate Echo on function-level benchmarks and the Mirai malware binary. Compared with the strongest baseline, Echo produces 2.43x more exact matches on average and achieves the highest structural similarity to ground-truth source code. On Mirai, Echo matches 2.75x and 7.4x as many functions as GPT-5.6 and Codex, respectively.

1 Introduction

Echo turns compilation into trusted feedback for searching, verifying, and refining decompilations. Its mismatches can guide source repairs while preserving regions that already match the target.

1 Introduction

  • Neural decompilations remain difficult to trust, while real-world matching decompilation for optimized binaries under unknown configurations remains underexplored.Behavioral tests are finite and often unavailable for real-world binaries, and semantic equivalence is undecidable in general.Source: §1 · pp. 1–2
  • Trusted back-translation treats deterministic compilation as feedback, comparing recompiled candidates with the target to iteratively select, refine, and verify source programs.Echo formulates neural decompilation as a search-based synthesis problem.Source: §1 · p. 2
  • 2.43× more exact assembly matches on average than the strongest baseline; Echo also achieves the highest source-level structural similarity and matches 2.75× and 7.4× as many Mirai functions as GPT-5.6 and Codex.The evaluations cover function-level benchmarks and the real-world Mirai binary.Source: §1 · p. 2

2 Motivation

  • Assembly mismatches can localize incorrect calls while leaving matching regions trustworthy, providing repair guidance and useful malware semantics even without a whole-function match.In the Mirai example, differences expose incorrect calls to func2 and func3.Source: §2 · p. 3, Figure 1 · p. 3

2.1 TBT-Enabled Decompilation Exploration

  • Top-p candidates are recompiled and compared; lower-mismatch candidates are retained, and the remaining difference locations guide targeted refinement toward an exact match.Echo jointly predicts source candidates and compilation configurations and measures assembly similarity.Source: §1 · p. 2, §2.1 · p. 3

2.2 Refinement Guided by Mismatch

  • Rule-based rewrites handle reliable patterns first, neural refinement uses assembly differences for harder repairs, and reasoning-based refinement derives source constants obscured by compiler arithmetic.The reasoning-based phase complements neural refinement when local patterns do not reliably reveal the repair.Source: §2.2 · p. 4

3 Overview

Echo frames matching decompilation as iterative search: generate source candidates, compile them back to assembly, and use the resulting similarity feedback to refine candidates toward exact matches.

3 Overview

  • The overview presents TBT-based decompilation as a search-based program-synthesis problem and introduces Echo as the system for solving it.Source: §3 · p. 4

3.1 TBT-based Decompilation Formulation

  • Trusted back-translation uses a probabilistic forward model to propose candidates and deterministic compilation to map them back for comparison with the target.The search seeks the candidate with the smallest distance; normalized edit distance ranges from 0 to 1, and an exact match has distance 0.Source: §3.1 · pp. 4–5

3.2 System Structure

  • Echo processes each function independently through neural decompilation and configuration synthesis, rule-based and neural refinement, then reasoning-based refinement for residual mismatches.Phase 1 produces ranked source–configuration candidates; later phases use assembly mismatches to guide further refinement.Source: §3.2 · p. 5

4 Neural Decompilation

Echo generates source and configuration candidates from assembly, trains its model on normalized program pairs, and searches configurations to improve assembly matches.

4.1 TBT-Based Candidate Generation

  • Candidate generation repeatedly predicts source code and a compilation configuration, recompiles candidates, and stops early on an exact match.Predicted configurations are projected into the valid search space, and inline-assembly candidates are dropped.Source: §4.1 · pp. 5–6

4.1.1 Training Methodology

  • The decompiler is trained by maximum likelihood on assembly–source pairs, with assembly and source normalized to reduce synthesis difficulty.The training set uses approximately 4 million compilable C programs compiled under sampled configurations.Source: §4.1.1 · p. 6
  • Input normalization preserves code-generation information while abstracting address-dependent artifacts; source normalization removes user-specific names and canonicalizes structured-data fields.Normalized programs are recompiled to verify that their normalized assembly remains unchanged.Source: §4.1.1 · pp. 6–7
  • The model jointly predicts source code and a serialized compilation configuration, which is decoded for recompilation during trusted back-translation.Source: Figure 5 · p. 6, §4.1.1 · p. 7

4.2 Configuration Synthesis

  • Configuration synthesis evolves promising configurations through crossover and mutation, then recompiles and reranks code candidates under the best configuration.Configuration fitness is the maximum assembly similarity across selected candidates.Source: §4.2 · p. 7

5 Mismatch-Guided Refinement

When initial candidates are not exact matches, Echo uses assembly-level differences to guide rule-based, neural, and reasoning-based repairs.

5 Mismatch-Guided Refinement

  • Echo interleaves rule-based and neural refinement over top-ranked candidates, then applies reasoning-based refinement to the highest-ranked candidates.Source: §5 · p. 7

5.1 Rule-Based Refinement

  • Rule-based refinement greedily accepts compilable mutations that lower edit distance, using branch, loop, and expression transformations.Expression mutations include changes to operand order, operators, literals, and signedness.Source: §5.1 · pp. 7–8

5.2 Neural Refinement

  • Neural refinement supplies the current candidate and a human-readable assembly difference to a model, then recompiles and ranks its updated candidate.Source: §5.2 · p. 8

5.2.1 Training Methodology

  • The refinement model is trained on approximately 3M records, excluding predictions that already produce exact assembly matches.Its input combines the current prediction with the assembly mismatch, and its output is normalized ground-truth code.Source: §5.2.1 · p. 8

5.3 Reasoning-Based Refinement

  • Reasoning-based refinement gives a general-purpose LLM the source prediction, remaining assembly mismatch, and complete target assembly for more complex repairs.To limit cost, the method uses a selection size and repeat count of 1 and at most five repair rounds.Source: §5.3 · p. 8

6 Evaluation Methodology

Section 6 evaluates Echo on three single-function benchmarks and the Mirai malware binary, against neural and LLM decompilation baselines. It measures exact assembly matches and behavioral equivalence across multiple compilation configurations.

6.1 Benchmark suites

  • The suite covers HumanEval, ExeBench, Synthesis, and Mirai, ranging from compact programs to functions from a real-world malware binary.For HumanEval and ExeBench, evaluation assembly sequences are checked against training data to prevent leakage; Table 1 characterizes the suites and defines NOI as number of instructions.Source: §6.1 · p. 8, Table 1 · p. 9

6.2 Baselines

  • Baselines include compact neural lifters and LLM workflows; LLM4Decompile also receives a matched inference-budget comparison, while SLaDE and ForkLift follow their original protocols.GPT-5.6 and GPT-5.6-Ghidra use the same general-purpose model, with the latter also using Ghidra pseudocode.Source: §6.2 · pp. 8–9

6.3 Evaluation Metrics

  • Exact-match rate compares normalized target and recompiled assembly; behavioral equivalence uses benchmark harnesses and is auxiliary because such harnesses are generally unavailable for real-world binaries.The normalization removes address- and layout-dependent artifacts while preserving code-generation information.Source: §6.3 · p. 9

6.4 Compilation and Execution Settings

  • Experiments cover GCC-12 at -O1, -O2, and -O3 and LLVM-14 at -O3; compilation configuration is assumed unknown unless specified, and Echo defaults to 100 queries in each phase.Baselines use a single query by default because additional independent queries lack mismatch feedback for improvement.Source: §6.4 · p. 9

7 Experimental Results

Across benchmark suites, Echo improves exact matching and behavioral equivalence over the evaluated baselines, while also achieving the highest CFG similarity. Refinement and convergence analyses show benefits from mismatch-guided feedback, and Mirai results demonstrate exact matches despite an unknown build configuration.

7.1 Exact Match Rates

  • Echo achieves 5.29×, 8.13×, 3.33×, 3.2×, 6.38×, and 2.43× more exact matches than SLaDE, ForkLift, LLM4Dec-v1.5, LLM4Dec-v2, GPT-5.6-Ghidra, and GPT-5.6, respectively.The evaluation covers GCC and LLVM compiler settings; external-LLM use improves Echo-Base's match rate by 1.05× on average.Source: §7.1 · p. 9, Figure 7 · p. 10

Behavioral equivalence rates as a function of edit distance

  • Behavioral-equivalence rates generally decline as assembly edit distance increases, especially below 0.2, but remain comparatively high at larger distances on Synthesis.HumanEval and ExeBench show lower rates at comparable distances; their curves reflect greater decompilation difficulty and larger search spaces.Source: Behavioral equivalence rates as a… · p. 10

7.2 Impact on Behavioral Equivalence

  • Echo achieves 3.98×, 4.31×, 2.14×, 1.81×, 1.2×, and 1.2× higher behavioral-equivalence rates than SLaDE, ForkLift, LLM4Dec-v1.5, LLM4Dec-v2, GPT-5.6-Ghidra, and GPT-5.6, respectively.Echo searches for source code and compilation configurations whose resulting assembly closely resembles the target.Source: §7.2 · p. 10, Figure 8 · p. 11

7.3 Source-Level Similarity

  • Echo achieves the highest CFG similarity among evaluated methods, while GPT-5.6 with Ghidra pseudocode has lower source-level similarity than GPT-5.6 alone.The paper attributes Echo's result to fewer assembly mismatches and recovery of structures closer to the original source.Source: Table 2 · p. 11, §7.3 · p. 11

7.4 Refinement Impact

  • Combining Phase 2 rule-based and neural refinement with Phase 3 reasoning-based refinement achieves better results than either phase alone.Phase 2 can miss repairs needing stronger reasoning; Phase 3 alone starts from suboptimal candidates and tends toward higher edit distances and lower exact-match rates.Source: Figure 10 · p. 11, §7.4 · p. 11

7.5 Convergence Behavior

  • Under a known configuration, Echo converges faster and reaches higher match rates than the compared neural decompilation baselines; normalization simplifies the input-output mapping.With unknown configurations, configuration synthesis and neural refinement consistently improve match rates across query allocations, and sufficient queries for both decompilation and refinement are important for best results.Source: §7.5 · pp. 11–12, Figure 11 · p. 12

7.6 Real-world Binary Application

  • On Mirai, Echo with Phase 3 exactly matches 35.5% of functions, 2.75× GPT-5.6's match rate under test-time scaling.Codex underperforms the direct LLM baseline in both match rate and edit distance.Source: Table 3 · p. 12, §7.6 · pp. 12–13
  • A gap remains between real-world binary decompilation and single-file benchmarks, and exact matching becomes harder for longer optimized programs.The paper identifies limited model capacity (1.3B parameters) as another limitation and leaves structured mismatch modeling and improved distance metrics to future work.Source: §7.6 · p. 13

8 Related Work

The related work reviews rule-based, neural, and matching decompilation. Echo distinguishes its approach by using back-translation mismatches as structural evidence for iterative refinement.

8.1 Rule-Based Decompilation

  • Traditional decompilers use hand-crafted analyses and transformations to produce readable pseudocode, rather than source that recompiles to identical assembly.The classic pipeline includes disassembly, intermediate-representation construction, data-flow analysis, control-flow structuring, and code generation.Source: §8.1 · p. 13

8.2 Neural Decompilation

  • Neural decompilation learns translation from low-level representations to source, with later work targeting optimized binaries, retargetability, neural lifting, and readability.LLM4Decompile [44] trains on paired source and assembly data, while Decompile-Bench provides a large-scale benchmark.Source: §8.2 · p. 13

8.3 Matching Decompilation

  • Echo treats discrepancies between candidate and target assemblies as structural evidence of unresolved code, rather than only as a binary correctness signal.This reframes matching decompilation as iterative reduction of semantic uncertainty.Source: §8.3 · p. 13

9 Conclusion

Echo uses trusted back-translation as structural feedback to iteratively refine decompilation toward exact matches. It outperforms the strongest baseline across function-level benchmarks and compiler settings, and reports results on Mirai.

9 Conclusion

  • Echo uses trusted back-translation as structural feedback to iteratively refine decompilation results toward exact matches.The conclusion describes TBT as a practical and useful system mechanism for matching decompilation.Source: §9 · p. 13
  • 2.43× more exact matches than the strongest baseline on average across function-level benchmarks and compiler settings, with the highest source-level structural similarity.On Mirai, Echo matches 2.75× and 7.4× as many functions as GPT-5.6 and Codex, respectively.Source: §9 · p. 13
  • On Mirai, Echo is the first neural decompilation approach reported to provide explicit correctness guarantees for decompiled malware functions.The conclusion reports 2.75× and 7.4× as many matched functions as GPT-5.6 and Codex, respectively.Source: §9 · p. 13

Ethical Considerations

The paper frames Echo as a research tool for program understanding and defensive security analysis, while acknowledging potential misuse and describing the scope of its evaluation and capabilities.

Ethical Considerations

  • Echo is designed and evaluated primarily as a research tool for program understanding and defensive security analysis, despite decompilation's dual-use potential.The paper names vulnerability analysis, malware understanding, software auditing, and incident response as legitimate uses, while noting risks to proprietary or malicious software.Source: Ethical Considerations · p. 14
  • The Mirai case study analyzes an existing binary in an isolated environment without external execution, deployment, or contact with live command-and-control infrastructure.The evaluation measures source-level recovery and compilation-level similarity.Source: Ethical Considerations · p. 14
  • Echo adds no exploitation, persistence, evasion, or operational malware capabilities, though the paper acknowledges possible misuse for reverse engineering and malware development.The authors state that the system does not discover targets, launch attacks, or automate exploitation.Source: Ethical Considerations · p. 14

Open Science

The paper provides artifacts and documentation for running Echo and reproducing its experiments, and describes the compiler-version search space.

Open Science

  • The artifact repository provides Echo's implementation, experiment scripts, configuration files, evaluation scripts, and reproduction instructions.It also hosts the trained model links and exact checkpoints, plus a quick-start workflow for lightweight validation.Source: Open Science · p. 14
  • Full evaluation scripts cover all three benchmarks; the reported run on one A30 GPU may take approximately three hours.The experiments used a machine with eight NVIDIA A30 GPUs, and scripts support parallel execution across GPUs.Source: Open Science · p. 14

A Compiler and Configuration Search Space

B Mutation rules

The appendix identifies the compiler-flag configurations included in the search space and the source-level mutation rules used by the synthesizer.

Mutation rules

Search space

  • Table 5 lists compiler-flag configurations in the search space, which users can extend without retraining the model.Source: Table 5 · p. 15

C Mismatch Patterns

The examples show that matching decompilation can diverge through register and stack layout, loop control, data types, global-object sizes, data flow, or external-symbol recovery. Some differences may not change program behavior, while others reflect different operations or value propagation.

1. Register allocation mismatch

  • Different register-allocation decisions can use different registers for the same intermediate value and need not indicate a semantic difference.The example contrasts %r14d with %r13d; such allocation differences can result from other mismatches.Source: C Mismatch Patterns · pp. 15–16

2. Stack frame layout mismatch

  • Different register allocation or local-variable layouts can change saved registers and stack space, as the example grows the frame from 2080 to 2088 bytes.Source: C Mismatch Patterns · p. 16

3. Loop control mismatch

  • A different induction variable or termination condition can produce a different loop update and branch structure.The example contrasts the target's explicit increment and termination check with the recompiled assembly's different value flow and block layout.Source: C Mismatch Patterns · p. 16

4. Data type mismatch

  • Recovered data types can change the width of an operation: the example shifts a 32-bit value instead of the target's low 8 bits.The passage says the difference is likely caused by recovering the source-level value with a different integer type.Source: C Mismatch Patterns · p. 16

5. Global object size mismatch

  • Recovered global variables can have different storage sizes even when the accessed portion is consistent, affecting exact matching without necessarily changing behavior.The recompiled binary allocates larger regions for two global objects; extra storage may not affect behavior if never accessed.Source: C Mismatch Patterns · p. 16

7. Data-flow mismatch

  • Incorrect data-flow recovery can change assignments even when similar operations are present, as the clock return value and accumulated XOR result are stored differently.The target stores the clock return value in DATA_3 and the accumulated XOR result in DATA_4.Source: C Mismatch Patterns · p. 16

7. External symbol and indirect-call mismatch

  • Failure to recover linkage-related symbols absent from training data can turn an indirect weak-symbol call into a direct function call and unrelated memory update.The target checks whether __gmon_start__ is available before invoking it indirectly.Source: C Mismatch Patterns · pp. 16–17
Loading 2609.18706v1…