PaperlayerView exact revision on arXiv

Source-linked AI summary

ASAP: Assembly-Source Aligned Pseudocode Refinement For Binary Decompilation

Yujian Zhuang, Dehong Gao, Qichao Zhang, Qijing Lai, Jiaxin Wang, Libin Yang, Xiaoyan Cai

arXiv:2610.06900v1cs.PLcs.CRcs.SE

TL;DR

Decompiler pseudocode is a useful but lossy abstraction that can hide errors, particularly in optimized binaries. ASAP aligns assembly representations with source code and adds compressed assembly tokens to pseudocode refinement. Across two benchmarks, it reports higher average re-execution and recompilation rates than the strongest baseline.

  • Problem

    Decompiler-produced pseudocode can conceal semantic errors, including incorrect signedness that causes plausible output to fail on negative inputs.

    Source: §1 · pp. 1–2

  • Method

    ASAP aligns assembly and source representations, then uses compressed assembly features alongside pseudocode to guide refinement.

    Source: §1 · p. 2, §3.1 · p. 4, §3.1.3 · p. 5

  • Results

    71.9% average re-execution rate and 96.6% average recompilation rate, compared with 64.7% and 91.6%, respectively, for the strongest baseline.

    Source: §1 · p. 3

  • Takeaways & Limitations

    ASAP targets functional recovery and recompilability, while assembly supplies corrective evidence for biased or incomplete pseudocode hypotheses.

    Source: §1 · p. 2, §5 · p. 9

    ASAP does not include a dedicated module for recovering human-written identifiers or comments, limiting its direct focus on readability.

    Source: C Limitations and Future Work · p. 16

Abstract

from arXiv · show

Large language models (LLMs) are increasingly used in binary decompilation to refine the C-like pseudocode produced by traditional rule-based decompilers. While this pseudocode is useful, it is a heuristic and lossy abstraction rather than a faithful copy of the source code. It often contains decompiler errors, especially for aggressively optimized binaries where critical low-level details are obscured. We present ASAP, an assembly-source aligned pseudocode refinement framework for binary decompilation. ASAP learns source-aligned assembly representations from paired source and binary functions using joint function-level and snippet-level contrastive alignment. A Q-Former then compresses chunk-level assembly features into a fixed number of assembly tokens that condition the decompilation LLM alongside the decompiler-produced pseudocode. During refinement, we use stochastic pseudocode masking and a relative assembly-advantage loss to reduce the model's tendency to ignore assembly features and rely only on pseudocode refining. On two decompilation benchmarks across multiple compiler optimization levels, ASAP improves the average re-execution rate from 64.7% to 71.9% and the average recompilation rate from 91.6% to 96.6% compared with the strongest baseline, offering both a new perspective and a practical solution to binary decompilation.

1 Introduction

Binary decompilation seeks useful, recompilable, functionally equivalent code rather than exact source recovery, but decompiler pseudocode can conceal semantic errors. ASAP adds compact source-aligned assembly evidence to pseudocode refinement, and reports higher average re-execution and recompilation rates than the strongest baseline.

1 Introduction

  • Decompiler pseudocode is readable but heuristic and lossy, so errors such as incorrect signedness can make plausible output fail on negative inputs.The practical goal is typically recompilable, functionally equivalent code readable enough for human review, not exact reconstruction.Source: §1 · pp. 1–2
  • Pseudocode refinement can preserve wrong abstractions, while direct assembly-to-source translation faces long sequences and a syntax gap with source-oriented LLM training data.Pseudocode and assembly provide complementary high-level hypotheses and low-level operational evidence, but models may under-attend to assembly.Source: §1 · p. 2
  • ASAP retains pseudocode as the generation interface and adds compact learned assembly representations aligned to source through function- and snippet-level alignment.Query-based compression produces fixed-size assembly tokens; stochastic pseudocode masking and a detached relative assembly-advantage loss encourage use of assembly evidence when pseudocode is incomplete or unreliable.Source: §1 · pp. 2–3
  • 71.9% average re-execution rate and 96.6% average recompilation rate, up from 64.7% and 91.6%, respectively, versus the strongest baseline.The evaluation covers HumanEval and MBPP across optimization levels O0–O3.Source: §1 · p. 3

2 Related Work

Prior refinement methods exploit pseudocode’s recovered structure but can preserve its errors, while direct assembly translation must contend with long sequences and a syntax mismatch. ASAP keeps pseudocode refinement central and uses compact assembly tokens as corrective evidence.

2.1 Pseudocode-Based Refinement

  • Pseudocode refinement benefits from high-level structure but may preserve decompiler artifacts such as incorrect signedness, pointer arithmetic, and optimized control-flow idioms.ASAP builds on this paradigm by adding compact assembly representations for low-level evidence missing from pseudocode.Source: §2.1 · p. 3

2.2 End-to-End Assembly Translation

  • Direct assembly-to-source methods address long assembly sequences with approaches including hierarchical attention, contrastive learning, and pretrained assembly encoders.DECodeT5 integrates a pretrained assembly encoder but conditions generation primarily on assembly rather than decompiler-produced pseudocode.Source: §2.2 · p. 3
  • ASAP instead retains pseudocode refinement and compresses source-aligned assembly features into fixed-size tokens as targeted corrective evidence, not standalone decompilation input.Its two-stage pipeline aligns assembly with source representations, then uses a Q-Former and pseudocode masking plus an assembly-advantage objective during refinement.Source: §2.2 · p. 3, Figure 2 · p. 4

3 Method

ASAP aligns assembly representations with source code, then compresses assembly evidence into tokens that condition an LLM refining decompiler pseudocode. Its training combines pseudocode masking with an objective that encourages assembly-conditioned improvements.

3.1 Assembly-Source Alignment (ASA)

  • ASAP first aligns assembly and source representations, then uses assembly-augmented refinement to recover source code from pseudocode and assembly evidence.The source encoder is held frozen as a stable alignment target, and the assembly encoder is frozen after alignment for refinement.Source: §3 · p. 4, §3.1 · p. 4

3.1.1 Chunked Assembly Encoding

  • Instruction-boundary chunks preserve local assembly evidence, while a light Transformer summarizes chunk sequences when function-level alignment needs a global embedding.During refinement, ASAP uses the chunk-level features and discards the light encoder.Source: §3.1.1 · pp. 4–5

3.1.2 Function-level Alignment

  • Function-level multi-positive contrastive learning aligns assembly with source and treats binaries compiled from the same source as positives across optimization levels.This reduces false negatives from different optimization views of the same source.Source: §3.1.2 · p. 5

3.1.3 Snippet-level Alignment

  • Snippet-level alignment uses debug-information line mappings as weak positives to teach local source-relevant cues, then combines its loss with function-level alignment.Optimization can move, merge, duplicate, or remove source statements, so the mappings are not treated as exact correspondences; the metadata is not exposed to the decompilation LLM.Source: §3.1.3 · p. 5

3.2 Assembly-Augmented Refinement (AAR)

  • In refinement, the Q-Former compresses chunk-level assembly features into a fixed number of assembly tokens that accompany pseudocode as input to the LLM.The assembly encoder is frozen during this phase, and the Q-Former and decompilation LLM are optimized.Source: §3.2 · p. 5, §3.2.1 · pp. 5–6

3.2.1 Assembly Feature Compression

  • The Q-Former uses learnable queries over chunk-level assembly features and projects its outputs into the LLM embedding space, avoiding direct textual concatenation of long assembly.The resulting assembly tokens are prepended to pseudocode; their fixed count trades strict completeness for usability and prioritizes evidence useful for correcting the pseudocode hypothesis.Source: §3.2.1 · pp. 5–6

3.2.2 Pseudocode Masking

  • Stochastic masking hides a sampled fraction of non-structural pseudocode tokens while preserving structural tokens, encouraging reliance on assembly evidence for local details.Masking cannot by itself guarantee correction of an incorrect control-flow structure.Source: §3.2.2 · p. 6

3.2.3 Assembly Advantage Objective

  • The assembly-advantage objective penalizes cases where assembly-conditioned generation fails to beat a matched pseudocode-only reference by a relative margin.The reference uses zero assembly tokens and detached loss; the margin uses token-normalized losses, with a scale clamp to limit gradient instability.Source: §3.2.3 · pp. 6–7

4 Experiments

Across two benchmark adaptations and four optimization levels, ASAP improves functional and syntactic recovery over the base decompilation LLM. Downstream evaluations and ablations examine the usefulness of its outputs and the contributions of alignment and refinement components.

4.1 Settings

  • Experiments train on 100K ExeBench C functions and evaluate HumanEval and MBPP adaptations compiled with GCC 11.4.0 for x86_64 at O0–O3.Metrics are re-execution, recompilation, edit similarity, and GPT-Judge; baselines include rule-based decompilers, task-agnostic LLMs, and decompilation methods.Source: §4.1 · p. 7

4.2 Main Results

  • Re-execution rises from 62.0% to 71.9% and recompilation from 85.5% to 96.6% over LLM4Decompile-9B; ASAP outperforms other baselines on both rates.ASAP is slightly lower than SK2Decompile on GPT-Judge, which the authors attribute to SK2Decompile’s identifier-naming component; Gemini-3.1-flash leads on GPT-Judge but underperforms decompilation methods in edit similarity.Source: Table 1 · p. 7, §4.2 · p. 8
  • ASAP achieves the best average downstream performance on two of three LLMs and leads on Signature Recovery across all baseline LLMs.Gemini-3.1-flash benefits Binary Code Summarization, while Algorithm Classification leadership varies by downstream LLM.Source: Table 2 · p. 8, §4.2 · p. 8

4.3 Ablation Study

  • Raw-Asm and w/o CL have similar average re-execution rates (67.71%, 67.34%), as do w/o SLA and w/o FLA (69.03%, 68.88%).Removing either alignment granularity weakens semantic usefulness, while recompilation remains close to ASAP for w/o SLA and w/o FLA.Source: §4.3 · pp. 8–9
  • Freezing the LLM yields the largest AAR ablation drop (63.82% average re-execution); w/o AAO is next, while w/o AFC hurts more at O1/O2 and w/o PM degrades uniformly.With the LLM frozen, the assembly–LLM interface cannot adapt to the continuous Q-Former outputs.Source: §4.3 · p. 9
  • The hyperparameter analysis examines assembly-token count K, maximum pseudocode masking ratio ρmax, and relative improvement ratio γ.Experimental results and analysis are provided in Appendix B.1.Source: §4.3 · p. 9

5 Conclusion

ASAP augments pseudocode refinement with source-aligned assembly evidence compressed into a fixed number of tokens. Results across optimization levels show improved re-execution and recompilation rates, while future work targets obfuscated binaries and multiple instruction-set architectures.

5 Conclusion

  • ASAP combines source-aligned assembly tokens with pseudocode masking and an assembly-advantage objective, and outperforms existing methods in re-execution and recompilation across optimization levels.The authors identify obfuscated binaries and support for multiple instruction-set architectures as future work.Source: §5 · p. 9

A.1 Optimization Settings

The appendix reports optimization settings for assembly-source alignment and assembly-augmented refinement, then provides prompt templates for refinement and code extraction.

A.1 Optimization Settings

  • Assembly-source alignment uses UniXcoder-initialized encoders, a two-layer Transformer light encoder, and 64 chunks capped at 256 subword tokens.PatchDropout drops 50% of assembly chunks; trainable modules are optimized for one epoch with AdamW at 1 × 10^-5 and a cosine schedule.Source: §A.1 · p. 14
  • Assembly-augmented refinement uses the default LAVIS Q-Former configuration and applies LoRA only to the decompilation LLM.LoRA rank is 16 and alpha is 32; trainable modules are optimized for one epoch with AdamW at 2 × 10^-5 and a cosine schedule.Source: §A.1 · p. 14

A.2 Prompt Templates

  • The refinement prompt asks for source code from decompiled code, while the extractor selects a complete C function and returns it in function tags.If no named function is found, the extractor selects the last complete function; if no complete function exists, it returns partial code when available.Source: §A.2 · p. 14

B.1 Hyperparameters Analysis

The hyperparameter analysis finds the default configuration performs best overall, while showing that assembly-token count does not yield monotonic gains and pseudocode masking should remain mild. It varies each parameter around fixed defaults.

B.1 Hyperparameters Analysis

  • The analysis varies K, ρmax, and γ one at a time around defaults K = 32, ρmax = 0.1, and γ = 0.1.Tested values are K ∈ {8, 16, 64}, ρmax ∈ {0.3, 0.5, 0.8}, and γ ∈ {0.3, 0.5, 0.8}.Source: §B.1 · p. 14, Table 4 · p. 15
  • K = 8, 16, and 64 yield close average re-execution rates, with no monotonic gain as assembly-token count increases.K = 64 is slightly stronger than w/o CL; it reduces compression pressure when the number of assembly chunks is 64 and adds Q-Former aggregation.Source: §B.1 · pp. 14–15
  • The default setting (K, ρmax, γ) = (32, 0.1, 0.1) performs best overall; larger masking reduces re-execution, especially at ρmax = 0.8.Among tested γ values, 0.5 gives the best re-execution, while 0.8 slightly improves recompilation but lowers re-execution.Source: §B.1 · p. 15

B.2 Attention Bias Analysis

The attention-bias analysis tests whether the model functionally uses assembly tokens by intervening on assembly and pseudocode inputs. Corrupting assembly substantially reduces performance, while performance remains competitive when pseudocode is masked.

B.2 Attention Bias Analysis

  • The four inference conditions compare correct inputs, zeroed or shuffled assembly tokens, and correct assembly tokens with pseudocode stochastically masked at ρmax = 0.1.The selected masking ratio avoids making the inference condition assembly-dominant.Source: §B.2 · p. 15
  • The intervention evaluates assembly utility through performance drops after assembly corruption, with negligible drops indicating possible pseudocode attention bias.Substantial drops under Zero-Asm and Shuffled-Asm indicate functional dependence on assembly evidence.Source: §B.2 · p. 15
  • Average re-execution drops by 7.5% with Zero-Asm and 11.2% with Shuffled-Asm; Masked-Pseudo retains a 70.7% average re-execution rate.The assembly-corruption drops occur across all optimization levels.Source: Table 5 · p. 15, §B.2 · p. 16

C Limitations and Future Work

The paper identifies limits in functional-equivalence verification, readability recovery, and model scale. It frames test-based re-execution as empirical evidence rather than proof and leaves identifier, type, and comment recovery and frontier-scale training for future work.

C Limitations and Future Work

  • Test-based re-execution is strong empirical evidence of functional equivalence, not a proof, because arbitrary-program equivalence is undecidable.The paper suggests integrating faster and more robust equivalence-checking techniques for stronger validation.Source: C Limitations and Future Work · p. 16
  • ASAP targets functional recovery and recompilability but has no dedicated module for recovering human-written identifiers or comments.Identifier, type, and comment recovery are described as an orthogonal direction for improving human usability.Source: C Limitations and Future Work · p. 16
  • Resource constraints prevented exhaustive training on frontier-scale LLMs, so the reported results validate the framework principle rather than saturating its upper bound.The authors expect fixed assembly-token representations and model-agnostic objectives to complement larger LLMs.Source: C Limitations and Future Work · p. 16

Related papers

Loading 2610.06900v1…