2025/09/18 by Yongpan Wang, Xin Xu, Wang, Yongpan +7 · 1 voice · 2 citations
Computer Science · #Advanced Malware Detection Techniques #FOS: Computer and information sciences #Programming Languages (cs.PL) #Security and Verification in Computing #Software Engineering (cs.SE) #Software Testing and Debugging Techniques #cs.PL #cs.SE
paper · pdf · doi:10.48550/arxiv.2509.14646
openalex publication_date 2025/09/18 · arxiv published 2025/09/18 · arxiv updated 2025/09/18 · openalex created_date 2025/10/10 · openalex updated_date 2026/07/28
Decompilation is widely used in reverse engineering to recover high-level language code from binary executables. While recent approaches leveraging Large Language Models (LLMs) have shown promising progress, they typically treat assembly code as a linear sequence of instructions, overlooking arbitrary jump patterns and isolated data segments inherent to binary files. This limitation significantly hinders their ability to correctly infer source code semantics from assembly code. To address this limitation, we propose \saltm, a novel binary decompilation method that abstracts stable logical features shared between binary and source code. The core idea of \saltm is to abstract selected binary-level operations, such as specific jumps, into a high-level logic framework that better guides LLMs in semantic recovery. Given a binary function, \saltm constructs a Source-level Abstract Logic Tree (\salt) from assembly code to approximate the logic structure of high-level language. It then fine-tunes an LLM using the reconstructed \salt to generate decompiled code. Finally, the output is refined through error correction and symbol recovery to improve readability and correctness. We compare \saltm to three categories of baselines (general-purpose LLMs, commercial decompilers, and decompilation methods) using three well-known datasets (Decompile-Eval, MBPP, Exebench). Our experimental results demonstrate that \saltm is highly effective in recovering the logic of the source code, significantly outperforming state-of-the-art methods (e.g., 70.4% TCP rate on Decompile-Eval with a 10.6% improvement). The results further validate its robustness against four commonly used obfuscation techniques. Additionally, analyses of real-world software and a user study confirm that our decompiled output offers superior assistance to human analysts in comprehending binary functions.