New Framework Tackles Binary Decompilation Under Optimization and Obfuscation

Turning compiled binaries back into understandable source code—a process called decompilation—is crucial for security researchers hunting vulnerabilities. Yet production software presents a tough challenge: compiler optimizations and intentional code obfuscation scramble control flows, hide variable meanings, and obscure the original logic so thoroughly that current language models often generate structurally broken or semantically nonsensical output.

The Problem with Current Approaches#

Existing LLM-based decompilation tools like DeGPT, LLM4Decompile, and FidelityGPT frequently stumble when faced with aggressive transformations. They struggle with flattened control structures and tend to fabricate program logic rather than faithfully recover what the binary actually does—a failure mode researchers call "semantic hallucination."

How ReSource Works#

Researchers have introduced ReSource, a new framework that breaks the decompilation challenge into three independent recovery stages: lexical (token meanings), syntactic (code structure), and semantic (program logic). This decoupling approach tackles each problem separately rather than asking the LLM to solve everything at once.

The system works in phases:

• Grounding with empirical knowledge: It consults a curated Semantic Distortion Database to anchor the LLM's reasoning in real patterns, preventing logic drift
• Structural reconstruction: A lightweight predictor undoes control-flow flattening to rebuild the high-level program skeleton that source code would have
• Lexical refinement: A contextual deduction stage restores readable variable and function names

Measured Performance#

Testing on a dataset spanning over 80,000 decompiled function pairs—across three optimization levels and four obfuscation techniques—ReSource achieved 83% top-5 source code retrieval accuracy and an average similarity score of 0.66. Critically, it maintained robust semantic accuracy where competing baselines either overfitted or degraded significantly under transformation pressure.