New approach uses runtime behavior to reconstruct readable code from heavily obfuscated binaries

Binary deobfuscation—the process of making compiled, scrambled code legible again—is essential for security research and reverse engineering work. Yet most existing solutions focus on the easier case of untangling source code, while the harder problem of working directly with compiled binaries has remained largely neglected, particularly in real-world scenarios where the original source is no longer available.

The structural transformation problem#

Traditional binary deobfuscation methods typically follow a familiar playbook: convert the binary back into pseudocode, then apply structural rewrites to clean it up. But this approach has a fundamental weakness. When source code gets compiled, the compiler throws away much of the high-level information—type details, function structure, variable names—that humans rely on for understanding. This semantic loss means that decompilation produces poor-quality output, and more critically, offers little guarantee that the reconstructed code will actually behave the same way as the original when run.

A behavior-first paradigm#

Researchers behind BinMirror, detailed in a paper submitted to arXiv, propose flipping the problem on its head. The key observation is simple but powerful: obfuscation may mangle a program's internal appearance, but any valid deobfuscation must preserve what the program actually does when executed. Rather than trying to reverse-engineer structure, BinMirror watches the obfuscated binary in action—recording execution traces and capturing system interactions—and uses those observations as a specification for generating fresh, clean source code.

Validation through testing#

The method synthesizes candidate source code guided by these behavioral specifications, then validates each candidate against the real runtime behavior recorded from the obfuscated original. This creates a tight feedback loop: if the synthesized code doesn't match what was observed, it's rejected.

Demonstrated results#

Testing on 1.5 million synthetically obfuscated binaries showed BinMirror substantially outperforming existing state-of-the-art techniques. Under extreme obfuscation, the approach achieved a unit-test pass rate (Pass@1) of 74.5%, demonstrating practical viability for real-world security analysis and reverse engineering tasks.