paper-with-me

홈 › Papers

LLM4Decompile: Decompiling Binary Code with Large Language Models

2024-03-08 · Hanzhuo Tan, Qi Luo, Jing Li, Yuqun Zhang

Decompilation aims to convert binary code to high-level source code, but traditional tools like Ghidra often produce results that are difficult to read and execute. Motivated by the advancements in Large Language Models (LLMs), we propose LLM4Decompile, the first and largest open-source LLM series (1.3B to 33B) trained to decompile binary code. We optimize the LLM training process and introduce the LLM4Decompile-End models to decompile binary directly. The resulting models significantly outperform GPT-4o and Ghidra on the HumanEval and ExeBench benchmarks by over 100% in terms of re-executability rate. Additionally, we improve the standard refinement approach to fine-tune the LLM4Decompile-Ref models, enabling them to effectively refine the decompiled code from Ghidra and achieve a further 16.2% improvement over the LLM4Decompile-End. LLM4Decompile demonstrates the potential of LLMs to revolutionize binary code decompilation, delivering remarkable improvements in readability and executability while complementing conventional tools for optimal results. Our code, dataset, and models are released at https://github.com/albertan017/LLM4Decompile

📄 PDF Abstract BibTeX arXiv:2403.05286

Code (1)

albertan017/LLM4Decompile 공식 구현 pytorch

Tasks

HumanEval

Methods 이 논문이 사용한 방법론

Attention 설명 없음
Linear Layer A Linear Layer is a projection $\mathbf{XW + b}$.
Dropout Dropout is a regularization technique for neural networks that drops a unit (along with connections) at training time with a specified probability $p$ (a common value is…
Multi-Head Attention 설명 없음
Position-Wise Feed-Forward Layer 설명 없음
Layer Normalization Unlike batch normalization, Layer Normalization directly estimates the normalization statistics from the summed inputs…
Absolute Position Encodings Absolute Position Encodings are a type of position embeddings for [Transformer-based models] where positional encodings are…
Softmax The Softmax output function transforms a previous layer's output into a vector of probabilities. It is commonly used for multiclass classification. Given an input vector $x$…

Similar Papers 제목 키워드 기반

DIRECT : A Transformer-based Model for Decompiled Identifier Renaming

2021-08-01 · ACL (NLP4Prog) 2021 8 · Vikram Nitin, Anthony Saieva, Baishakhi Ray, Gail Kaiser

Decompiling binary executables to high-level code is an important step in reverse engineering scenarios, such as malware analysis and legacy code maintenance. However, the generated high-level code is difficult to unders…

Malware Analysis

N-Bref : A High-fidelity Decompiler Exploiting Programming Structures

2021-01-01 · Cheng Fu, Kunlin Yang, Xinyun Chen, Yuandong Tian 외

In software development, decompilation aims to reverse engineer binary executables. With the success of neural machine translation (NMT), recent efforts on neural-based decompiler show promising results compared to tradi…

Code GenerationDecoderMachine TranslationNMT+1

Can Neural Decompilation Assist Vulnerability Prediction on Binary Code?

2024-12-10 · D. Cotroneo, F. C. Grasso, R. Natella, V. Orbinato

Vulnerability prediction is valuable in identifying security issues efficiently, even though it requires the source code of the target software system, which is a restrictive hypothesis. This paper presents an experiment…

Prediction

NeuroDeX: Unlocking Diverse Support in Decompiling Deep Neural Network Executables

2025-09-08 · Yilin Li, Guozhu Meng, Mingyang Sun, Yanzhong Wang 외 arxiv

On-device deep learning models have extensive real world demands. Deep learning compilers efficiently compile models into executables for deployment on edge devices, but these executables may face the threat of reverse e…

Enhancing Reverse Engineering: Investigating and Benchmarking Large Language Models for Vulnerability Analysis in Decompiled Binaries

2024-11-07 · Dylan Manuel, Nafis Tanveer Islam, Joseph Khoury, Ana Nunez 외

Security experts reverse engineer (decompile) binary code to identify critical security vulnerabilities. The limited access to source code in vital systems - such as firmware, drivers, and proprietary software used in Cr…

Benchmarking