arXivDaily arXiv每日学术速递 周一至周五更新
arXiv 2604.23940cs.SEcs.AI
收藏

基于约束的多智能体反编译用于可执行二进制恢复

Constraint-Guided Multi-Agent Decompilation for Executable Binary Recovery

Vanderbilt University(范德比大学)

Yifan Zhang, Xiaohan Wang, Yueke Zhang, Yu Huang, Kevin Leach

AI总结:

本文提出一种多智能体框架,通过多级约束引导反编译(MCGD)将反编译代码转换为可执行源代码,提升反编译结果的可执行性与正确性。

摘要:

反编译——从编译二进制中恢复源代码——对于安全分析、恶意软件逆向工程和遗留软件维护至关重要。然而,现有反编译器生成的代码往往无法正确编译或执行,限制了其实际应用。我们提出了一种多智能体框架,通过多级约束引导反编译(MCGD)将反编译代码转换为可执行源代码。我们的方法采用三级约束验证流程:(1)通过解析实现语法正确性,(2)通过GCC实现可编译性,(3)通过LLM生成的测试用例实现行为等价性。当验证失败时,专用的LLM智能体通过结构化错误反馈迭代优化代码。我们在ExeBench上的1641个真实二进制上评估了该框架,针对RetDec、Ghidra和Angr三种反编译器。我们的框架实现了84-97%的可执行性,比基线反编译器输出提升了28-89个百分点。与使用相同GPT-4o背骨的最先进LLM反编译方法相比,我们的方法(84.1%)优于LLM4Decompile(80.3%)、SK2Decompile(73.9%)和SALT4Decompile(61.8%)。我们的消融研究揭示了执行基于验证的重要性:仅编译的approaches尽管达到91-99%的编译率,但行为正确性为0%。系统收敛效率高,90%以上的二进制在2次迭代内达到正确性,平均成本为每份二进制0.03-0.05美元。我们的结果表明,约束引导的智能体优化可以弥合原始反编译输出与实际有用的源代码之间的差距。

英文摘要:

Decompilation -- recovering source code from compiled binaries -- is essential for security analysis, malware reverse engineering, and legacy software maintenance. However, existing decompilers produce code that often fails to compile or execute correctly, limiting their practical utility. We present a multi-agent framework that transforms decompiled code into re-executable source through Multi-level Constraint-Guided Decompilation (MCGD). Our approach employs a hierarchical validation pipeline with three constraint levels: (1) syntactic correctness via parsing, (2) compilability via GCC, and (3) behavioral equivalence via LLM-generated test cases. When validation fails, specialized LLM agents iteratively refine the code using structured error feedback. We evaluate our framework on 1,641 real-world binaries from ExeBench across three decompilers (RetDec, Ghidra, and Angr). Our framework achieves 84-97% re-executability, improving baseline decompiler output by 28-89 percentage points. In comparison with state-of-the-art LLM-based decompilation methods using the same GPT-4o backbone, our approach (84.1%) outperforms LLM4Decompile (80.3%), SK2Decompile (73.9%), and SALT4Decompile (61.8%). Our ablation study reveals that execution-based validation is critical: compile-only approaches achieve 0% behavioral correctness despite 91-99% compilation rates. The system converges efficiently, with 90%+ binaries reaching correctness within 2 iterations at an average cost of $0.03-0.05 per binary. Our results demonstrate that constraint-guided agentic refinement can bridge the gap between raw decompiler output and practically useful source code.

机构、总结、中文摘要均由AI分析而来,可能存在错误,请以论文正文为准。

↑