使用基于锚点的检索和大语言模型推理从二进制函数中进行实用的源代码恢复
Practical Source Code Recovery from Binary Functions Using Anchor-Based Retrieval and LLM Reasoning
- McGill University（麦吉尔大学）
- Defence Research and Development Canada（国防研究与发展加拿大）
机构由 AI 辅助整理，请以论文原文为准。
AI总结：
研究如何从二进制函数恢复源代码，结合逆向工程、基于锚点检索和大语言模型推理，在基于高保真数据库对tcpdump二进制文件评估中，匹配方法实现95.2%汇编指令覆盖率，在GitHub数据库实验中平均覆盖率35.5%。
AI中文摘要：
我们提出了一种实用的管道，通过结合逆向工程、基于锚点的源代码检索和大语言模型推理，从剥离的二进制函数中恢复源代码。我们的二进制到源代码的检索方法试图从源代码数据库中识别源函数，而不是生成近似反编译的伪代码。它使用Ghidra提取诸如字符串、常量、外部调用和可用函数名等锚点，通过倒排索引搜索数据库检索候选文件，将候选范围缩小到可能的函数片段，并基于反汇编、反编译代码和源元数据用大语言模型对它们重新排序。在我们基于高保真源代码数据库对剥离、优化的tcpdump二进制文件的评估中，我们提出的二进制到源匹配方法实现了95.2%的汇编指令覆盖率。在基于GitHub的检索数据库上的实验显示平均指令覆盖率较低，为35.5%，主要是由于检索未命中。这些结果表明，源级二进制恢复在高质量数据库中表现出色，并且在嘈杂环境中仍然是一个有用的工具。
英文摘要：
We present a practical pipeline for recovering source code from stripped binary functions by combining reverse engineering, anchor-based source code retrieval, and large language model reasoning. Our binary-to-source-code retrieval method attempts to identify the source function from a source code database, rather than generating approximate decompiled pseudocode. It extracts anchors such as strings, constants, external calls, and available function names using Ghidra, retrieves candidate files via an inverted-index search database, narrows candidates to likely function snippets, and re-ranks them with a large language model (LLM) based on disassembly, decompiled code, and source metadata. Confident matches can also serve as anchors in later passes. In an evaluation backed by our high-fidelity source code database on a stripped, optimized tcpdump binary, our proposed binary-to-source matching method achieves 95.2% assembly instruction coverage. Experiments on a GitHub-based retrieval database showed lower performance with 35.5% instruction coverage on average, mainly due to retrieval misses. These results show that source-level binary recovery excels with high-quality databases and remains a useful tool in noisy environments.
