发表机构
School of Cybersecurity, Northwestern Polytechnical University; School of Automation, Northwestern Polytechnical University(西北工业大学网络安全学院; 西北工业大学自动化学院)
机构由 AI 辅助整理,请以论文原文为准。AI 中文总结
ASAP通过汇编-源码对齐表示和Q-Former压缩汇编特征,结合随机伪代码掩蔽与相对汇编优势损失,精炼反编译伪代码,在基准上将重新执行率提升至71.9%,重新编译率提升至96.6%。
AI 中文摘要
大型语言模型(LLMs)越来越多地被用于二进制反编译,以精炼传统基于规则的反编译器生成的类C伪代码。虽然这种伪代码有用,但它是一种启发式且有损的抽象,而非源代码的忠实副本。它常常包含反编译器错误,尤其是对于经过激进优化的二进制文件,其中关键的低级细节被掩盖。我们提出ASAP,一个面向二进制反编译的汇编-源码对齐伪代码精炼框架。ASAP通过联合函数级和片段级对比对齐,从配对的源码和二进制函数中学习源码对齐的汇编表示。然后,一个Q-Former将块级汇编特征压缩为固定数量的汇编标记,这些标记与反编译器生成的伪代码一起条件化反编译LLM。在精炼过程中,我们使用随机伪代码掩蔽和相对汇编优势损失,以减少模型忽略汇编特征而仅依赖伪代码精炼的倾向。在两个跨多个编译器优化级别的反编译基准上,与最强基线相比,ASAP将平均重新执行率从64.7%提升至71.9%,将平均重新编译率从91.6%提升至96.6%,为二进制反编译提供了新视角和实用解决方案。
英文摘要
Large language models (LLMs) are increasingly used in binary decompilation to refine the C-like pseudocode produced by traditional rule-based decompilers. While this pseudocode is useful, it is a heuristic and lossy abstraction rather than a faithful copy of the source code. It often contains decompiler errors, especially for aggressively optimized binaries where critical low-level details are obscured. We present ASAP, an assembly-source aligned pseudocode refinement framework for binary decompilation. ASAP learns source-aligned assembly representations from paired source and binary functions using joint function-level and snippet-level contrastive alignment. A Q-Former then compresses chunk-level assembly features into a fixed number of assembly tokens that condition the decompilation LLM alongside the decompiler-produced pseudocode. During refinement, we use stochastic pseudocode masking and a relative assembly-advantage loss to reduce the model's tendency to ignore assembly features and rely only on pseudocode refining. On two decompilation benchmarks across multiple compiler optimization levels, ASAP improves the average re-execution rate from 64.7% to 71.9% and the average recompilation rate from 91.6% to 96.6% compared with the strongest baseline, offering both a new perspective and a practical solution to binary decompilation.