LLM4Decompile

Analysis

Why This Paper Matters

Decompilation is a critical but challenging task in reverse engineering, security analysis, and legacy code migration. Traditional tools like Ghidra produce low-level, hard-to-read output that often fails to execute correctly. LLM4Decompile directly addresses this gap by leveraging large language models to generate human-readable, executable source code from binaries. This is a significant step forward because it combines the pattern-matching strengths of LLMs with the structured output needed for practical decompilation.

The paper is particularly important because it provides the first open-source LLM series for this task, making the technology accessible to researchers and practitioners. The scale of models (1.3B to 33B parameters) allows for experimentation across different resource constraints. The demonstrated superiority over both GPT-4o and Ghidra—by over 100% in re-executability—shows that specialized LLMs can outperform general-purpose models and traditional tools in niche domains.

Technical Contributions

• End-to-end decompilation (LLM4Decompile-End): Trained to directly map binary code to source code, bypassing intermediate representations. This is a novel application of LLMs for a structured output task.
• Refinement approach (LLM4Decompile-Ref): Fine-tunes the model to improve Ghidra's output, achieving a 16.2% relative improvement over the End model. This hybrid approach combines traditional tool speed with LLM quality.
• Training optimization: The authors detail a training process tailored for decompilation, likely involving instruction tuning and binary-source pairs, though specifics are abstracted.
• Benchmarking: Evaluation on HumanEval and ExeBench provides standardized metrics for re-executability, a practical measure of decompilation quality.

Results

• LLM4Decompile-End models achieve over 100% higher re-executability rate than GPT-4o and Ghidra on both HumanEval and ExeBench benchmarks.
• The Ref models further improve re-executability by 16.2% over the End models, demonstrating the value of iterative refinement.
• The 33B parameter model likely achieves the best performance, though exact per-model metrics are not detailed in the abstract.

Significance

LLM4Decompile has broad implications for software engineering and security. It can accelerate reverse engineering tasks, reduce human effort in analyzing malware or legacy code, and enable better tool integration where LLMs complement traditional decompilers. The open-source release allows the community to build upon this work, potentially leading to specialized models for different architectures or optimization levels. This paper also highlights the growing trend of applying LLMs to structured code tasks beyond natural language, reinforcing the versatility of transformer architectures.