将反编译代码转化为可编译执行的等效代码,准确率超99%。
PCodeTrans: Translate Decompiled Pseudocode to Compilable and Executable Equivalent
- 用动态反馈引导LLM修复语义错误,实现精准迭代优化。
- 在未剥离二进制上实现100%函数可编译性,行为一致性达99.55%~99.89%。
- 适合软件现代化与漏洞修复,对剥离二进制也保持96%以上鲁棒性。
反编译是二进制分析的基础,但传统工具更关注人类可读性而非严格可重编译性和可验证的运行时正确性。现有基于LLM的方法通常只优化可读性或依赖静态分析评估,易产生语义幻觉,导致准确性下降且无法解决实际运行失败。对于软件现代化和漏洞修复等关键任务,恢复后的代码必须既能编译又能复现原始二进制的行为。本文提出PCodeTrans,一个反馈驱动框架,连接反编译、重编译与严格的函数级动态验证。通过提取最小但完整的上下文以保证可重编译性,PCodeTrans采用原位可替换引擎,将编译后的函数直接热插到未修改的二进制中,原生保留其执行上下文和全局依赖。基于细粒度差异追踪生成运行时反馈,引导LLM迭代修复语义偏差。在Coreutils和Binutils上评估,PCodeTrans在修正原始Hex-Rays输出时达到前所未有的恢复性能:未剥离二进制上实现100%函数级可编译性,测试验证的行为一致性分别为99.55%和99.89%;分别解决了官方测试套件暴露的76.56%和79.74%逻辑错误。即使在完全剥离的二进制上,仍保持超过96%的行为一致性。显著优于所有现有基线,为可靠将反编译伪代码转为可编译可执行等效代码铺平了实用路径。
原文摘要 · Abstract (English)
Decompilation is foundational to binary analysis, yet conventional tools prioritize human readability over strict recompilability and verifiable runtime correctness. While recent LLM-based approaches attempt to refine decompiled pseudocode, they typically either optimize solely for readability or rely on static analysis for evaluation. This makes them prone to "semantic hallucinations" that compromise accuracy and fail to resolve actual runtime failures. For critical tasks like software modernization and vulnerability remediation, recovered code must not only compile but replicate the original binary's behavior. We present PCodeTrans, a feedback-driven framework that bridges the gap between decompilation, recompilation, and rigorous function-level dynamic validation. After extracting a minimal yet coherent context to guarantee recompilability, PCodeTrans employs an in situ substitutable engine to hot-swap the compiled function directly into the unmodified binary, natively preserving its authentic execution context and global dependencies. Guided by fine-grained differential tracing, PCodeTrans generates precise runtime feedback to iteratively guide an LLM in repairing semantic discrepancies. Evaluated on Coreutils and Binutils, PCodeTrans achieves unprecedented recovery performance when rectifying raw Hex-Rays outputs, attaining 100% function-level compilability on unstripped binaries alongside 99.55% and 99.89% test-validated behavioral consistency, respectively. In doing so, it resolves 76.56% and 79.74% of logic errors exposed by official test suites. Exhibiting exceptional resilience, PCodeTrans maintains over 96% behavioral consistency even on fully stripped binaries. By significantly outperforming all existing baselines, PCodeTrans paves a practical path to reliably translate decompiled pseudocode into compilable and executable equivalents.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。