arXiv:2604.15390cs.SEcs.AI2026-04

用思维链引导大模型,自动还原被混淆的代码结构与逻辑。

Analyzing Chain of Thought (CoT) Approaches in Control Flow Code Deobfuscation Tasks

论文配图:Analyzing Chain of Thought (CoT) Approaches in Control Flow Code Deobfuscation Tasks
图 1 · 摘自论文原文
  • 通过逐步推理引导大模型分析混淆代码的控制流
  • 相比直接提问,思维链使代码结构恢复率提升16%,语义保留率提升20.5%
  • 适合需要快速逆向工程或代码可解释性的安全研究者

代码去混淆旨在恢复程序的可读版本并保持其原始行为。实际中常需数天甚至数月的手动分析和昂贵工具。本文探索基于思维链(CoT)提示的大语言模型方法,引导模型通过显式、分步推理进行代码分析。聚焦控制流混淆技术,包括控制流扁平化(CFF)、不透明谓词及其组合,评估控制流图的结构恢复与程序语义的保留情况。在标准C基准上测试五种主流大模型,结果表明CoT提示显著优于简单提示。其中,GPT5表现最佳,平均在控制流图重建上提升约16%,语义保留提升约20.5%(相较零样本提示)。性能受混淆程度、所用混淆器及原控制流图复杂度影响。结果表明,CoT引导的大模型可有效辅助代码去混淆,提升可解释性、结构还原精度与行为保真度,有望减少逆向工程的人工投入。

原文摘要 · Abstract (English)

Code deobfuscation is the task of recovering a readable version of a program while preserving its original behavior. In practice, this often requires days or even months of manual work with complex and expensive analysis tools. In this paper, we explore an alternative approach based on Chain-of-Thought (CoT) prompting, where a large language model is guided through explicit, step-by-step reasoning tailored for code analysis. We focus on control flow obfuscation, including Control Flow Flattening (CFF), Opaque Predicates, and their combination, and we measure both structural recovery of the control flow graph and preservation of program semantics. We evaluate five state-of-the-art large language models and show that CoT prompting significantly improves deobfuscation quality compared with simple prompting. We validate our approach on a diverse set of standard C benchmarks and report results using both structural metrics for control flow graphs and semantic metrics based on output similarity. Among the tested models and by applying CoT, GPT5 achieves the strongest overall performance, with an average gain of about 16% in control-flow graph reconstruction and about 20.5% in semantic preservation across our benchmarks compared to zero-shot prompting. Our results also show that model performance depends not only on the obfuscation level and the chosen obfuscator but also on the intrinsic complexity of the original control flow graph. Collectively, these findings suggest that CoT-guided large language models can serve as effective assistants for code deobfuscation, providing improved code explainability, more faithful control flow graph reconstruction, and better preservation of program behavior while potentially reducing the manual effort needed for reverse engineering.

代码去混淆思维链大模型逆向工程

Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。