用多智能体迭代优化，让反编译代码能重新运行。
Constraint-Guided Multi-Agent Decompilation for Executable Binary Recovery
- 分三层约束验证：语法、编译、行为一致性，失败则由大模型修复。
- 在1641个真实二进制上实现84%-97%可重执行，提升28-89个百分点。
- 适合安全分析与老旧系统维护，尤其需要可运行源码的场景。
反编译——从已编译二进制文件恢复源代码——对安全分析、恶意软件逆向工程和遗留软件维护至关重要。然而，现有反编译器生成的代码往往无法正确编译或执行，限制了实际应用。本文提出一种多智能体框架，通过多层级约束引导的反编译（MCGD）将反编译代码转化为可重执行的源码。该方法采用分层验证流水线，包含三个约束层级：(1) 基于解析的语法正确性，(2) 基于GCC的可编译性，(3) 基于大语言模型生成测试用例的行为等价性。当验证失败时，专用的大语言模型智能体利用结构化错误反馈迭代优化代码。我们在来自ExeBench的1,641个真实世界二进制文件上，对RetDec、Ghidra和Angr三种反编译器进行了评估。该框架实现了84%-97%的可重执行率，较基线提升28-89个百分点。与使用相同GPT-4o主干的最先进基于大模型的反编译方法相比，我们的方法（84.1%）优于LLM4Decompile（80.3%）、SK2Decompile（73.9%）和SALT4Decompile（61.8%）。消融实验表明，基于执行的验证至关重要：仅编译验证的方法尽管编译率达91%-99%，但行为正确率为0%。系统收敛高效，90%以上的二进制在2次迭代内达到正确性，平均每个二进制成本为0.03-0.05美元。结果表明，约束引导的智能体精炼能够弥合原始反编译输出与实用源码之间的差距。
原文摘要 · Abstract (English)
Decompilation -- recovering source code from compiled binaries -- is essential for security analysis, malware reverse engineering, and legacy software maintenance. However, existing decompilers produce code that often fails to compile or execute correctly, limiting their practical utility. We present a multi-agent framework that transforms decompiled code into re-executable source through Multi-level Constraint-Guided Decompilation (MCGD). Our approach employs a hierarchical validation pipeline with three constraint levels: (1) syntactic correctness via parsing, (2) compilability via GCC, and (3) behavioral equivalence via LLM-generated test cases. When validation fails, specialized LLM agents iteratively refine the code using structured error feedback. We evaluate our framework on 1,641 real-world binaries from ExeBench across three decompilers (RetDec, Ghidra, and Angr). Our framework achieves 84-97% re-executability, improving baseline decompiler output by 28-89 percentage points. In comparison with state-of-the-art LLM-based decompilation methods using the same GPT-4o backbone, our approach (84.1%) outperforms LLM4Decompile (80.3%), SK2Decompile (73.9%), and SALT4Decompile (61.8%). Our ablation study reveals that execution-based validation is critical: compile-only approaches achieve 0% behavioral correctness despite 91-99% compilation rates. The system converges efficiently, with 90%+ binaries reaching correctness within 2 iterations at an average cost of $0.03-0.05 per binary. Our results demonstrate that constraint-guided agentic refinement can bridge the gap between raw decompiler output and practically useful source code.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。