用锚点+大模型从二进制恢复源码，准确率超95%
Practical Source Code Recovery from Binary Functions Using Anchor-Based Retrieval and LLM Reasoning
- 通过字符串、常量等锚点定位源码，结合倒排索引快速检索
- 在高质量数据库上实现95.2%指令覆盖率，显著优于传统反编译
- 适合安全分析、逆向工程人员在真实场景中精准还原代码
我们提出一种实用的二进制函数源码恢复流水线，融合逆向工程、基于锚点的源码检索与大语言模型推理。该方法不生成近似伪代码，而是从源码库中直接匹配原始函数。利用Ghidra提取字符串、常量、外部调用和函数名等锚点，通过倒排索引数据库检索候选文件，再基于反汇编、反编译代码和源码元数据，用大语言模型对候选片段重排序并筛选。高置信度匹配结果可作为后续迭代的锚点。在剥离优化的tcpdump二进制上，基于高保真源码库的实验达到95.2%的汇编指令覆盖率。在基于GitHub的检索库上平均仅35.5%指令覆盖率，主因是检索遗漏。结果表明，源码级二进制恢复在高质量数据库下表现优异，且在噪声环境中仍具实用性。
原文摘要 · Abstract (English)
We present a practical pipeline for recovering source code from stripped binary functions by combining reverse engineering, anchor-based source code retrieval, and large language model reasoning. Our binary-to-source-code retrieval method attempts to identify the source function from a source code database, rather than generating approximate decompiled pseudocode. It extracts anchors such as strings, constants, external calls, and available function names using Ghidra, retrieves candidate files via an inverted-index search database, narrows candidates to likely function snippets, and re-ranks them with a large language model (LLM) based on disassembly, decompiled code, and source metadata. Confident matches can also serve as anchors in later passes. In an evaluation backed by our high-fidelity source code database on a stripped, optimized tcpdump binary, our proposed binary-to-source matching method achieves 95.2% assembly instruction coverage. Experiments on a GitHub-based retrieval database showed lower performance with 35.5% instruction coverage on average, mainly due to retrieval misses. These results show that source-level binary recovery excels with high-quality databases and remains a useful tool in noisy environments.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。