Refining Decompiled C Code with Large Language Models
Wai Kin Wong, Huaijin Wang, Zongjie Li, Zhibo Liu, Shuai Wang, Qiyi Tang, Sen Nie, Shi Wu
TL;DR
The paper tackles the problem of turning decompiler outputs into recompilable C code, a task traditionally hampered by information loss and compiler mismatches. It proposes DecGPT, a two-step LLM-assisted pipeline that statically fixes syntax and type issues and dynamically repairs memory errors surfaced via ASAN, enabling recompilation of IDA-Pro outputs. On 300 Code Contest test cases, DecGPT raises recompilation success from about 45% baseline to roughly 75%, with ablation studies showing both static and dynamic components are essential, especially for long-context inputs. The work highlights practical significance for security instrumentation, legacy software migration, and automated binary hardening, while outlining limitations and future directions in prompt design, context management, and broader decompiler applicability.
Abstract
A C decompiler converts an executable into source code. The recovered C source code, once re-compiled, is expected to produce an executable with the same functionality as the original executable. With over twenty years of development, C decompilers have been widely used in production to support reverse engineering applications. Despite the prosperous development of C decompilers, it is widely acknowledged that decompiler outputs are mainly used for human consumption, and are not suitable for automatic recompilation. Often, a substantial amount of manual effort is required to fix the decompiler outputs before they can be recompiled and executed properly. This paper is motived by the recent success of large language models (LLMs) in comprehending dense corpus of natural language. To alleviate the tedious, costly and often error-prone manual effort in fixing decompiler outputs, we investigate the feasibility of using LLMs to augment decompiler outputs, thus delivering recompilable decompilation. Note that different from previous efforts that focus on augmenting decompiler outputs with higher readability (e.g., recovering type/variable names), we focus on augmenting decompiler outputs with recompilability, meaning to generate code that can be recompiled into an executable with the same functionality as the original executable. We conduct a pilot study to characterize the obstacles in recompiling the outputs of the de facto commercial C decompiler -- IDA-Pro. We then propose a two-step, hybrid approach to augmenting decompiler outputs with LLMs. We evaluate our approach on a set of popular C test cases, and show that our approach can deliver a high recompilation success rate to over 75% with moderate effort, whereas none of the IDA-Pro's original outputs can be recompiled. We conclude with a discussion on the limitations of our approach and promising future research directions.