{"schema_version":1,"papers":[{"id":"paper-humans-machines-sre","title":"Humans vs. Machines: A Comparison With AI Agents in Software Reverse Engineering","title_zh":"人类与机器：AI 智能体在软件逆向工程中的对比研究","description_en":"Compares human and LLM-agent understanding and navigation on the same static reverse-engineering challenges, then studies how binary representations consume context windows.","description_zh":"比较人类与 LLM 智能体在相同静态逆向挑战中的理解和导航方式，并研究二进制表示如何占用上下文窗口。","authors":["Samuele Doria","Stefano De Rosa","Ruoyu Wang","Zion Leonahenahe Basque","Eleonora Losiouk","Simone Aonzo"],"authors_omitted":null,"venue":"arXiv","doi":"10.48550/arxiv.2610.14960","arxiv_id":"2610.14960","year":2026,"publication_status":"preprint","targets":["binary"]},{"id":"paper-ctf-dojo","title":"Training Language Model Agents to Find Vulnerabilities with CTF-Dojo","title_zh":"使用 CTF-Dojo 训练语言模型智能体发现漏洞","description_en":"CTF-Dojo is an execution environment for training LLM agents on capture-the-flag tasks: 658 challenges from 50 competitions held between 2011 and 2025, taken from pwn.college's CTF Archive and containerized with Docker. Its CTF-Forge pipeline prompts DeepSeek-V3-0324 to write each challenge's Dockerfile, docker-compose file and challenge metadata; across three independent runs, 650 challenges consistently built and answered on their expected ports. Qwen3-Coder and DeepSeek-V3-0324 agents in the EnIGMA+ scaffold, capped at 40 turns, collected trajectories. Matched CTFtime writeups served as hints during collection and were removed afterwards, and ports, paths, distractor code and other runtime details were randomized per rollout. Rejection-sampling fine-tuning of Qwen3 8B, 14B and 32B on 486 flag-capturing trajectories from 274 solved challenges raises average Pass@1 on InterCode-CTF, NYU CTF Bench and Cybench by up to 11.6 points; the 32B model reaches 31.9%.","description_zh":"CTF-Dojo 是用于在夺旗赛任务上训练大语言模型智能体的可执行环境：它从 pwn.college 的 CTF Archive 中选取 658 道题目，来自 2011 年至 2025 年举办的 50 项竞赛，并以 Docker 容器化。其 CTF-Forge 流水线提示 DeepSeek-V3-0324 为每道题目编写 Dockerfile、docker-compose 文件和题目元数据；在三次独立运行中，650 道题目均能稳定构建并在预期端口上响应。Qwen3-Coder 与 DeepSeek-V3-0324 智能体在上限为 40 轮的 EnIGMA+ 框架中收集轨迹。收集过程中以匹配到的 CTFtime 题解作为提示，之后再从轨迹中删除；每次运行还会随机化端口、路径、干扰代码及其他运行时细节。作者以拒绝采样微调方式，用来自 274 道已解题目的 486 条成功夺旗轨迹训练 Qwen3 8B、14B 与 32B 模型，使其在 InterCode-CTF、NYU CTF Bench 与 Cybench 上的平均 Pass@1 最多提高 11.6 个百分点；32B 模型达到 31.9%。","authors":["Terry Yue Zhuo","Dingmin Wang","Hantian Ding","Varun Kumar","Zijian Wang"],"authors_omitted":null,"venue":"ICML 2026","doi":null,"arxiv_id":"2508.18370","year":2026,"publication_status":"conference-paper","targets":["binary"]},{"id":"paper-reveree","title":"Reveree: Diagnosing LLM Reverse-Engineering Agents","title_zh":"Reveree：诊断大语言模型逆向工程智能体","description_en":"Evaluates reverse-engineering agent traces through flag recovery, eight analysis milestones and action profiles. Deterministic checks and an outcome-blinded LLM judge help locate failures beyond a single solve-rate score.","description_zh":"从旗标恢复、八个分析阶段和操作特征评估逆向智能体轨迹，通过确定性检查与不知道最终结果的模型裁判定位失败环节。","authors":["Hadjer Benkraouda","Hongyu Cai","Berkay Celik","Gang Wang"],"authors_omitted":null,"venue":"arXiv","doi":"10.48550/arxiv.2609.01185","arxiv_id":"2609.01185","year":2026,"publication_status":"preprint","targets":["binary"]},{"id":"paper-sre-bench","title":"The Next Challenge for Agentic Cybersecurity: A Realistic, Contamination-Free Reverse Engineering Benchmark","title_zh":"智能体网络安全的下一项挑战：真实场景且无训练数据污染的逆向工程基准","description_en":"Introduces SRE-Bench, with privately authored programs and protected binary variants, to study agent recovery of program semantics while reducing training-data contamination.","description_zh":"提出 SRE-Bench，使用私有编写的程序及带保护机制的二进制变体，研究智能体恢复程序语义的能力，并减少训练数据污染。","authors":["Jeremy Spence","Nicholas Assaderaghi","Feng Xiao","Jinhao Zhu","Nikil Ravi","Xiangyu Qi","Matthew Jagielski","Raluca Ada Popa","Eric Wallace","Guannan Wei","Yangruibo Ding","Zhuo Zhang"],"authors_omitted":null,"venue":"arXiv","doi":null,"arxiv_id":"2608.11469","year":2026,"publication_status":"preprint","targets":["binary"]},{"id":"paper-attacking-re-ai-agents","title":"Automatically Attacking Software Reverse Engineering AI Agents","title_zh":"针对软件逆向工程 AI 智能体的自动化攻击","description_en":"A proof of concept for indirect prompt injection against Cline/GhidraMCP binary-analysis agents. An adapted AutoDAN generates embedded strings that make the agent describe different behavior. The authors demonstrate four small C programs with Qwen3-8B and transfer the examples to GPT-OSS-120B.","description_zh":"研究针对 Cline/GhidraMCP 二进制分析智能体的间接提示注入。改造后的 AutoDAN 生成嵌入字符串，使分析报告偏离程序实际行为。作者以四个小型 C 程序在 Qwen3-8B 上演示，并将样例迁移到 GPT-OSS-120B。","authors":["Brian Crawford","Justin Phillips","Patrick McClure"],"authors_omitted":null,"venue":"ECCWS 2026","doi":"10.34190/eccws.25.1.4597","arxiv_id":"2605.30667","year":2026,"publication_status":"conference-paper","targets":["binary"]},{"id":"paper-crackmebench","title":"CrackMeBench: Binary Reverse Engineering for Agents","title_zh":"CrackMeBench：面向智能体的二进制逆向工程基准","description_en":"Evaluates agents on executable-checked CrackMe tasks: infer validation logic from binaries and submit an accepted input or artifact, while recording tool use, time, and scoring attempts.","description_zh":"用可执行程序判定结果的 CrackMe 任务评估智能体：从二进制推断验证逻辑，提交可被接受的输入或产物，并记录工具使用、耗时与评分尝试。","authors":["Isaac David","Arthur Gervais"],"authors_omitted":null,"venue":"arXiv","doi":null,"arxiv_id":"2605.10597","year":2026,"publication_status":"preprint","targets":["binary"]},{"id":"paper-llm-resistant-protection","title":"Towards LLM-Resistant Software Protection: Agent Failure Patterns in CTF Reverse Engineering","title_zh":"迈向抗 LLM 的软件保护：CTF 逆向工程中的智能体失败模式","description_en":"Runs Claude Code, Codex CLI and ChatGPT-5.2 Pro on 24 crackme-style challenges selected from 15 international CTF events held in 2025, and attributes their failures to stages of an Observe–Comprehend–Plan loop and to three protection effects: concealment, complication and misdirection. From the failure logs, the authors derive four recurring weaknesses (training bias, over-trust in observations, context limitation and plan persistence). They rerun both CLI agents without a decompiler and compare outcomes with in-competition solve rates.","description_zh":"让 Claude Code、Codex CLI 与 ChatGPT-5.2 Pro 求解从 2025 年 15 场国际 CTF 赛事中选出的 24 道 crackme 类题目，并将失败归因到“观察—理解—计划”循环的各阶段，以及隐藏、复杂化与误导三类保护效果。作者从失败日志中归纳出四类反复出现的弱点：训练偏差、过度信任观察结果、上下文限制和计划固守。他们还在移除反编译器后重新运行两个命令行智能体，并将结果与赛时解题率对比。","authors":["Ryutaro Nishizaka","Yudai Fujiwara","Takuya Shimizu","Kazushi Kato","Yuichi Sugiyama"],"authors_omitted":null,"venue":"Workshop on Binary Analysis Research (BAR) 2026","doi":"10.14722/bar.2026.23058","arxiv_id":null,"year":2026,"publication_status":"conference-paper","targets":["binary"]},{"id":"paper-programbench","title":"ProgramBench: Can Language Models Rebuild Programs From Scratch?","title_zh":"ProgramBench：语言模型能否从零重建程序？","description_en":"Evaluates black-box program reconstruction across 200 tasks: agents query an executable and read its documentation, then independently implement a codebase whose behavior is checked by generated tests.","description_zh":"通过 200 项任务评估黑盒程序重建：智能体运行可执行文件进行探测并阅读文档，再独立实现代码库，由生成的测试检查其行为。","authors":["John Yang","Kilian Lieret","Jeffrey Ma","Parth Thakkar","Dmitrii Pedchenko","Sten Sootla","Emily McMilin","Pengcheng Yin","Rui Hou","Gabriel Synnaeve","Diyi Yang","Ofir Press"],"authors_omitted":null,"venue":"NeurIPS 2026","doi":"10.48550/arXiv.2605.03546","arxiv_id":"2605.03546","year":2026,"publication_status":"conference-accepted","targets":["binary","app"]},{"id":"paper-decompiling-synergy","title":"Decompiling the Synergy: An Empirical Study of Human–LLM Teaming in Software Reverse Engineering","title_zh":"解构协同：软件逆向工程中人类与 LLM 协作的实证研究","description_en":"Studies how human analysts work with LLM assistance during static software reverse engineering. A survey of 153 practitioners informed six LLM features built into an instrumented IDA Pro plugin. Then 48 participants (24 self-reported novices and 24 experts) analyzed two CTF-style binaries, with the features enabled on one randomly assigned challenge. From graded writeups, interaction logs and surveys, the authors report 18 findings: novice understanding rose by about 98% to expert levels while experts gained little, known-algorithm functions were triaged up to 2.4× faster, and artifact recovery rose by at least 66%, alongside harmful hallucinations.","description_zh":"研究人类分析人员在静态软件逆向工程中如何借助 LLM 辅助开展工作。作者依据对 153 名从业者的问卷，在带插桩的 IDA Pro 插件中实现六项 LLM 功能；随后 48 名参与者（自报新手与专家各 24 名）分析两个 CTF 风格的二进制程序，其中一道随机指定的题目启用这些功能。基于评分后的解题报告、交互日志和问卷，作者报告 18 项发现：新手的理解程度提升约 98%，达到专家水平，而专家收益甚微；已知算法函数的分诊速度最高提升 2.4 倍，产物恢复量至少增加 66%；同时也出现了有害的幻觉。","authors":["Zion Leonahenahe Basque","Samuele Doria","Ananta Soneji","Wil Gibbs","Adam Doupé","Yan Shoshitaishvili","Eleonora Losiouk","Ruoyu Wang","Simone Aonzo"],"authors_omitted":null,"venue":"NDSS 2026","doi":"10.14722/ndss.2026.240380","arxiv_id":null,"year":2026,"publication_status":"conference-paper","targets":["binary"]},{"id":"paper-cyber-zero","title":"Cyber-Zero: Training Cybersecurity Agents without Runtime","title_zh":"Cyber-Zero：无需运行环境训练网络安全智能体","description_en":"Cyber-Zero synthesizes training trajectories for capture-the-flag (CTF) agents from public writeups instead of running the challenges. Writeups collected from CTFtime through the CTF Archives repository are cleaned, filtered and completed with DeepSeek-V3-0324, which fills in missing metadata and extracts flags; after removing 47 challenges that overlap the evaluation benchmarks, the corpus holds 6,188 writeups for 4,610 challenges from 543 competitions in six categories, 2017–2025. Two DeepSeek-V3-0324 personas then simulate each solve: a CTF player that sees only the challenge content, and a Bash terminal that sees the writeup and flag, invents plausible command output and may inject hints, which are removed before training. Trajectories use the EnIGMA scaffold format and are kept only if they reach the exact flag, pass format checks and are judged by an LLM filter to follow the writeup's approach. Qwen3, Qwen2.5-Instruct and SWE-agent-LM models are fine-tuned on 9,464 of these trajectories and evaluated with EnIGMA+, the authors' parallel version of EnIGMA, on InterCode-CTF, NYU CTF Bench and Cybench. The fine-tuned Qwen3-32B (Cyber-Zero-32B) rises from 20.3% to 33.4% average Pass@1, the 13.1-point gain reported in the abstract.","description_zh":"Cyber-Zero 依据公开的解题报告（writeup）合成夺旗赛（CTF）智能体的训练轨迹，而不实际运行题目。作者经由 CTF Archives 仓库从 CTFtime 收集解题报告，经过清洗与筛选后，再用 DeepSeek-V3-0324 补全缺失的元数据并提取旗标；移除与评测基准重叠的 47 道题目后，语料包含 6,188 篇解题报告，覆盖 543 场竞赛中六个类别的 4,610 道题目，时间跨度为 2017–2025 年。随后由两个 DeepSeek-V3-0324 角色模拟每次解题：CTF 选手只能看到题目内容；Bash 终端则能看到解题报告与旗标，负责编造合理的命令输出，并可插入提示，这些提示在训练前会被删除。轨迹采用 EnIGMA 智能体框架的格式，只有得出完全匹配的旗标、通过格式检查，并经 LLM 过滤器判定与解题报告思路一致的轨迹才会保留。作者用其中 9,464 条轨迹微调 Qwen3、Qwen2.5-Instruct 与 SWE-agent-LM 模型，并以自行开发的并行版 EnIGMA+ 在 InterCode-CTF、NYU CTF Bench 与 Cybench 上评测。微调后的 Qwen3-32B（Cyber-Zero-32B）平均 Pass@1 从 20.3% 提升至 33.4%，即摘要所述的 13.1 个百分点增益。","authors":["Terry Yue Zhuo","Dingmin Wang","Hantian Ding","Varun Kumar","Zijian Wang"],"authors_omitted":null,"venue":"ICLR 2026","doi":null,"arxiv_id":"2508.00910","year":2026,"publication_status":"conference-paper","targets":["binary"]},{"id":"paper-crebench","title":"CREBench: Evaluating Large Language Models in Cryptographic Binary Reverse Engineering","title_zh":"CREBench：评估大语言模型的密码二进制逆向工程能力","description_en":"Benchmarks cryptographic binary reverse engineering across algorithm recognition, key or IV extraction, wrapper reconstruction, and flag recovery using 432 controlled challenges.","description_zh":"通过 432 个受控挑战，评估密码二进制逆向中的算法识别、密钥或 IV 提取、包装层重建及标志恢复。","authors":["Baicheng Chen","Yu Wang","Ziheng Zhou","Xiangru Liu","Juanru Li","Yilei Chen","Tianxing He"],"authors_omitted":null,"venue":"COLM 2026","doi":null,"arxiv_id":"2604.03750","year":2026,"publication_status":"conference-paper","targets":["binary"]},{"id":"paper-enigma","title":"EnIGMA: Interactive Tools Substantially Assist LM Agents in Finding Security Vulnerabilities","title_zh":"EnIGMA：交互式工具显著帮助语言模型智能体发现安全漏洞","description_en":"EnIGMA extends SWE-agent for capture-the-flag challenges with interactive agent tools that keep a gdb debugging session or a pwntools server connection open across turns, alongside decompile and disassemble commands, an LM summarizer for long outputs, and category-specific demonstrations and guidelines. It is evaluated with four LMs on 390 challenges from NYU CTF, InterCode-CTF, Cybench and a HackTheBox set the authors collected. The paper ablates tools, summarizers and demonstrations, and analyzes solution leakage and “soliloquizing”, where the model writes its own observations instead of acting in the environment.","description_zh":"EnIGMA 在 SWE-agent 基础上面向 CTF 题目进行扩展：交互式智能体工具可在多轮之间保持 gdb 调试会话或 pwntools 服务器连接，另有反编译与反汇编命令、用于长输出的语言模型摘要器，以及按题目类别编写的示例和指导。论文使用四种语言模型，在 NYU CTF、InterCode-CTF、Cybench 及作者收集的 HackTheBox 题集共 390 道题目上评测；还对工具、摘要器和示例做消融实验，并分析解答泄露和“自言自语”（soliloquizing）现象，即模型不与环境交互而自行编写观察结果。","authors":["Talor Abramovich","Meet Udeshi","Minghao Shao","Kilian Lieret","Haoran Xi","Kimberly Milner","Sofija Jancheska","John Yang","Carlos E Jimenez","Farshad Khorrami","Prashanth Krishnamurthy","Brendan Dolan-Gavitt","Muhammad Shafique","Karthik R Narasimhan","Ramesh Karri","Ofir Press"],"authors_omitted":null,"venue":"ICML 2025","doi":null,"arxiv_id":"2409.16165","year":2025,"publication_status":"conference-paper","targets":["binary"]},{"id":"paper-cybench","title":"Cybench: A Framework for Evaluating Cybersecurity Capabilities and Risks of Language Models","title_zh":"Cybench：评估语言模型网络安全能力与风险的框架","description_en":"Cybench turns 40 professional-level capture-the-flag tasks from four competitions (HackTheBox Cyber Apocalypse 2024, SekaiCTF 2022–23, GlacierCTF and HKCert) into runnable agent tasks. Each task has a description, starter files, a Kali Linux container for the agent with task servers in Docker, and the time the first human team needed to solve it, from 2 minutes to 24 hours 54 minutes. Each task is also split into subtasks that grade intermediate steps. The authors evaluate eight models with a structured bash agent and compare four scaffolds for GPT-4o and Claude 3.5 Sonnet. Without subtask guidance, the best agents solved only tasks whose first human solve took at most 11 minutes, and Claude 3.5 Sonnet reached 17.5% unguided success.","description_zh":"Cybench 将来自四项竞赛（HackTheBox Cyber Apocalypse 2024、SekaiCTF 2022–23、GlacierCTF 与 HKCert）的 40 道专业级夺旗赛题目整理为可运行的智能体任务。每道题目都包含题目描述、初始文件、供智能体使用的 Kali Linux 容器及以 Docker 运行的题目服务器，并记录首个人类队伍的解题用时（2 分钟至 24 小时 54 分钟）。每道题目还被拆分为若干子任务，用于评估中间步骤。作者使用结构化 bash 智能体评测了八个模型，并为 GPT-4o 与 Claude 3.5 Sonnet 比较了四种智能体框架。在没有子任务引导时，表现最好的智能体只解出了人类首解用时不超过 11 分钟的题目；Claude 3.5 Sonnet 的无引导成功率为 17.5%。","authors":["Andy K. Zhang","Neil Perry","Riya Dulepet","Joey Ji","Celeste Menders","Justin W. Lin","Eliot Jones","Gashon Hussein","Samantha Liu","Donovan Jasper","Pura Peetathawatchai","Ari Glenn","Vikram Sivashankar","Daniel Zamoshchin","Leo Glikbarg","Derek Askaryar","Mike Yang","Teddy Zhang","Rishi Alluri","Nathan Tran","Rinnara Sangpisit","Polycarpos Yiorkadjis","Kenny Osele","Gautham Raghupathi","Dan Boneh","Daniel E. Ho","Percy Liang"],"authors_omitted":null,"venue":"ICLR 2025","doi":null,"arxiv_id":"2408.08926","year":2025,"publication_status":"conference-paper","targets":["binary"]},{"id":"paper-nyu-ctf-bench","title":"NYU CTF Bench: A Scalable Open-Source Benchmark Dataset for Evaluating LLMs in Offensive Security","title_zh":"NYU CTF Bench：用于评估大语言模型攻击性安全能力的可扩展开源基准数据集","description_en":"NYU CTF Bench packages 200 manually validated challenges from CSAW CTF qualifying and final rounds held between 2017 and 2023, spanning cryptography, forensics, pwn, reverse engineering, web and miscellaneous tasks, with challenge.json metadata and Docker images for server-side challenges. The paper also presents an automated framework that gives LLMs function-calling tools for shell commands, file creation, Ghidra disassembly and decompilation, flag checking and giving up. It evaluates five LLMs and compares their scores with human teams at CSAW 2022 and 2023.","description_zh":"NYU CTF Bench 收录 2017–2023 年 CSAW CTF 资格赛与决赛中经人工验证的 200 道题目，涵盖密码学、取证、二进制漏洞利用、逆向工程、Web 与杂项任务，并为题目提供 challenge.json 元数据，为需要服务端的题目提供 Docker 镜像。论文还提出一个自动化框架，通过函数调用为大语言模型提供执行 Shell 命令、创建文件、使用 Ghidra 反汇编与反编译、检查 flag 和放弃求解等工具。论文评测了五种大语言模型，并将其得分与 CSAW 2022 和 2023 的人类参赛队伍比较。","authors":["Minghao Shao","Sofija Jancheska","Meet Udeshi","Brendan Dolan-Gavitt","Haoran Xi","Kimberly Milner","Boyuan Chen","Max Yin","Siddharth Garg","Prashanth Krishnamurthy","Farshad Khorrami","Ramesh Karri","Muhammad Shafique"],"authors_omitted":null,"venue":"NeurIPS 2024 Datasets and Benchmarks","doi":"10.52202/079017-1832","arxiv_id":"2406.05590","year":2024,"publication_status":"conference-paper","targets":["binary"]},{"id":"paper-patchalign","title":"Locate, Then Reason: End-to-End Patch Presence Testing in Stripped Binaries","title_zh":"先定位再推理：剥离符号二进制中的端到端补丁存在性测试","description_en":"Locates patch-relevant code in stripped binaries using instruction-aligned retrieval and caller/callee context, then uses an LLM to screen candidate matches and compare patch-specific behavior with vulnerable and patched references.","description_zh":"结合指令对齐检索及调用者／被调用者上下文，在剥离符号的二进制中定位补丁相关代码，再由 LLM 筛选候选匹配并对照漏洞版与修复版参考程序判断补丁特定行为。","authors":["Huaijin Wang","Tongda Wang","Zhibo Liu","Yue Zhang","Shuai Wang","Pengfei Hu","Jianzhong Liu","Fangtian Zhong","Shaohua Wang"],"authors_omitted":null,"venue":"arXiv","doi":"10.48550/arxiv.2610.25071","arxiv_id":"2610.25071","year":2026,"publication_status":"preprint","targets":["binary"]},{"id":"paper-bscout","title":"Recall-Oriented Precise Binary-to-Source Function Matching","title_zh":"面向召回率的精确二进制到源码函数匹配","description_en":"BScout matches decompiled functions to a source corpus using chunked embeddings and inlining-aware training. Existing matches provide positional clues to expand candidates; LLM selection and structural filters refine the resulting correspondences.","description_zh":"BScout 通过分块嵌入及考虑内联的训练，将反编译函数匹配到源码语料；已有匹配提供位置线索以扩充候选，再由大语言模型选择及结构过滤改进对应关系。","authors":["Junlin Li","Jianjun Huang","Wei You","Bin Liang"],"authors_omitted":null,"venue":"arXiv","doi":null,"arxiv_id":"2610.23546","year":2026,"publication_status":"preprint","targets":["binary"]},{"id":"paper-ios-protobuf-extractor","title":"Decoding What iOS Location Services Send to Apple: An LLM Is an Unreliable Analyst but a Useful Toolmaker","title_zh":"解码 iOS 定位服务发送给 Apple 的数据：大语言模型并非可靠分析员，却能辅助构建工具","description_en":"Compares direct LLM recovery of Apple PBCodable schemas with an AI-written Extractor checked against compiled synthetic fixtures, published descriptors and captured traffic. It shows how plausible recovered schemas can silently decode values incorrectly.","description_zh":"比较直接用大语言模型恢复 Apple PBCodable 模式与构建 Extractor 工具两种路径；工具以编译后的合成样本、既有描述文件和捕获流量交叉检查，说明看似合理的模式也可能静默解码出错误值。","authors":["Douglas Leith"],"authors_omitted":null,"venue":"arXiv","doi":null,"arxiv_id":"2610.21597","year":2026,"publication_status":"preprint","targets":["binary","protocol","app"]},{"id":"paper-sok-source-recovery-reliability","title":"SoK: Are LLMs Reliable at Source Code Recovery? A Taxonomy and Empirical Evaluation","title_zh":"SoK：LLM 恢复源码是否可靠？分类体系与实证评估","description_en":"This SoK organizes LLM-assisted source-recovery designs and separates compilation, readability, structural and behavioral metrics. Its controlled study varies architecture, compiler optimization and symbol availability, with smaller ablations for input representation, model roles and source language.","description_zh":"该 SoK 组织 LLM 辅助源码恢复方案，并区分编译、可读性、结构与行为指标。受控研究改变架构、编译优化及符号状态，并以较小的消融实验考察输入表示、模型角色和源语言。","authors":["Varun Kohli","Lee Bing Cheng","Nur Hazim Ghazali","Gao Yuze","Daryl Poon","Dinil Mon Divakaran"],"authors_omitted":null,"venue":"arXiv","doi":null,"arxiv_id":"2610.11556","year":2026,"publication_status":"preprint","targets":["binary"]},{"id":"paper-codeinverter-suite","title":"The CodeInverter Suite: Structure- and Data-Aware Binary Decompilation with Efficient LLMs","title_zh":"CodeInverter 套件：利用高效大语言模型进行结构与数据感知的二进制反编译","description_en":"CodeInverter studies function-level LLM decompilation using control-flow graphs and memory-to-data mappings extracted with IDA/objdump. It presents a prompt workflow, training corpus and model family, evaluated through compilation, benchmark input/output tests and edit similarity.","description_zh":"CodeInverter 研究函数级 LLM 反编译，使用 IDA／objdump 提取的控制流图和内存到数据映射补充输入。论文提出提示工作流、训练语料与模型系列，并以编译、基准输入输出测试和编辑相似性评估结果。","authors":["Peipei Liu","Jian Sun","Rongkang Sun","Li Chen","Zhaoteng Yan","Xiaoling Zhang","Dawei Wang","Dapeng Sun","Peizheng Zhang","Dan Li"],"authors_omitted":null,"venue":"ASE 2026","doi":"10.1145/3832783.3837554","arxiv_id":"2503.07215","year":2026,"publication_status":"conference-paper","targets":["binary"]},{"id":"paper-binjudge","title":"Beyond Text Matching: Towards Reference-Free Evaluation for Human-Oriented Binary Reverse Engineering","title_zh":"超越文本匹配：面向人的二进制逆向工程的无参考评估","description_en":"BinJudgeBench collects expert judgments for function naming, binary-code summaries and decompilation refinement. BinJudge learns to select a judge configuration for each input and task, evaluating agreement with human scores rather than executable correctness.","description_zh":"BinJudgeBench 收集函数命名、二进制代码摘要及反编译改进的专家评分。BinJudge 学习为每个输入及任务选择评审配置，评估与人工评分的一致性，而非可执行正确性。","authors":["Xiuwei Shang","Li Hu","Xiao Jiang","Jieke Shi","Junda He","Zhou Yang","Shaoyin Cheng","Guoqiang Chen","Weiming Zhang","David Lo"],"authors_omitted":null,"venue":"ASE 2026","doi":"10.1145/3832783.3834339","arxiv_id":"2608.07038","year":2026,"publication_status":"conference-paper","targets":["binary"]},{"id":"paper-quelle","title":"Decompiling Quantum Assembly into Structured Programs","title_zh":"将量子汇编反编译为结构化程序","description_en":"Quelle recovers library calls, loops, functions and symbolic parameters from compiled OpenQASM. It removes routing artifacts, proposes structured reconstructions and checks them against circuit semantics, retaining gate-level fallbacks when recovery fails.","description_zh":"Quelle 从编译后的 OpenQASM 恢复库调用、循环、函数及符号参数，通过消除路由痕迹、提出结构化重建并核对电路语义，在恢复失败时保留门级表示。","authors":["Pingchuan Ma","Zhantong Xue","Zongjie Li","Qixin Zhang","Yuxuan Du","Zhaoyu Wang","Yuguang Zhou","Shuai Wang","Xiaoqin Zhang"],"authors_omitted":null,"venue":"arXiv","doi":"10.48550/arxiv.2610.05012","arxiv_id":"2610.05012","year":2026,"publication_status":"preprint","targets":["binary"]},{"id":"paper-asap-decompilation","title":"ASAP: Assembly-Source Aligned Pseudocode Refinement For Binary Decompilation","title_zh":"ASAP：通过汇编与源码对齐改进二进制反编译伪代码","description_en":"ASAP aligns assembly and source representations during training, compresses assembly features into tokens, and supplies them alongside decompiler pseudocode to an LLM refiner. Masking and an assembly-advantage objective encourage the refiner to use low-level evidence.","description_zh":"ASAP 在训练中对齐汇编与源码表示，将汇编特征压缩为标记，并与反编译伪代码一起交给 LLM 改进。掩码及汇编优势目标用于鼓励模型利用低层证据。","authors":["Yujian Zhuang","Dehong Gao","Qichao Zhang","Qijing Lai","Jiaxin Wang","Libin Yang","Xiaoyan Cai"],"authors_omitted":null,"venue":"arXiv","doi":null,"arxiv_id":"2610.06900","year":2026,"publication_status":"preprint","targets":["binary"]},{"id":"paper-faultless","title":"Faultless: A Program Equivalence Technique for Validating and Evaluating Neural Decompilers","title_zh":"Faultless：验证和评估神经反编译器的程序等价性方法","description_en":"Compares neural-decompiler C output with deterministic decompilation or reference functions using symbolic execution and a specialized memory model. It supports both analyst-facing validation and model evaluation without requiring the surrounding codebase.","description_zh":"利用符号执行与专门的内存模型，将神经反编译器生成的 C 代码与确定性反编译结果或参考函数比较，无需完整周边代码库，可用于分析人员的结果核查及模型评估。","authors":["Luke Dramko","Claire Le Goues","Edward Schwartz"],"authors_omitted":null,"venue":"arXiv","doi":"10.48550/arxiv.2609.34089","arxiv_id":"2609.34089","year":2026,"publication_status":"preprint","targets":["binary"]},{"id":"paper-extractor-development-reliability","title":"Between the Commits: Process, Error, and Claim Reliability in a Wholly AI-Authored Codebase","title_zh":"提交之间：一个完全由 AI 编写的代码库中的过程、错误与陈述可靠性","description_en":"Studies development of the Extractor reverse-engineering tool through commits, available session logs and code-provenance tracing. Taxonomies separate instruction intent, change triggers and agent claims, exposing errors corrected before commits that ordinary repository history misses.","description_zh":"通过提交、可用会话日志及代码溯源研究 Extractor 逆向工具的开发，用分类体系区分指令意图、变更触发因素及智能体陈述，揭示普通仓库历史无法反映的提交前纠错。","authors":["Douglas Leith"],"authors_omitted":null,"venue":"arXiv","doi":null,"arxiv_id":"2609.29744","year":2026,"publication_status":"preprint","targets":["binary","protocol"]},{"id":"paper-echo-matching-decompilation","title":"Echo: Learning-based Matching Decompilation using Trusted Back Translation","title_zh":"Echo：基于可信回译的学习式匹配反编译","description_en":"Echo iteratively generates source and compiler configurations, recompiles candidates, and uses assembly differences to guide configuration search and code refinement. It evaluates matching on function benchmarks and selected functions from a Mirai binary.","description_zh":"Echo 迭代生成源码及编译配置，重新编译候选，并使用汇编差异指导配置搜索与代码修正。研究在函数基准和一个 Mirai 二进制的部分函数上评估匹配结果。","authors":["Jun Bi","Xiangxin Fang","Aarsh Chaube","José Wesley De Souza Magalhães","Rodrigo C. O. Rocha","Michael O'Boyle"],"authors_omitted":null,"venue":"arXiv","doi":null,"arxiv_id":"2609.18706","year":2026,"publication_status":"preprint","targets":["binary"]},{"id":"paper-memorization-floor","title":"A Memorization Floor for LLM Refinement of Decompiled Code","title_zh":"大语言模型改进反编译代码中的记忆基线","description_en":"Studies whether LLM refinement of decompiled C recovers identifiers from input evidence or prior knowledge. Within-item ablations and output-matched chance baselines test naming gains on textbook and newly authored functions, including a second-model replication.","description_zh":"研究大语言模型改进反编译 C 代码时，标识符恢复来自输入证据还是先验知识。通过同一条目的消融实验和与输出词汇匹配的随机基线，比较教材式函数与新编写函数的命名增益，并进行第二模型复核。","authors":["Muhammad Asjad"],"authors_omitted":null,"venue":"arXiv","doi":"10.48550/arxiv.2609.17236","arxiv_id":"2609.17236","year":2026,"publication_status":"preprint","targets":["binary"]},{"id":"paper-decompile-diverge","title":"When LLM Decompilers Recompile More and Preserve Less","title_zh":"当 LLM 反编译器更易重编译，却更少保留原始行为","description_en":"Decompile-Diverge builds function-level behavioral comparisons from source-derived drivers and fuzzed reference inputs. The study compares reconstructed functions on the same inputs and examines divergences and missing crashes that compilation and supplied tests can miss.","description_zh":"Decompile-Diverge 基于源码生成驱动，并对参考实现进行模糊测试，以构建函数级行为比较。研究让重建函数使用相同输入，检查编译及既有测试可能漏掉的行为差异与崩溃消失。","authors":["Chang Liu","Edward Raff","Kristopher Micinski"],"authors_omitted":null,"venue":"arXiv","doi":null,"arxiv_id":"2609.05370","year":2026,"publication_status":"preprint","targets":["binary"]},{"id":"paper-resource","title":"Decoupling is a Necessity: Transformation-Agnostic Decompiled Code Recovery under Optimization and Obfuscation","title_zh":"解耦的必要性：面向优化与混淆、无需识别具体变换的反编译代码恢复","description_en":"ReSource refines decompiled functions affected by compiler optimization and obfuscation. Its stages retrieve guidance from a Semantic Distortion Database, predict a control-flow skeleton, and refine names and formatting. Evaluation measures code similarity and retrieval of the corresponding original function from a source corpus.","description_zh":"ReSource 针对受编译优化与混淆影响的反编译函数进行修复：先从语义失真数据库检索指导信息，再预测控制流骨架，最后调整名称与格式。评估衡量代码相似性，以及能否从源码语料中检索到对应的原始函数。","authors":["Zhiping Zhou","Xiaohong Li","Ruitao Feng","Yao Zhang","Yuekang Li","Wenbu Feng"],"authors_omitted":null,"venue":"arXiv","doi":null,"arxiv_id":"2608.27889","year":2026,"publication_status":"preprint","targets":["binary"]},{"id":"paper-still-stl","title":"STILL: Recovering Lowered STL Semantics for LLM-assisted C++ Decompilation","title_zh":"STILL：为 LLM 辅助 C++ 反编译恢复编译后隐藏的 STL 语义","description_en":"STILL predicts function-level STL container presence from stripped control-flow graphs and turns those predictions into compact hints for LLM refinement of Ghidra output. StlBench supplies controlled labels for five container classes.","description_zh":"STILL 从去符号控制流图预测函数级 STL 容器的存在情况，并将预测转成紧凑提示，供 LLM 改进 Ghidra 输出。StlBench 为五类容器提供受控标注。","authors":["Xiaohan Wang","Kevin Leach"],"authors_omitted":null,"venue":"arXiv","doi":null,"arxiv_id":"2608.26408","year":2026,"publication_status":"preprint","targets":["binary"]},{"id":"paper-evolution-binary-decompilation","title":"The Evolution of Binary Decompilation in the Modern Era: A Taxonomy, Literature Review, and Future Perspectives","title_zh":"现代二进制反编译的演进：分类体系、文献回顾与未来展望","description_en":"This survey maps traditional, dynamic, matching and neural decompilation approaches, then organizes type recovery, control-flow restructuring, naming and refinement tasks alongside evaluation metrics and benchmark choices. An accompanying repository provides the reviewed literature list.","description_zh":"该综述梳理传统、动态、匹配及神经反编译方法，并组织类型恢复、控制流重构、命名和改进等任务及其评估指标、基准选择。配套仓库提供所审文献列表。","authors":["Omar Abusabha","Sungjae Hwang"],"authors_omitted":null,"venue":"arXiv","doi":null,"arxiv_id":"2608.24955","year":2026,"publication_status":"preprint","targets":["binary"]},{"id":"paper-bridge-lifting","title":"Lifting Optimized Binaries to Canonical Compiler IR via Structure-Aware Retrieval and Iterative Verification","title_zh":"基于结构感知检索与迭代验证将优化二进制提升为规范编译器 IR","description_en":"BRIDGE lifts stripped, optimized x86-64 and ARM64 functions, given as llvm-objdump disassembly, to LLVM IR. Its target is the unoptimized IR that a fixed clang -O0 configuration emits for the original source. Offline, it builds a retrieval database from 69,253 ExeBench functions compiled at -O0 to -O3, using LLVM pseudo-probe instrumentation to align assembly fragments with the matching -O0 IR regions. At inference it splits each function's angr-recovered control-flow graph into control-flow segments such as loops and if–else regions, retrieves the three nearest aligned assembly–IR pairs per segment from a FAISS index of Nova-1.3B embeddings, and prompts a hosted general-purpose LLM (DeepSeek-chat) to write the IR. Up to five refinement rounds then feed LLVM verifier and compiler diagnostics and unit-test failures back to the model. On HumanEval-Decompile and MBPP compiled with Clang 19 at -O0 to -O3, average re-executability is 65.2% and 65.4% on x86-64 and 45.6% and 42.1% on ARM64. The rule-based MCTOLL reaches 62.1% and 64.9% on x86-64, and the five directly prompted API LLMs reach at most 21.5%.","description_zh":"BRIDGE 将以 llvm-objdump 反汇编形式给出的、已剥离符号并经过优化的 x86-64 与 ARM64 函数提升为 LLVM IR，目标是固定 clang -O0 配置为原始源码生成的未优化 IR。离线阶段，它将 69,253 个 ExeBench 函数分别以 -O0 至 -O3 编译并构建检索数据库，借助 LLVM 伪探针插桩将汇编片段与对应的 -O0 IR 区域对齐。推理时，它把 angr 恢复的函数控制流图划分为循环、if–else 等控制流片段，从基于 Nova-1.3B 嵌入的 FAISS 索引中为每个片段检索三个最相近的已对齐汇编—IR 对，再提示托管的通用大语言模型（DeepSeek-chat）生成 IR。随后最多进行五轮修正，把 LLVM 校验器与编译器诊断信息以及单元测试失败结果反馈给模型。在以 Clang 19 按 -O0 至 -O3 编译的 HumanEval-Decompile 与 MBPP 上，其平均可重新执行率在 x86-64 上为 65.2% 和 65.4%，在 ARM64 上为 45.6% 和 42.1%。基于规则的 MCTOLL 在 x86-64 上为 62.1% 和 64.9%，五个直接提示的 API 大语言模型最高为 21.5%。","authors":["Xiaoao Zhu","Jie Ren","Zhiqiang Li","Jie Zheng","Zhanyong Tang","Zheng Wang"],"authors_omitted":null,"venue":"ACL 2026","doi":"10.18653/v1/2026.acl-long.527","arxiv_id":null,"year":2026,"publication_status":"conference-paper","targets":["binary"]},{"id":"paper-asmfooler","title":"Fool Me If You Can: On the Robustness of Binary Code Similarity Detection Models against Semantics-Preserving Transformations","title_zh":"有本事就骗过我：二进制代码相似性检测模型对语义保持变换的鲁棒性研究","description_en":"The paper builds asmFooler to test whether learned binary code similarity detection (BCSD) models keep matching functions after semantics-preserving changes. From 620 baseline x86-64 ELF binaries (coreutils, binutils, PuTTY, nginx, SPEC2006 and others, built with Clang at O0–O3), it generates 9,565 variants using in-place instruction rewriting, basic-block reordering, Obfuscator-LLVM, semantic NOPs and junk code, and it adds a greedy search for dead-code sequences that make dissimilar functions look similar. Across Genius, Gemini, Asm2Vec, SAFE, Trex and BinShot, robustness depends on each model's preprocessing, architecture and features: block reordering drops BinShot's recall from 0.972 to 0.036 but lowers it by under 0.05 for the CFG-based Genius and Gemini. The false-positive attack reaches up to 100% success with 14.75 inserted instructions on average.","description_zh":"论文构建 asmFooler，用于检验基于学习的二进制代码相似性检测（BCSD）模型在语义保持的改动后能否继续匹配函数。它以 620 个基准 x86-64 ELF 二进制（包括 coreutils、binutils、PuTTY、nginx、SPEC2006 等，均由 Clang 以 O0–O3 编译）为起点，通过原地指令改写、基本块重排、Obfuscator-LLVM、语义空操作和垃圾代码插入生成 9,565 个变体，并加入一种贪心搜索，寻找能让不相似函数显得相似的死代码序列。在 Genius、Gemini、Asm2Vec、SAFE、Trex 与 BinShot 上的结果表明，鲁棒性取决于各模型的预处理、架构与特征：基本块重排使 BinShot 的召回率从 0.972 降至 0.036，而基于控制流图的 Genius 与 Gemini 召回率降幅不足 0.05。误报攻击的成功率最高可达 100%，平均只需插入 14.75 条指令。","authors":["Jiyong Uhm","Minseok Kim","Michalis Polychronakis","Hyungjoon Koo"],"authors_omitted":null,"venue":"Proceedings of the ACM on Software Engineering (FSE 2026)","doi":"10.1145/3797116","arxiv_id":"2602.12681","year":2026,"publication_status":"journal-article","targets":["binary"]},{"id":"paper-mirrorcode","title":"MirrorCode: AI can rebuild entire programs from behavior alone","title_zh":"MirrorCode：仅凭行为重建完整程序的评测","description_en":"Tests reimplementation of 25 command-line programs using execute-only reference access, documentation and visible examples. Separate scoring environments compare exact outputs on visible and held-out end-to-end tests.","description_zh":"利用仅可执行的参考程序、文档及可见样例，评测 25 个命令行程序的重新实现；在独立评分环境中对可见及留出端到端测试进行精确输出比较。","authors":["Tom Adamczewski","David Owen","David Rein","Florian Brand","Giles Edkins","Allen Hart","Daniel O'Connell"],"authors_omitted":null,"venue":"arXiv","doi":"10.48550/arxiv.2606.30182","arxiv_id":"2606.30182","year":2026,"publication_status":"preprint","targets":["binary","app"]},{"id":"paper-sok-ai-binary-reversing","title":"SoK: AI-Augmented Binary Reversing","title_zh":"SoK：人工智能增强的二进制逆向工程","description_en":"A systematization-of-knowledge survey of machine-learning, LLM and agentic approaches to binary reversing. Version 2 collects 246 papers published since 2015, found through keyword searches of 11 security, software-engineering and AI venues plus citation snowballing, and organizes them into 22 domains by inference task: from code-boundary detection and recovery of function names, types and struct layouts to code similarity, malware and vulnerability analysis, and decompilation. Its taxonomy links conventional triage, static, dynamic and security-testing analyses to AI pipelines through the binary-derived artifacts they exchange, and it derives 12 insights and open directions such as binary-aligned ground truth and goal-driven agentic reversing.","description_zh":"一篇系统化知识综述，梳理机器学习、大语言模型与智能体方法在二进制逆向中的应用。第二版通过关键词检索 11 个安全、软件工程与人工智能会议并辅以引文滚雪球，收集 2015 年以来的 246 篇论文，按推断任务归入 22 个领域：从代码边界检测，到函数名、类型与结构体布局恢复，再到代码相似性、恶意软件与漏洞分析以及反编译。其分类体系通过二进制派生的分析产物，把传统的初筛、静态分析、动态分析与安全测试同人工智能流程联系起来，并总结出 12 条洞见及若干开放方向，例如与二进制对齐的语义真值和目标驱动的智能体逆向。","authors":["Yujeong Kwon","Yiyue Zhang","Kexin Pei","Dokyung Song","Hyungjoon Koo"],"authors_omitted":null,"venue":"arXiv","doi":null,"arxiv_id":"2606.17398","year":2026,"publication_status":"preprint","targets":["binary"]},{"id":"paper-autodecompiler","title":"Binary Decompilation LLM with Feedback-Driven Multi-Turn Refinement","title_zh":"基于反馈驱动多轮修正的二进制反编译大语言模型","description_en":"AutoDecompiler trains function-level decompilation models to revise assembly- or pseudocode-derived outputs using compilation, execution and I/O feedback. Its reinforcement-learning design combines diagnostic feedback with rewards for valid code, tested behavior, syntax and data-flow structure.","description_zh":"AutoDecompiler 训练函数级反编译模型，利用编译、执行及 I/O 反馈修正汇编或伪代码输入产生的输出。其强化学习设计结合诊断反馈及代码有效性、测试行为、语法和数据流结构奖励。","authors":["Peipei Liu","Jian Sun","Mingzhe Xing","Yicheng Zeng","Zhaoteng Yan","Lixiao Zhang","Li Chen","Dan Li"],"authors_omitted":null,"venue":"arXiv","doi":null,"arxiv_id":"2606.16162","year":2026,"publication_status":"preprint","targets":["binary"]},{"id":"paper-qrs-readability","title":"LLM Agent-Assisted Reverse Engineering with Quantitative Readability Metrics","title_zh":"以量化可读性指标引导 LLM 智能体辅助逆向工程","description_en":"Uses a composite Quantitative Readability Score (QRS) to guide agents refining decompiled C. Lexical familiarity, structural simplicity and coding idioms are combined with a binary-structure similarity gate. Experiments compare refinement with and without shell access on 210 simple C binaries.","description_zh":"用综合量化可读性分数（QRS）引导智能体改进反编译 C 代码，将词汇熟悉度、结构简洁度和编程惯用法与二进制结构相似性门槛结合，在 210 个简单 C 二进制程序上比较有无 shell 访问的迭代。","authors":["Neil Archibald","Ruben Thijssen"],"authors_omitted":null,"venue":"arXiv","doi":null,"arxiv_id":"2606.06838","year":2026,"publication_status":"preprint","targets":["binary"]},{"id":"paper-scdbench","title":"SCDBench: A Benchmark for LLM-Based Smart Contract Decompilers","title_zh":"SCDBench：基于大语言模型的智能合约反编译器基准","description_en":"Benchmarks LLM-based EVM decompilation on 600 source-verified Ethereum Solidity contracts, sampled in easy, medium and hard thirds from 772,736 unique bytecode–source pairs after near-duplicate filtering. Each task supplies EVM assembly and optional four-byte selector hints and asks for self-contained Solidity with compiler settings. Outputs are scored in four cumulative stages: format completeness, compilation, ABI recovery, and semantic consistency, where 227,383 recorded test cases for 14,553 public functions are replayed on the recompiled output. With one compiler-feedback repair call, GPT-5.3-Codex compiled 90.3% of contracts, while the best semantic results were 29.4% of functions and 42 of 600 contracts recovered perfectly, both by Claude Opus 4.7.","description_zh":"在 600 个源码已验证的以太坊 Solidity 合约上评测基于大语言模型的 EVM 反编译。这些合约在近重复过滤后，从 772,736 对唯一的字节码—源码中按简单、中等、困难各三分之一抽样。每个任务提供 EVM 汇编及可选的四字节选择器提示，要求输出自包含的 Solidity 代码与编译器设置。输出按四个累进阶段评分：格式完整性、编译、ABI 恢复，以及语义一致性；最后一阶段在重新编译的输出上重放为 14,553 个公共函数记录的 227,383 个测试用例。借助一次基于编译器反馈的修复调用，GPT-5.3-Codex 使 90.3% 的合约成功编译；语义方面的最佳结果均来自 Claude Opus 4.7，即 29.4% 的函数一致，600 个合约中有 42 个被完全恢复。","authors":["Kaihua Qin","Dawn Song","Arthur Gervais"],"authors_omitted":null,"venue":"arXiv","doi":null,"arxiv_id":"2605.29059","year":2026,"publication_status":"preprint","targets":["binary"]},{"id":"paper-packer-identification-semantic-validation","title":"Semantic Validation of Packer Identification Tools: Characterization, Repair, and Downstream Impact","title_zh":"加壳识别工具的语义验证：特征分析、修正与下游影响","description_en":"Uses unpacking outcomes as reference evidence to assess packer labels, normalizes heterogeneous tool results, and evaluates complementary signature/heuristic pools with static predicates derived from unpacker implementations. It traces how identification errors affect later unpacking and malware classification.","description_zh":"以脱壳结果作为参考证据评估壳标签，规范化不同工具的输出，并评估互补签名／启发式规则池及从脱壳器实现提取的静态判定条件；同时追踪识别错误对后续脱壳和恶意软件分类的影响。","authors":["Fangtian Zhong","Zhuoyun Qian","Yili Jiang","Jiaqi Huang","Yunming Pang","Xiuzhen Cheng"],"authors_omitted":null,"venue":"arXiv","doi":"10.48550/arxiv.2605.25923","arxiv_id":"2605.25923","year":2026,"publication_status":"preprint","targets":["binary"]},{"id":"paper-decaf","title":"Decaf: Improving Neural Decompilation with Automatic Feedback and Search","title_zh":"Decaf：通过自动反馈与搜索改进神经反编译","description_en":"Decaf samples multiple candidate decompilations, recompiles them and ranks them using compiler-derived byte distance or a learned reranker. The work studies candidate selection as a way to improve neural decompilation without an iterative source-repair conversation.","description_zh":"Decaf 采样多个反编译候选，重新编译后利用字节距离或学习式重排序器排序。研究通过候选选择改进神经反编译，而非使用迭代源码修复对话。","authors":["Alexander Shypula","Osbert Bastani","Edward Schwartz"],"authors_omitted":null,"venue":"arXiv","doi":null,"arxiv_id":"2605.11501","year":2026,"publication_status":"preprint","targets":["binary"]},{"id":"paper-notdec","title":"NotDec: WebAssembly Decompilation With Inter-Procedural Type Recovery","title_zh":"NotDec：通过跨过程类型恢复进行 WebAssembly 反编译","description_en":"NotDec lifts WebAssembly into SSA-based IR, uses Retypd-derived type constraints and pointer/value distinctions to recover structures, and emits C. Its study separates full interprocedural analysis from a faster intraprocedural variant.","description_zh":"NotDec 将 WebAssembly 提升为 SSA 中间表示，通过基于 Retypd 的类型约束及指针／数值区分恢复结构，并生成 C。研究区分完整跨过程分析与较快的过程内变体。","authors":["Jikai Wang","Ningyu He","Tianming Liu","Junhai Wang","Haoyu Wang"],"authors_omitted":null,"venue":"ICSE 2026","doi":"10.1145/3744916.3787762","arxiv_id":"2608.03286","year":2026,"publication_status":"conference-paper","targets":["binary"]},{"id":"paper-helios","title":"HELIOS: Hierarchical Graph Abstraction for Structure-Aware LLM Decompilation","title_zh":"HELIOS：面向结构感知大语言模型反编译的分层图抽象","description_en":"HELIOS gives an LLM a hierarchical summary of binary control flow and function calls alongside decompiler output, with optional compiler feedback. It evaluates compilability and functional correctness.","description_zh":"HELIOS 将二进制程序的控制流和函数调用整理成分层摘要，与反编译器输出一同提供给大语言模型，并可加入编译器反馈。论文评估了生成代码的可编译性和功能正确性。","authors":["Yonatan Gizachew Achamyeleh","Harsh Thomare","Mohammad Abdullah Al Faruque"],"authors_omitted":null,"venue":"arXiv","doi":null,"arxiv_id":"2601.14598","year":2026,"publication_status":"preprint","targets":["binary"]},{"id":"paper-deception-delta","title":"The Deception Delta: Adversarial Evaluation of LLM-Based Smart Contract Bytecode Forensics","title_zh":"Deception Delta：基于大语言模型的智能合约字节码取证对抗评测","description_en":"Evaluates how language models interpret raw EVM bytecode from purpose-built deceptive and control contracts. It distinguishes recognizing a hidden transfer mechanism from correctly judging its risk, using model judges alongside judge-independent checks.","description_zh":"评估语言模型如何解释人工构造的欺骗性合约与对照合约的原始 EVM 字节码，区分识别隐藏转账机制与正确判断其风险，并结合模型评审和不依赖评审模型的检查。","authors":["Timo Schefold"],"authors_omitted":null,"venue":"ACM CCS 2026","doi":"10.48550/arxiv.2609.14098","arxiv_id":"2609.14098","year":2026,"publication_status":"conference-accepted","targets":["binary"]},{"id":"paper-sk2decompile","title":"SK2Decompile: LLM-based Two-Phase Binary Decompilation from Skeleton to Skin","title_zh":"SK2Decompile：从骨架到皮肤的大语言模型两阶段二进制反编译","description_en":"Splits LLM decompilation into two phases: a Structure Recovery model turns decompiler pseudocode into an identifier-free IR that keeps control flow and data structures, trained with compiler-based RL rewards, and an Identifier Naming model then restores names under a semantic-similarity reward. The authors report a 21.6% average re-executability gain over GPT-5-mini on HumanEval and a 29.4% average R2I improvement over Idioms on GitHub2025.","description_zh":"将 LLM 反编译分为两个阶段：结构恢复模型把反编译器伪代码转换为保留控制流和数据结构、但不含标识符的中间表示，并以编译器反馈作为强化学习奖励；标识符命名模型再以语义相似度为奖励恢复名称。作者报告，其在 HumanEval 上的平均可重新执行率比 GPT-5-mini 高 21.6%，在 GitHub2025 上的平均 R2I 比 Idioms 提升 29.4%。","authors":["Hanzhuo Tan","Weihao Li","Xiaolong Tian","Siyi Wang","Jiaming Liu","Jing Li","Yuqun Zhang"],"authors_omitted":null,"venue":"ICLR 2026","doi":null,"arxiv_id":"2509.22114","year":2026,"publication_status":"conference-paper","targets":["binary"]},{"id":"paper-shieldedcode","title":"ShieldedCode: Learning Robust Representations for Virtual Machine Protected Code","title_zh":"ShieldedCode：学习虚拟机保护代码的鲁棒表示","description_en":"ShieldedCode studies software protection from the defender's side: it trains code language models on pairs of C source functions and their virtualization-protected (VMP) x86-64 code so that the models can generate, compare and rank protected variants. Training pairs come from AnghaBench functions compiled at O0–O3, protected at levels L0–L3 by a commercial VMP tool, then disassembled and normalized. The model adds attention masks for dependencies within, between adjacent and across virtual instructions, contrastive objectives for functional equivalence and protection strength, and a protection-effectiveness task that ranks variants of the same source. Continual pre-training starts from CodeLlama 34B and adds The Stack to the corpus, and fine-tuning uses 2.5 million source–VM pairs. On HumanEval-compile, VM code generation reaches 26.95% Pass@1 at level L0 (GPT-4o: 22.58%) and 14.71% at L3. On BinaryCorp-VirtualAssembly similarity detection, Recall@1 for the O0+L1 setting is 0.488, against 0.333 for jTrans with a linear probe. The authors also run a manual reverse-engineering study and pattern-matching and angr attacks on the generated protection.","description_zh":"ShieldedCode 从防御方角度研究软件保护：它以 C 源代码函数及其经虚拟化保护（VMP）后的 x86-64 代码组成的配对数据训练代码语言模型，使模型能够生成、比较和排序受保护的变体。训练配对取自 AnghaBench 函数，经 O0–O3 编译后由一款商业 VMP 工具按 L0–L3 级别保护，再反汇编并规范化。模型为单条虚拟指令内部、相邻虚拟指令之间以及跨虚拟指令的依赖加入注意力掩码，采用面向功能等价和保护强度的对比学习目标，并设置对同一源代码不同变体排序的保护效果任务。持续预训练从 CodeLlama 34B 起步，语料另加入 The Stack；微调使用 250 万组源代码—虚拟机代码配对。在 HumanEval-compile 上，L0 级虚拟机代码生成的 Pass@1 为 26.95%（GPT-4o 为 22.58%），L3 级为 14.71%。在 BinaryCorp-VirtualAssembly 相似性检测中，O0+L1 设置下的 Recall@1 为 0.488，采用线性探针的 jTrans 为 0.333。作者还对生成的保护代码开展了人工逆向研究，以及模式匹配和 angr 攻击。","authors":["Mingqiao Mo","Yunlong Tan","Hao Zhang","Heng Zhang","Yangfan He"],"authors_omitted":null,"venue":"ICLR 2026","doi":null,"arxiv_id":"2601.20679","year":2026,"publication_status":"conference-paper","targets":["binary"]},{"id":"paper-idioms","title":"Idioms: A Simple and Effective Framework for Turbo-Charging Local Neural Decompilation with Well-Defined Types","title_zh":"Idioms：以明确定义的类型显著增强局部神经反编译的简单有效框架","description_en":"Idioms fine-tunes code language models to turn Hex-Rays output for one target function into predicted original C together with definitions of the user-defined structs, unions and typedefs it uses. Input can include neighboring decompiled functions in breadth-first call-graph order, so evidence about a type scattered across callers and callees reaches the model. The authors also build Realtype, 157,163 functions from compiled open-source C repositories with full type definitions. Their CodeGemma-7b-based model passes ExeBench unit tests for 54.4% of functions versus 46.3% for LLM4Decompile and 37.5% for Nova, and scores at least 95% higher on Realtype.","description_zh":"Idioms 微调代码语言模型，把单个目标函数的 Hex-Rays 输出转换为预测的原始 C 代码，并同时给出其中使用的用户自定义结构体、联合体和类型别名定义。输入可按调用图广度优先顺序附带相邻的反编译函数，使分散在调用者与被调用者中的类型线索能够提供给模型。作者还构建了 Realtype 数据集，包含来自已编译开源 C 仓库的 157,163 个函数及完整类型定义。其基于 CodeGemma-7b 的模型在 ExeBench 上有 54.4% 的函数通过单元测试，LLM4Decompile 为 46.3%，Nova 为 37.5%；在 Realtype 上的得分至少高出 95%。","authors":["Luke Dramko","Claire Le Goues","Edward J. Schwartz"],"authors_omitted":null,"venue":"NDSS 2026","doi":"10.14722/ndss.2026.240795","arxiv_id":"2502.04536","year":2026,"publication_status":"conference-paper","targets":["binary"]},{"id":"paper-fidelitygpt","title":"FidelityGPT: Correcting Decompilation Distortions with Retrieval Augmented Generation","title_zh":"FidelityGPT：利用检索增强生成纠正反编译失真","description_en":"FidelityGPT post-processes existing decompiler output: an LLM labels lines with six distortion types, such as non-conventional dereferencing, redundant variables and confusing control flow, and then rewrites the labeled lines. Its prompts define the distortion types and add retrieval-augmented context from a manually annotated database of distorted IDA Pro and Ghidra lines. A semantic-intensity algorithm chooses which lines to query, and a variable-dependency analysis carries redundant-variable context across 50-line chunks. On 620 function pairs, the authors report 89% detection accuracy and 83% precision, and correction fix rates of 94% (FR) and 64% (CFR) against 83% and 37% for their DeGPT runs.","description_zh":"FidelityGPT 对现有反编译器输出进行后处理：由大语言模型为代码行标注六类失真（如非常规解引用、冗余变量和令人困惑的控制流），再改写被标注的行。其提示词定义各失真类型，并从人工标注的 IDA Pro 与 Ghidra 失真代码行数据库中检索增强上下文。语义强度算法负责选择用于查询的代码行，变量依赖分析则在 50 行分块之间传递冗余变量上下文。作者在 620 对函数上报告检测准确率 89%、精确率 83%，纠正的修复率（FR）为 94%、正确修复率（CFR）为 64%，而他们运行的 DeGPT 分别为 83% 和 37%。","authors":["Zhiping Zhou","Xiaohong Li","Ruitao Feng","Yao Zhang","Yuekang Li","Wenbu Feng","Yunqian Wang","Yuqing Li"],"authors_omitted":null,"venue":"NDSS 2026","doi":"10.14722/ndss.2026.230989","arxiv_id":"2510.19615","year":2026,"publication_status":"conference-paper","targets":["binary"]},{"id":"paper-chisel-iterative-recovery","title":"CHISEL-ing Back Source Code with AI-enabled Iterative Recovery","title_zh":"CHISEL：借助 AI 迭代恢复源码","description_en":"CHISEL refines Ghidra pseudocode using compiler diagnostics and type-aware differential fuzzing against the original function. It retains counterexamples and candidate history; existing I/O pairs are held out for evaluation rather than supplied to the recovery loop.","description_zh":"CHISEL 利用编译诊断及针对原函数的类型感知差分模糊测试改进 Ghidra 伪代码，并保留反例与候选历史。既有 I/O 样例用于保留评测，不提供给恢复循环。","authors":["Varun Kohli","N Raghava","Biplab Sikdar","Dinil Mon Divakaran"],"authors_omitted":null,"venue":"SURE @ ACM CCS 2026","doi":null,"arxiv_id":"2608.27981","year":2026,"publication_status":"conference-accepted","targets":["binary"]},{"id":"paper-rex86","title":"REx86: A Local Large Language Model for Assisting in x86 Assembly Reverse Engineering","title_zh":"REx86：辅助 x86 汇编逆向工程的本地大语言模型","description_en":"The paper fine-tunes eight local models from CodeLlama, Qwen2.5-Coder, and CodeGemma on 5,981 x86 assembly examples and evaluates their help with binary reverse engineering.","description_zh":"论文使用 5,981 个 x86 汇编样例微调了 CodeLlama、Qwen2.5-Coder 和 CodeGemma 系列的八个本地模型，并评估它们辅助二进制逆向工程的效果。","authors":["Darrin Lea","James Ghawaly","Golden Richard","Aisha Ali-Gombe","Andrew Case"],"authors_omitted":null,"venue":"2025 IEEE Annual Computer Security Applications Conference (ACSAC)","doi":"10.1109/acsac67867.2025.00024","arxiv_id":"2510.20975","year":2025,"publication_status":"conference-paper","targets":["binary","firmware"]},{"id":"paper-wasm-decompiler-study","title":"Is This the Same Code? A Comprehensive Study of Decompilation Techniques for WebAssembly Binaries","title_zh":"这还是同一份代码吗？WebAssembly 二进制反编译技术的全面研究","description_en":"Measures how well existing WebAssembly decompilers recover C, with native-binary decompilers as the baseline. The same C programs are compiled with Emscripten to WebAssembly and with clang to native code, then decompiled by wasm2c, w2c2 and wasm-decompile or by Ghidra and RetDec. Correctness reuses 1,000 Csmith programs from DecFuzzer, recompiling the output and comparing its execution with the original; code-complexity metrics and AST similarity to the original source are measured on PolyBenchC and CHStone at -O0 to -O2. wasm2c passed all 1,000 correctness programs, against 649 for wasm-decompile, 818 for Ghidra and 775 for RetDec.","description_zh":"以原生二进制反编译器为基线，衡量现有 WebAssembly 反编译器恢复 C 代码的能力。同一批 C 程序分别经 Emscripten 编译为 WebAssembly、经 clang 编译为原生代码，再由 wasm2c、w2c2 与 wasm-decompile，或由 Ghidra 与 RetDec 反编译。正确性评测复用 DecFuzzer 的 1,000 个 Csmith 程序，将输出重新编译并与原程序的执行结果比较；代码复杂度指标及与原始源码的 AST 相似度则在 PolyBenchC 和 CHStone 上以 -O0 至 -O2 测量。wasm2c 通过了全部 1,000 个正确性程序，wasm-decompile、Ghidra 和 RetDec 分别为 649、818 和 775 个。","authors":["Wei-Cheng Wu","Yutian Yan","Hallgrimur David Egilsson","David Park","Steven Chan","Christophe Hauser","Weihang Wang"],"authors_omitted":null,"venue":"SecureComm 2024","doi":"10.1007/978-3-031-94448-2_6","arxiv_id":"2411.02278","year":2025,"publication_status":"conference-paper","targets":["binary"]},{"id":"paper-binmetric","title":"BinMetric: A Comprehensive Binary Code Analysis Benchmark for Large Language Models","title_zh":"BinMetric：面向大语言模型的综合二进制代码分析基准","description_en":"BinMetric poses 1,000 questions across six binary-analysis tasks: call-site reconstruction, decompilation, signature recovery, binary code summarization, algorithm classification and assembly instruction generation. The questions come from 20 open-source C projects compiled for x86-64, stripped and processed with IDA Pro, and aligned with source code through DWARF information. The authors evaluate 12 LLMs from five model families with one-shot prompts, alongside IDA Pro’s decompiler, LLM4Decompile, BinT5 and HexT5 where those apply.","description_zh":"BinMetric 提供六类二进制分析任务共 1,000 道题目：调用点重建、反编译、函数签名恢复、二进制代码摘要、算法分类与汇编指令生成。题目取自 20 个开源 C 项目：项目针对 x86-64 编译、剥离符号并经 IDA Pro 处理，再借助 DWARF 信息与源码对齐。作者使用单样例提示评测来自五个模型家族的 12 个大语言模型，并在适用任务上与 IDA Pro 反编译器、LLM4Decompile、BinT5 和 HexT5 对比。","authors":["Xiuwei Shang","Guoqiang Chen","Shaoyin Cheng","Benlong Wu","Li Hu","Gangyang Li","Weiming Zhang","Nenghai Yu"],"authors_omitted":null,"venue":"IJCAI 2025","doi":"10.24963/ijcai.2025/858","arxiv_id":"2505.07360","year":2025,"publication_status":"conference-paper","targets":["binary"]},{"id":"paper-llm-code-deobfuscation","title":"Exploring the Potential of LLMs for Code Deobfuscation","title_zh":"探索大语言模型在代码去混淆中的潜力","description_en":"Studies LLMs as source-to-source deobfuscators for C functions protected with the Tigress obfuscator. Functions from ExeBench, with identifiers randomized, are obfuscated with five transformations: MBA arithmetic encoding, branch encoding, control-flow flattening, opaque predicates and argument randomization. Each model receives a whole obfuscated function and returns simplified C. DeepSeek Coder 6.7B and Code Llama 7B are fine-tuned on obfuscated–original pairs, GPT-4 is prompted, and Clang optimization at -O0 to -O3 serves as a compiler baseline. Simplification is scored with Halstead program length relative to the original and obfuscated code, syntactic correctness by compiling ExeBench wrappers and semantic correctness by ExeBench input/output samples. The fine-tuned models reduce complexity more than GPT-4 on every transformation and more than Clang except on arithmetic encoding and argument randomization, where Clang is on par. Trained on chains of up to five transformations, they keep stable scores on chains of six and seven, and the best model cuts Halstead program length by 89.21% on average in the hardest scenario. A test with randomized constants found one sample that reproduced memorized code.","description_zh":"研究将大语言模型用作源码到源码的去混淆器，处理经 Tigress 混淆器保护的 C 函数。研究从 ExeBench 选取函数并随机化标识符，再施加五种变换：MBA 算术编码、分支编码、控制流平坦化、不透明谓词和参数随机化。模型每次读入一个完整的混淆函数并输出简化后的 C 代码。DeepSeek Coder 6.7B 与 Code Llama 7B 在“混淆—原始”代码对上微调，GPT-4 通过提示使用，Clang 的 -O0 至 -O3 优化则作为编译器基线。简化效果以 Halstead 程序长度相对于原始代码与混淆代码的变化衡量，语法正确性通过编译 ExeBench 包装程序检查，语义正确性则用 ExeBench 输入／输出样例检查。微调模型在每种变换上降低复杂度的幅度都大于 GPT-4，除算术编码和参数随机化（Clang 与之相当）外也大于 Clang。模型在最多五个变换组成的链上训练，在六个和七个变换的链上得分仍保持稳定；最佳模型在最困难场景中平均将 Halstead 程序长度缩减 89.21%。随机化常量的记忆测试只发现一个样本复现了记忆中的代码。","authors":["David Beste","Grégoire Menguy","Hossein Hajipour","Mario Fritz","Antonio Emanuele Cinà","Sébastien Bardin","Thorsten Holz","Thorsten Eisenhofer","Lea Schönherr"],"authors_omitted":null,"venue":"DIMVA 2025","doi":"10.1007/978-3-031-97620-9_15","arxiv_id":null,"year":2025,"publication_status":"conference-paper","targets":["binary"]},{"id":"paper-decompilebench","title":"DecompileBench: A Comprehensive Benchmark for Evaluating Decompilers in Real-World Scenarios","title_zh":"DecompileBench：面向真实场景的反编译器综合评测基准","description_en":"Evaluates traditional and LLM-based decompilers using functions from real programs, runtime behavioral checks, and an LLM-assisted assessment of analyst-facing code understandability.","description_zh":"利用真实程序中的函数、运行时行为检查，以及 LLM 辅助的代码可理解性评估，比较传统反编译器与基于 LLM 的方法。","authors":["Zeyu Gao","Yuxin Cui","Hao Wang","Siliang Qin","Yuanda Wang","Zhang Bolun","Chao Zhang"],"authors_omitted":null,"venue":"Findings of ACL 2025","doi":"10.18653/v1/2025.findings-acl.1194","arxiv_id":"2505.11340","year":2025,"publication_status":"conference-paper","targets":["binary"]},{"id":"paper-llm-evm-decompiler","title":"Decompiling Smart Contracts with a Large Language Model","title_zh":"利用大语言模型反编译智能合约","description_en":"Converts Ethereum Virtual Machine bytecode into Solidity in two stages. Static analysis first lifts the bytecode into three-address code with recovered control flow; a Llama-3.2-3B model fine-tuned with LoRA on 238,446 TAC-to-Solidity function pairs then writes each function. On 9,731 held-out functions from verified Ethereum contracts, the authors report average semantic similarity of 0.82 to the original source, with 78.3% of functions above 0.8. An ablation compares the untuned base model on 663 functions, and case studies decompile an unverified Dx Protocol contract and an exploited MEV bot.","description_zh":"分两个阶段将以太坊虚拟机字节码转换为 Solidity。首先通过静态分析把字节码提升为带有恢复控制流的三地址码；随后由基于 238,446 对三地址码—Solidity 函数、以 LoRA 微调的 Llama-3.2-3B 模型逐个生成函数。作者在来自已验证以太坊合约的 9,731 个留出函数上报告，与原始源码的平均语义相似度为 0.82，78.3% 的函数高于 0.8。消融实验在 663 个函数上比较未微调的基础模型，案例研究则反编译了一个未验证的 Dx Protocol 合约和一个遭攻击的 MEV 机器人合约。","authors":["Isaac David","Liyi Zhou","Dawn Song","Arthur Gervais","Kaihua Qin"],"authors_omitted":null,"venue":"arXiv","doi":null,"arxiv_id":"2506.19624","year":2025,"publication_status":"preprint","targets":["binary"]},{"id":"paper-decllm","title":"DecLLM: LLM-Augmented Recompilable Decompilation for Enabling Programmatic Use of Decompiled Code","title_zh":"DecLLM：借助大语言模型实现可重新编译的反编译，支持以程序化方式使用反编译代码","description_en":"DecLLM repairs decompiler pseudocode that does not recompile into C that compiles and runs, so source-level tools such as CodeQL can be applied to binaries. An iterative loop feeds compiler errors to an off-the-shelf LLM, reverting illegal outputs and large deletions, then uses mismatched test outputs and AddressSanitizer reports from the rebuilt program to repair behavior, and finally fuzzes the original and rebuilt executables for divergences. With GPT-3.5 and GPT-4 the authors report 74% and 78.3% success on 300 Code Contest programs; on Coreutils and CGC binaries, 61.9–70.9% recompile and 48.1–59.0% are fully functional.","description_zh":"DecLLM 将无法重新编译的反编译伪代码修复为可编译、可运行的 C 代码，使 CodeQL 等源码级工具能够用于二进制分析。其迭代流程把编译器错误反馈给现成的大语言模型，并回退非法输出和大段删除；随后利用重建程序与预期不符的测试输出及 AddressSanitizer 报告修复行为，最后对原始与重建的可执行文件进行模糊测试以发现行为差异。作者报告，使用 GPT-3.5 与 GPT-4 时，在 300 个 Code Contest 程序上的成功率分别为 74% 和 78.3%；在 Coreutils 与 CGC 二进制上，61.9%–70.9% 可重新编译，完全功能正常的占 48.1%–59.0%。","authors":["Wai Kin Wong","Daoyuan Wu","Huaijin Wang","Zongjie Li","Zhibo Liu","Shuai Wang","Qiyi Tang","Sen Nie","Shi Wu"],"authors_omitted":null,"venue":"Proceedings of the ACM on Software Engineering (ISSTA 2025)","doi":"10.1145/3728958","arxiv_id":null,"year":2025,"publication_status":"journal-article","targets":["binary"]},{"id":"paper-disco","title":"DiSCo: Towards Decompiling EVM Bytecode to Source Code using Large Language Models","title_zh":"DiSCo：利用大语言模型将 EVM 字节码反编译为源代码","description_en":"DiSCo lifts Ethereum contract creation bytecode to Solidity source by prompting a frozen LLM, instead of emitting decompiler pseudocode. It abstracts control-flow paths into logic-invariant semantic units, recovers constructor logic by simulating creation bytecode captured from block execution, and infers stripped names with signature databases and a type-aware graph model. These units become natural-language descriptions plus coding specifications in the prompt. GPT-4 is the primary model; Llama 3 is also tested.","description_zh":"DiSCo 通过提示冻结参数的大语言模型，把以太坊合约的创建字节码提升为 Solidity 源码，而不是输出反编译伪代码。它将控制流路径抽象为逻辑不变的语义单元，模拟执行从区块执行中捕获的创建字节码以恢复构造函数逻辑，并借助签名数据库与类型感知图模型推断被剥离的名称。这些单元被转写为自然语言描述，并与编码规范一起放入提示词。主要模型为 GPT-4，另测试了 Llama 3。","authors":["Xing Su","Hanzhong Liang","Hao Wu","Ben Niu","Fengyuan Xu","Sheng Zhong"],"authors_omitted":null,"venue":"Proceedings of the ACM on Software Engineering (FSE 2025)","doi":"10.1145/3729373","arxiv_id":null,"year":2025,"publication_status":"journal-article","targets":["binary"]},{"id":"paper-d-lift","title":"D-LiFT: Improving LLM-based Decompiler Backend via Code Quality-driven Fine-tuning","title_zh":"D-LiFT：通过代码质量驱动的微调改进基于大语言模型的反编译器后端","description_en":"D-LIFT uses D-Score to guide LLM fine-tuning and output selection, improving decompiled code while prioritizing accuracy. It evaluates Ghidra output from coreutils and util-linux.","description_zh":"D-LIFT 使用 D-Score 指导大语言模型微调和输出选择，在优先保证准确性的同时改善反编译代码，并评估了 Ghidra 对 coreutils 和 util-linux 程序的输出。","authors":["Muqi Zou","Hongyu Cai","Hongwei Wu","Zion Leonahenahe Basque","Arslan Khan","Berkay Celik"," Dave"," Tian","Antonio Bianchi"," Ruoyu"," Wang","Dongyan Xu"],"authors_omitted":null,"venue":"arXiv","doi":null,"arxiv_id":"2506.10125","year":2025,"publication_status":"preprint","targets":["binary"]},{"id":"paper-ref-decompile","title":"ReF Decompile: Relabeling and Function Call Enhanced Decompile","title_zh":"ReF Decompile：通过重标记和函数调用增强反编译","description_en":"ReF Decompile relabels jump targets and uses function calls to recover variable information when converting binary code to source code. It was evaluated on the HumanEval-Decompile Benchmark.","description_zh":"ReF Decompile 通过重标记跳转目标、利用函数调用恢复变量信息，将二进制代码转换为源代码。论文在 HumanEval-Decompile 基准上进行了评估。","authors":["Yunlong Feng","Bohan Li","Xiaoming Shi","Qingfu Zhu","Wanxiang Che"],"authors_omitted":null,"venue":"arXiv","doi":null,"arxiv_id":"2502.12221","year":2025,"publication_status":"preprint","targets":["binary"]},{"id":"paper-gennm","title":"Unleashing the Power of Generative Model in Recovering Variable Names from Stripped Binary","title_zh":"释放生成式模型在剥离符号二进制变量名恢复中的能力","description_en":"GenNm suggests names for placeholder variables in decompiled code of stripped binaries by fine-tuning generative code models (CodeGemma-2B by default; CodeLlama-7B and a LoRA-tuned CodeLlama-34B are also tested). Queries add renamed caller code and callee signatures propagated along the call graph; a DPO-style symbol-preference optimization (SymPO) counters bias toward frequent training names, and a data-flow name-validation step chooses among candidates over iterative rounds. The authors report 5.6–11.4-point precision gains over VarBERT and ReSym on rebuilt DIRTY and VarCorpus datasets, and 22.8% precision on names unseen in training against 17.3% for the strongest baseline.","description_zh":"GenNm 通过微调生成式代码模型（默认 CodeGemma-2B，另测试 CodeLlama-7B 及经 LoRA 微调的 CodeLlama-34B），为剥离符号二进制反编译代码中的占位变量建议名称。查询会加入沿调用图传播、已重命名的调用者代码与被调用者签名；类 DPO 的符号偏好优化（SymPO）抑制模型偏向训练集中高频名称，基于数据流的名称验证步骤则在多轮迭代中从候选名称里选择。作者报告，在重建的 DIRTY 与 VarCorpus 数据集上，其精确率比 VarBERT 和 ReSym 高 5.6–11.4 个百分点；对训练中未出现的名称，精确率为 22.8%，最强基线为 17.3%。","authors":["Xiangzhe Xu","Zhuo Zhang","Zian Su","Ziyang Huang","Shiwei Feng","Yapeng Ye","Nan Jiang","Danning Xie","Siyuan Cheng","Lin Tan","Xiangyu Zhang"],"authors_omitted":null,"venue":"NDSS 2025","doi":"10.14722/ndss.2025.240276","arxiv_id":"2306.02546","year":2025,"publication_status":"conference-paper","targets":["binary"]},{"id":"paper-typeforge","title":"TypeForge: Synthesizing and Selecting Best-Fit Composite Data Types for Stripped Binaries","title_zh":"TypeForge：为去符号二进制合成并选择最适配的复合数据类型","description_en":"TypeForge recovers composite data types, including struct layouts, unions and pointer or nesting relationships, from stripped binaries. A whole-program Type Flow Graph over Ghidra’s decompiler-inferred variables propagates member offsets and sizes, cuts conflicting edges caused by casts and unions, and synthesizes candidate type declarations. An LLM only selects among these statically synthesized candidates: each is applied through the decompiler’s retype interface, and a double-elimination tournament compares the resulting pseudocode for readability. On OSPREY’s coreutils dataset the authors report F1 of 81.7% for composite-type identification, 88.2% for layout recovery and 72.1% for relationship recovery.","description_zh":"TypeForge 从去符号二进制中恢复复合数据类型，包括结构体布局、联合体以及指针引用和嵌套关系。它在 Ghidra 反编译器推断出的变量之上构建全程序类型流图，传播成员偏移与大小，切断由类型转换和联合体引起的冲突边，并合成候选类型声明。大语言模型只在这些静态合成的候选中进行选择：每个候选通过反编译器的重定类型接口应用，再以双败淘汰赛比较所得伪代码的可读性。作者在 OSPREY 的 coreutils 数据集上报告复合类型识别 F1 为 81.7%、布局恢复 F1 为 88.2%、关系恢复 F1 为 72.1%。","authors":["Yanzhong Wang","Ruigang Liang","Yilin Li","Peiwei Hu","Kai Chen","Bolun Zhang"],"authors_omitted":null,"venue":"IEEE S&P 2025","doi":"10.1109/SP61157.2025.00193","arxiv_id":null,"year":2025,"publication_status":"conference-paper","targets":["binary"]},{"id":"paper-nova","title":"Nova: Generative Language Models for Assembly Code with Hierarchical Attention and Contrastive Learning","title_zh":"Nova：结合层次注意力与对比学习的汇编代码生成式语言模型","description_en":"Nova is a generative LLM for x86-64 assembly, trained from DeepSeek-Coder checkpoints on stripped, normalized gcc -O0 to -O3 assembly built from AnghaBench and The Stack. It adds hierarchical attention that builds per-instruction summaries, and contrastive objectives that keep a function's source and O0–O3 assembly close while ordering them by optimization level. Fine-tuned for decompilation, Nova-1.3B and Nova-6.7B reach 25.17% and 34.36% average Pass@1 on HumanEval-Decompile, 14.84 and 12.41 points above same-size LLM4Decompile; separately fine-tuned models report the highest average Recall@1 for O0-to-O3 binary code similarity on six real-world projects.","description_zh":"Nova 是面向 x86-64 汇编的生成式大语言模型，从 DeepSeek-Coder 检查点出发，以 AnghaBench 与 The Stack 代码经 gcc -O0 至 -O3 编译、剥离符号并规范化后的汇编训练。它加入为每条指令构建摘要的层次注意力，以及对比学习目标：使同一函数的源码与 O0–O3 汇编表示彼此接近，并按优化级别排序。针对反编译微调后，Nova-1.3B 与 Nova-6.7B 在 HumanEval-Decompile 上的平均 Pass@1 分别为 25.17% 和 34.36%，比同规模 LLM4Decompile 高 14.84 和 12.41 个百分点；另行微调的模型在六个真实项目上的 O0 对 O3 二进制代码相似性检测中取得最高的平均 Recall@1。","authors":["Nan Jiang","Chengxiao Wang","Kevin Liu","Xiangzhe Xu","Lin Tan","Xiangyu Zhang","Petr Babkin"],"authors_omitted":null,"venue":"ICLR 2025","doi":null,"arxiv_id":"2311.13721","year":2025,"publication_status":"conference-paper","targets":["binary"]},{"id":"paper-malsight","title":"Malsight: Exploring Malicious Source Code and Benign Pseudocode for Iterative Binary Malware Summarization","title_zh":"Malsight：结合恶意源代码与良性伪代码的二进制恶意软件迭代式摘要生成","description_en":"MALSIGHT writes natural-language summaries of stripped binary malware one function at a time. IDA Pro produces pseudocode and a call graph, and functions are summarized callees first, so each caller receives its callees' summaries as context; a sequence-labeling model also marks key API calls and strings, which drive code-search retrieval and LLM-written annotations. The summarizer, MalT5, is a 0.77B-parameter CodeT5+ model fine-tuned first on MalS, 89,609 malicious C source functions from GitHub with LLM-generated summaries refined by human reviewers, and then on annotated benign pseudocode from the Capybara dataset. The authors also introduce MalP, 500 pseudocode functions for testing, and BLEURT-sum, a fine-tuned BLEURT metric, and report that MalT5 performs comparably to much larger Code Llama models.","description_zh":"MALSIGHT 以函数为单位，为剥离符号的二进制恶意软件生成自然语言摘要。它先用 IDA Pro 生成伪代码和调用图，再按先被调用者、后调用者的顺序生成摘要，使每个调用者都能获得其被调用函数的摘要作为上下文；另有一个序列标注模型标记关键 API 调用和字符串，据此进行代码检索并由大语言模型生成注释。摘要模型 MalT5 是 0.77B 参数的 CodeT5+，先在 MalS 上微调，即来自 GitHub 的 89,609 个恶意 C 源码函数，其摘要由大语言模型生成并经人工审阅完善，再在 Capybara 数据集带注释的良性伪代码上微调。作者还提出了包含 500 个伪代码函数的测试集 MalP 和微调 BLEURT 得到的评测指标 BLEURT-sum，并报告 MalT5 的表现与规模大得多的 Code Llama 模型相当。","authors":["Haolang Lu","Hongrui Peng","Guoshun Nan","Jiaoyang Cui","Cheng Wang","Weifei Jin","Songtao Wang","Shengli Pan","Xiaofeng Tao"],"authors_omitted":null,"venue":"IEEE Transactions on Information Forensics and Security","doi":"10.1109/TIFS.2025.3583552","arxiv_id":"2406.18379","year":2025,"publication_status":"journal-article","targets":["binary"]},{"id":"paper-lares","title":"Lares: LLM-driven Code Slice Semantic Search for Patch Presence Testing","title_zh":"Lares：面向补丁存在性测试的大语言模型驱动代码切片语义搜索","description_en":"Lares tests whether a known 1-day vulnerability fix is present in a target binary function without recompiling the project. Its inputs are the target binary, the project source and the patch commit diff. A patch-enhancement step adds data- and control-flow context from the source (via Tree-sitter and Joern) to patches with few changed statements. An LLM then locates the pseudocode slice in the IDA Pro decompilation of the target function that corresponds to each patch slice. Finally, matched slices are normalized into equations and checked for equivalence with the Z3 SMT solver, and the LLM judges the cases Z3 cannot model, deciding whether the function matches the pre-patch or the patched version. On 4,480 test cases from 73 CVEs in OpenSSL, FreeType, tcpdump and libxml2, compiled with GCC 9.4.0 and Clang 6 at O0–O3 for x86, x64 and ARM, the authors report an average F1 of 0.77 on x86 with Claude 3.5 Sonnet, against 0.67 for Robin and 0.68 for PS3, and F1 from 0.71 to 0.77 across five compiler–architecture settings.","description_zh":"Lares 在不重新编译项目的情况下，测试目标二进制函数中是否已包含某个已知 1-day 漏洞的修复。其输入为目标二进制、项目源码和补丁提交差异。补丁增强步骤借助 Tree-sitter 与 Joern 从源码中为改动语句较少的补丁补充数据流和控制流上下文。随后由大语言模型在目标函数的 IDA Pro 反编译伪代码中定位与每个补丁切片对应的伪代码切片。最后，匹配的切片被规范化为等式并交由 Z3 SMT 求解器检验等价性，Z3 无法建模的情况由大语言模型判断，从而确定该函数对应修复前版本还是已修复版本。在来自 OpenSSL、FreeType、tcpdump 和 libxml2 中 73 个 CVE 的 4,480 个测试用例上（使用 GCC 9.4.0 和 Clang 6 以 O0–O3 为 x86、x64 与 ARM 编译），作者报告使用 Claude 3.5 Sonnet 时 x86 上的平均 F1 为 0.77，Robin 与 PS3 分别为 0.67 和 0.68；在五种编译器—架构组合下 F1 为 0.71 至 0.77。","authors":["Siyuan Li","Yaowen Zheng","Hong Li","Jingdong Guo","Chaopeng Dong","Chunpeng Yan","Weijie Wang","Yimo Ren","Limin Sun","Hongsong Zhu"],"authors_omitted":null,"venue":"ASE 2025","doi":"10.1109/ASE63991.2025.00081","arxiv_id":"2511.01252","year":2025,"publication_status":"conference-paper","targets":["binary"]},{"id":"paper-decompile-bench","title":"Decompile-Bench: Million-Scale Binary-Source Function Pairs for Real-World Binary Decompilation","title_zh":"Decompile-Bench：面向真实二进制反编译的百万级二进制与源码函数对","description_en":"Introduces two million C/C++ binary-source function pairs using a Compile-Trace-Filter pipeline, with an evaluation suite spanning translated HumanEval/MBPP tasks and recent GitHub functions.","description_zh":"通过 Compile-Trace-Filter 流程构建 200 万组 C/C++ 二进制与源码函数对，并提供涵盖转写为 C/C++ 的 HumanEval、MBPP 任务及近期 GitHub 函数的评测集。","authors":["Hanzhuo Tan","Xiaolong Tian","Hanrui Qi","Jiaming Liu","Zuchen Gao","Siyi Wang","Qi Luo","Jing Li","Yuqun Zhang"],"authors_omitted":null,"venue":"NeurIPS 2025 Datasets and Benchmarks","doi":"10.52202/085713-0177","arxiv_id":"2505.12668","year":2025,"publication_status":"conference-paper","targets":["binary"]},{"id":"paper-symgen","title":"Beyond Classification: Inferring Function Names in Stripped Binaries via Domain Adapted LLMs","title_zh":"超越分类：借助领域适配的大语言模型推断去符号二进制中的函数名","description_en":"SymGen infers function names for stripped binaries by generating them with a LoRA-fine-tuned Code Llama model instead of classifying over a fixed name vocabulary. Ghidra decompiles each stripped function, its own name is masked, and callee names are normalized for deduplication. Before fine-tuning, the model is domain-adapted on decompiled code paired with LLM-generated summaries of the matching source functions. On functions from 33 C projects built for x86-64, x86-32, ARM and MIPS at O0–O3, deduplicated from 2,237,915 to 495,494, the authors report average word-level F1 of 0.277 (0.380 on x86-64), plus case studies on obfuscated binaries and Linux malware.","description_zh":"SymGen 使用经 LoRA 微调的 Code Llama 模型生成去符号二进制的函数名，而不是在固定的名称词表上分类。每个去符号函数先由 Ghidra 反编译，再屏蔽其自身名称，并对被调用函数名进行归一化以便去重。微调之前，模型先以反编译代码及其对应源函数的大语言模型生成摘要进行领域适配。在 33 个 C 项目针对 x86-64、x86-32、ARM 和 MIPS 架构及 O0–O3 优化级别构建的函数上（经去重由 2,237,915 个减至 495,494 个），作者报告词级平均 F1 为 0.277（x86-64 上为 0.380），并给出混淆二进制与 Linux 恶意软件的案例研究。","authors":["Linxi Jiang","Xin Jin","Zhiqiang Lin"],"authors_omitted":null,"venue":"NDSS 2025","doi":"10.14722/ndss.2025.240797","arxiv_id":null,"year":2025,"publication_status":"conference-paper","targets":["binary"]},{"id":"paper-resym","title":"ReSym: Harnessing LLMs to Recover Variable and Data Structure Symbols from Stripped Binaries","title_zh":"ReSym：利用大语言模型恢复去符号二进制中的变量与数据结构符号","description_en":"Combines two fine-tuned language models with Prolog-based cross-function reasoning to infer local-variable symbols and user-defined data structures from stripped-binary decompilation.","description_zh":"结合两个微调语言模型与基于 Prolog 的跨函数推理，从去符号二进制的反编译结果中推断局部变量符号及用户自定义数据结构。","authors":["Danning Xie","Zhuo Zhang","Nan Jiang","Xiangzhe Xu","Lin Tan","Xiangyu Zhang"],"authors_omitted":null,"venue":"ACM CCS 2024","doi":"10.1145/3658644.3670340","arxiv_id":null,"year":2024,"publication_status":"conference-paper","targets":["binary"]},{"id":"paper-sc2dec","title":"Self-Constructed Context Decompilation with Fined-grained Alignment Enhancement","title_zh":"自构造上下文反编译与细粒度对齐增强","description_en":"Adds two techniques to LLM decompilation of function-level x86-64 GCC assembly into C. Self-Constructed Context Decompilation (sc²dec) recompiles a model’s first compilable output and uses the resulting assembly–source pair as an in-context example for a second attempt, without fine-tuning. Fine-grained Alignment Enhancement (FAE) fine-tunes llm4decompile-6.7b with LoRA on statement-level assembly–C alignments derived from DWARF debug information. Combining both, the authors report 52.41% average re-executability on Decompile-Eval, against 48.60% for the base model.","description_zh":"为大语言模型将函数级 x86-64 GCC 汇编反编译为 C 的流程增加两项技术。自构造上下文反编译（sc²dec）无需微调：把模型首次生成且可编译的结果重新编译，以得到的汇编—源码对作为上下文示例再次反编译。细粒度对齐增强（FAE）利用 DWARF 调试信息构造语句级汇编—C 对齐数据，以 LoRA 微调 llm4decompile-6.7b。两者结合后，作者报告在 Decompile-Eval 上的平均可重执行率为 52.41%，基础模型为 48.60%。","authors":["Yunlong Feng","Dechuan Teng","Yang Xu","Honglin Mu","Xiao Xu","Libo Qin","Qingfu Zhu","Wanxiang Che"],"authors_omitted":null,"venue":"Findings of EMNLP 2024","doi":"10.18653/v1/2024.findings-emnlp.385","arxiv_id":"2406.17233","year":2024,"publication_status":"conference-paper","targets":["binary"]},{"id":"paper-llm4decompile","title":"LLM4Decompile: Decompiling Binary Code with Large Language Models","title_zh":"LLM4Decompile：使用大语言模型反编译二进制代码","description_en":"Trains language models for assembly-to-C decompilation and for refining Ghidra pseudocode, evaluating whether recovered functions can be recompiled and executed correctly.","description_zh":"训练语言模型将汇编反编译为 C，并改进 Ghidra 伪代码，以恢复函数能否重新编译并正确执行为评估目标。","authors":["Hanzhuo Tan","Qi Luo","Jing Li","Yuqun Zhang"],"authors_omitted":null,"venue":"EMNLP 2024","doi":"10.18653/v1/2024.emnlp-main.203","arxiv_id":"2403.05286","year":2024,"publication_status":"conference-paper","targets":["binary"]},{"id":"paper-wadec","title":"WaDec: Decompiling WebAssembly Using Large Language Model","title_zh":"WaDec：基于大语言模型的 WebAssembly 反编译","description_en":"WaDec decompiles WebAssembly text (wat) into C by fine-tuning CodeLlama-7b with LoRA on loop-level wat–C snippet pairs. Functions are ordered by dependency and sliced so that each input holds at most one loop, with nested loops replaced by markers. Prompts add declarations of called functions, previously defined local variables and offset-to-string mappings; the outputs are then reassembled, with string constants restored and variables renamed. Training data come from 51,768 the-stack-dedup and 377 TheAlgorithms/C programs compiled with Emscripten. On 3,977 C files, the authors report 3.34% code inflation, 52.11% recompilability, 43.55% re-execution and 27.15% output consistency, compared with Wasm2c and Ghidra.","description_zh":"WaDec 使用循环级 wat–C 代码片段对，以 LoRA 微调 CodeLlama-7b，将 WebAssembly 文本格式（wat）反编译为 C。它按依赖关系排列函数并进行切片，使每个输入至多包含一个循环，嵌套循环以标记替代。提示中补充被调用函数的声明、此前已定义的局部变量以及偏移到字符串的映射；随后重组输出，恢复字符串常量并重命名变量。训练数据来自经 Emscripten 编译的 51,768 个 the-stack-dedup 程序和 377 个 TheAlgorithms/C 程序。作者在 3,977 个 C 文件上报告，代码膨胀率为 3.34%，可重新编译率为 52.11%，可重新执行率为 43.55%，输出一致率为 27.15%，并与 Wasm2c 及 Ghidra 进行比较。","authors":["Xinyu She","Yanjie Zhao","Haoyu Wang"],"authors_omitted":null,"venue":"ASE 2024","doi":"10.1145/3691620.3695020","arxiv_id":"2406.11346","year":2024,"publication_status":"conference-paper","targets":["binary","website"]},{"id":"paper-llm-binary-understanding","title":"How Far Have We Gone in Binary Code Understanding Using Large Language Models","title_zh":"大语言模型理解二进制代码的能力已走多远","description_en":"Benchmarks 16 code and general LLMs on function name recovery and summarization of stripped binaries. The benchmark takes 12 popular C projects built for x86-64, strips and decompiles 28 binaries with IDA Pro, aligns 81,185 functions with source through DWARF, and keeps 2,000 functions after expert review. Zero-shot LLMs are compared with SymLM, NER, BinT5 and HexT5. Code Llama 34B leads name recovery with token-level F1 of 27.59, and ChatGPT leads summarization with BLEU-4 7.37. The study also measures few-shot prompting, LoRA fine-tuning of two 7B models on GNU binaries, and a case study on a stripped open-source Linux remote-access trojan.","description_zh":"在剥离符号二进制的函数名恢复与代码摘要两项任务上，评测 16 个代码领域与通用领域的大语言模型。基准选取 12 个热门 C 项目编译为 x86-64，剥离并用 IDA Pro 反编译 28 个二进制，借助 DWARF 将 81,185 个函数与源码对齐，经专家审核后保留 2,000 个函数。零样本大语言模型与 SymLM、NER、BinT5 和 HexT5 进行比较。Code Llama 34B 在函数名恢复上以 27.59 的词元级 F1 领先，ChatGPT 在摘要任务上以 7.37 的 BLEU-4 领先。研究还考察了少样本提示、两个 7B 模型基于 GNU 二进制的 LoRA 微调，以及针对一个剥离符号的开源 Linux 远程访问木马的案例研究。","authors":["Xiuwei Shang","Shaoyin Cheng","Guoqiang Chen","Yanming Zhang","Li Hu","Xiao Yu","Gangyang Li","Weiming Zhang","Nenghai Yu"],"authors_omitted":null,"venue":"ICSME 2024","doi":"10.1109/ICSME58944.2024.00012","arxiv_id":"2404.09836","year":2024,"publication_status":"conference-paper","targets":["binary"]},{"id":"paper-clap","title":"CLAP: Learning Transferable Binary Code Representations with Natural Language Supervision","title_zh":"CLAP：借助自然语言监督学习可迁移的二进制代码表示","description_en":"CLAP (Contrastive Language-Assembly Pre-training) learns assembly-function embeddings aligned with natural-language explanations. A dataset engine compiles Ubuntu C/C++ packages with GCC and Clang at O0–O3 and Os, has GPT-3.5 explain about 2.6 million matching source functions, and fine-tunes a Vicuna-13B “shadow model” on half of those explanations to label more code, yielding 195 million assembly–explanation pairs. A 110M-parameter assembly encoder, using address rebasing, a WordPiece tokenizer and jump-aware embeddings, is first pre-trained on assembly and then contrastively aligned with a text encoder. The embeddings support zero-shot classification by matching code against text prompts. On BinaryCorp-3M similarity search in pools of 10,000 functions, zero-shot CLAP reports 0.836 average recall@1 against 0.571 for fine-tuned jTrans.","description_zh":"CLAP（对比式语言—汇编预训练）学习与自然语言解释对齐的汇编函数嵌入。其数据引擎以 GCC 和 Clang 在 O0–O3 与 Os 下编译 Ubuntu 的 C/C++ 软件包，由 GPT-3.5 为约 260 万个对应的源码函数生成解释，再用其中一半解释微调 Vicuna-13B“影子模型”为更多代码生成说明，最终得到 1.95 亿对汇编—解释数据。采用地址重定基、WordPiece 分词与跳转感知嵌入的 1.1 亿参数汇编编码器先在汇编上预训练，再与文本编码器进行对比对齐。所得嵌入可通过将代码与文本提示匹配来实现零样本分类。在候选池为 10,000 个函数的 BinaryCorp-3M 相似性检索中，零样本 CLAP 的平均 recall@1 为 0.836，经微调的 jTrans 为 0.571。","authors":["Hao Wang","Zeyu Gao","Chao Zhang","Zihan Sha","Mingyang Sun","Yuchen Zhou","Wenyu Zhu","Wenju Sun","Han Qiu","Xi Xiao"],"authors_omitted":null,"venue":"ACM ISSTA 2024","doi":"10.1145/3650212.3652145","arxiv_id":"2402.16928","year":2024,"publication_status":"conference-paper","targets":["binary"]},{"id":"paper-tygr","title":"TYGR: Type Inference on Stripped Binaries using Graph Neural Networks","title_zh":"TYGR：基于图神经网络的剥离符号二进制类型推断","description_en":"TYGR infers the types of stack and heap variables in stripped binaries by running an architecture-agnostic, intra-procedural data-flow analysis on angr's VEX IR and classifying each variable's data-flow graph with a graph neural network. It predicts base types, pointers and struct member layouts, covering 97.1% of the types observed in its data. The authors also build TyDa, 163,643 binaries compiled with debug information from Gentoo and Debian C packages for x86, x64, AArch64, Arm32 and MIPS at O0–O3, and deduplicate functions in the evaluated subset before splitting it. On x64 across O0–O3 they report 76.6% overall and 45.2% struct accuracy, and say TYGR beats prior work by at least 26.1% overall and 10.2% on structs.","description_zh":"TYGR 在 angr 的 VEX 中间表示上执行与架构无关的过程内数据流分析，并用图神经网络对每个变量的数据流图进行分类，从而推断剥离符号二进制中栈变量与堆变量的类型。它可预测基本类型、指针及结构体成员布局，覆盖其数据中观察到的 97.1% 的类型。作者还构建了 TyDa：由 Gentoo 与 Debian 的 C 软件包以 O0–O3 编译、保留调试信息的 163,643 个二进制，涵盖 x86、x64、AArch64、Arm32 与 MIPS，并在划分评测子集前对其中函数去重。作者报告在 x64 的 O0–O3 上整体准确率为 76.6%、结构体准确率为 45.2%，并称整体准确率与结构体准确率分别至少超出已有工作 26.1% 和 10.2%。","authors":["Chang Zhu","Ziyang Li","Anton Xue","Ati Priya Bajaj","Wil Gibbs","Yibo Liu","Rajeev Alur","Tiffany Bao","Hanjun Dai","Adam Doupé","Mayur Naik","Yan Shoshitaishvili","Ruoyu Wang","Aravind Machiry"],"authors_omitted":null,"venue":"USENIX Security 2024","doi":null,"arxiv_id":null,"year":2024,"publication_status":"conference-paper","targets":["binary"]},{"id":"paper-d-helix","title":"D-Helix: A Generic Decompiler Testing Framework Using Symbolic Differentiation","title_zh":"D-Helix：基于符号差分的通用反编译器测试框架","description_en":"Tests decompilers function by function on binaries without needing source code. RECOMPILER repairs decompiled C so individual functions recompile, SYMDIFF compares symbolic models of the original binary function and the recompiled decompiled function using patched angr and PROMPT symbolic executors, and TUNER toggles decompiler heuristic rules to locate, and sometimes work around, the rule behind an inaccuracy. On Ghidra 10.0 and angr 9.2.30, 2,004 binaries and object files from coreutils, util-linux and six popular GitHub C projects yield 93K decompiled functions; the authors report 4,515 incorrectly decompiled functions, 8 reproduced known bugs, 17 previously unknown bugs and 7 bugs fixed automatically.","description_zh":"在无需源码的前提下，逐函数测试反编译器对二进制的处理。RECOMPILER 修复反编译所得的 C 代码，使单个函数能够重新编译；SYMDIFF 借助打过补丁的 angr 与 PROMPT 符号执行器，比较原始二进制函数与重新编译后的反编译函数的符号模型；TUNER 通过切换反编译器的启发式规则，定位造成偏差的规则，并在部分情况下予以规避。作者在 Ghidra 10.0 与 angr 9.2.30 上，使用来自 coreutils、util-linux 及六个热门 GitHub C 项目的 2,004 个二进制与目标文件，得到 93K 个反编译函数；报告发现 4,515 个反编译错误的函数，复现 8 个已知缺陷，发现 17 个此前未知的缺陷，并自动修复 7 个缺陷。","authors":["Muqi Zou","Arslan Khan","Ruoyu Wu","Han Gao","Antonio Bianchi","Dave (Jing) Tian"],"authors_omitted":null,"venue":"USENIX Security 2024","doi":null,"arxiv_id":null,"year":2024,"publication_status":"conference-paper","targets":["binary"]},{"id":"paper-hermessim","title":"Code is not Natural Language: Unlock the Power of Semantics-Oriented Graph Representation for Binary Code Similarity Detection","title_zh":"代码并非自然语言：释放面向语义的图表示在二进制代码相似性检测中的潜力","description_en":"HermesSim detects binary code similarity by lifting each function to Ghidra P-code and building a semantics-oriented graph that exposes operand structure inside instructions, def-use, control-flow and effect-order relations, while dropping semantics-independent details such as which register temporarily holds a value. A gated graph neural network with a multi-head softmax aggregator embeds the graph, and functions are compared by embedding similarity. On the Dataset-1 benchmark of Marcelli et al., the authors report 48.1% RECALL@1 for x64 cross-compiler retrieval in pools of 10,000 functions, against 31.4% for a fine-tuned jTrans, with a 388K-parameter model.","description_zh":"HermesSim 将每个函数提升为 Ghidra P-code，并构建面向语义的图，以显式表示指令内部的操作数结构、定义—使用关系、控制流及副作用顺序，同时舍弃与语义无关的细节，例如由哪个寄存器临时保存某个值。它使用带多头 softmax 聚合器的门控图神经网络对图进行嵌入，再按嵌入相似度比较函数。作者在 Marcelli 等人发布的 Dataset-1 基准上报告：在 10,000 个函数的候选池中进行 x64 跨编译器检索时，RECALL@1 为 48.1%，经微调的 jTrans 为 31.4%；HermesSim 模型参数量为 388K。","authors":["Haojie He","Xingwei Lin","Ziang Weng","Ruijie Zhao","Shuitao Gan","Libo Chen","Yuede Ji","Jiashui Wang","Zhi Xue"],"authors_omitted":null,"venue":"USENIX Security 2024","doi":null,"arxiv_id":null,"year":2024,"publication_status":"conference-paper","targets":["binary"]},{"id":"paper-decompiler-fidelity-taxonomy","title":"A Taxonomy of C Decompiler Fidelity Issues","title_zh":"C 语言反编译器保真度问题分类","description_en":"Open-codes decompiled/original C function pairs to classify how decompiler output departs from the source beyond missing names and types. Using a statement-alignment abstraction and thematic analysis, the authors build a hierarchical codebook of 15 top-level categories and 52 codes, covering correctness issues such as nonequivalent expressions and incorrect return behavior and readability issues such as extraneous variables, non-idiomatic control flow and decompiler-specific macros. The codebook, developed on Hex-Rays output, is applied to Ghidra, retdec and angr, and the authors suggest type prediction, rule-based fixes and whole-program learned techniques to address classes of defects.","description_zh":"对反编译所得与原始 C 函数构成的代码对进行开放式编码，归纳反编译器输出在缺失名称与类型之外如何偏离源码。作者借助语句对齐抽象与主题分析，构建包含 15 个顶层类别、共 52 个编码的层级化编码手册，既涵盖不等价表达式、错误返回行为等正确性问题，也涵盖多余变量、不符合惯用写法的控制流及反编译器特有宏等可读性问题。该编码手册基于 Hex-Rays 输出建立，并应用于 Ghidra、retdec 与 angr；作者据此提出以类型预测、基于规则的修正及整程序级学习技术来应对各类缺陷。","authors":["Luke Dramko","Jeremy Lacomis","Edward J. Schwartz","Bogdan Vasilescu","Claire Le Goues"],"authors_omitted":null,"venue":"USENIX Security 2024","doi":null,"arxiv_id":null,"year":2024,"publication_status":"conference-paper","targets":["binary"]},{"id":"paper-codeart","title":"CodeArt: Better Code Models by Attention Regularization When Symbols Are Lacking","title_zh":"CodeArt：在缺少符号时通过注意力正则化改进代码模型","description_en":"CodeArt pre-trains a BERT-sized encoder from scratch on 26 million stripped x86-64 functions built from jTrans's BinaryCorp. Instead of relying on symbols, it uses IDA Pro control-flow graphs and a binary data-flow analysis to compute control and data dependences, then restricts self-attention with masks so a token attends only to instructions it transitively depends on or that depend on it, to tokens in its own instruction, and to a global [CLS] token; pre-training masks tokens and perturbs the dependence graph. The authors fine-tune it for binary similarity, malware family classification and type inference. They report improvements over prior models from 53% to 64% recall@1 for similarity in pools of 500, from 49% to 60% LRAP for malware families, and from 74% to 94% average F1 for type inference.","description_zh":"CodeArt 基于 jTrans 的 BinaryCorp 构建的 2,600 万个剥离符号的 x86-64 函数，从零开始预训练一个 BERT 规模的编码器。它不依赖符号，而是利用 IDA Pro 控制流图和面向二进制的数据流分析计算控制依赖与数据依赖，再通过注意力掩码，使每个词元只能关注与其存在传递依赖关系的指令、同一条指令内的词元以及全局 [CLS] 词元；预训练时同时遮蔽词元并扰动依赖图。作者将其微调用于二进制相似性分析、恶意软件家族分类和类型推断，报告相对已有模型的提升为：在 500 个函数的候选池中相似性 recall@1 由 53% 升至 64%，恶意软件家族分类 LRAP 由 49% 升至 60%，类型推断平均 F1 由 74% 升至 94%。","authors":["Zian Su","Xiangzhe Xu","Ziyang Huang","Zhuo Zhang","Yapeng Ye","Jianjun Huang","Xiangyu Zhang"],"authors_omitted":null,"venue":"Proceedings of the ACM on Software Engineering (FSE 2024)","doi":"10.1145/3643752","arxiv_id":"2402.11842","year":2024,"publication_status":"journal-article","targets":["binary"]},{"id":"paper-stacksight","title":"StackSight: Unveiling WebAssembly through Large Language Models and Neurosymbolic Chain-of-Thought Decompilation","title_zh":"StackSight：借助大语言模型与神经符号思维链反编译揭示 WebAssembly","description_en":"StackSight decompiles WebAssembly text-format functions into C++ with LLM prompting. A static analysis annotates each WAT instruction with the virtual-stack state, using symbolic notation where branches diverge; a one-shot chain-of-thought prompt then asks the model to recover variable meanings, summarize the function and write C++. With GPT-4 the share of outputs passing all benchmark tests rises from 19.7% to 36.5% on HumanEval-X and from 42.4% to 59.6% on MBXP relative to one-shot prompting; GPT-3.5 and Code Llama-7B-Instruct are also evaluated.","description_zh":"StackSight 借助大语言模型提示，将 WebAssembly 文本格式（WAT）函数反编译为 C++。它先通过静态分析为每条 WAT 指令标注虚拟栈状态，在分支分叉处使用符号记法；再用单样例思维链提示，要求模型恢复变量含义、总结函数功能并写出 C++。使用 GPT-4 时，与单样例提示相比，通过全部基准测试的输出比例在 HumanEval-X 上从 19.7% 升至 36.5%，在 MBXP 上从 42.4% 升至 59.6%；论文还评估了 GPT-3.5 与 Code Llama-7B-Instruct。","authors":["Weike Fang","Zhejian Zhou","Junzhou He","Weihang Wang"],"authors_omitted":null,"venue":"ICML 2024","doi":null,"arxiv_id":"2406.04568","year":2024,"publication_status":"conference-paper","targets":["binary","website"]},{"id":"paper-stride","title":"STRIDE: Simple Type Recognition In Decompiled Executables","title_zh":"STRIDE：反编译可执行文件中的简单类型识别","description_en":"STRIDE predicts the names and types of variables in decompiler output without a neural model. From training decompilation with known labels, it builds a database mapping the token sequences (N-grams, with N from 2 to 60) immediately left and right of each variable occurrence to the five most frequent names or types. Variable placeholders are canonicalized, and address-like tokens and large constants are bucketed so that N-grams can match. At prediction time it looks up the longest matching N-gram on each side of every occurrence, scores the returned labels by how specific the match is, and sums the scores across the function. The prototype is about 1,000 lines of Python and runs on a CPU. On DIRT functions not seen in training, the authors report 66.4% retyping accuracy, against 52.3% for DIRTY with beam search, and 56.2% renaming accuracy, against 51.3% reported for VarBERT. Across 16 VarCorpus splits, renaming accuracy is higher than VarBERT on 11 and 1.55 points higher on average. Prediction takes 8.2 ms per function on a CPU, against 43.7 ms for VarBERT on an NVIDIA L4 GPU.","description_zh":"STRIDE 不使用神经网络模型，而是预测反编译器输出中变量的名称和类型。它基于带已知标签的训练反编译结果构建数据库，将每处变量出现位置紧邻左右两侧的词元序列（N-gram，N 取 2 至 60）映射到出现频率最高的五个名称或类型。变量占位名会被规范化，类似地址的词元和较大的常量会被分桶，以便 N-gram 能够匹配。预测时，它在每处出现位置的两侧查找最长的匹配 N-gram，按匹配的特异程度为返回的标签打分，并在整个函数内累加得分。原型约有 1,000 行 Python 代码，在 CPU 上运行。作者报告，在训练集中未出现的 DIRT 函数上，类型恢复准确率为 66.4%（启用束搜索的 DIRTY 为 52.3%），重命名准确率为 56.2%（VarBERT 的已报告结果为 51.3%）。在 16 个 VarCorpus 划分中，其重命名准确率在 11 个划分上高于 VarBERT，平均高 1.55 个百分点。预测在 CPU 上每个函数耗时 8.2 毫秒，而 VarBERT 在 NVIDIA L4 GPU 上为 43.7 毫秒。","authors":["Harrison Green","Edward J. Schwartz","Claire Le Goues","Bogdan Vasilescu"],"authors_omitted":null,"venue":"arXiv","doi":null,"arxiv_id":"2407.02733","year":2024,"publication_status":"preprint","targets":["binary"]},{"id":"paper-gpt4-binary-re","title":"Exploring the Efficacy of Large Language Models (GPT-4) in Binary Reverse Engineering","title_zh":"探索大型语言模型（GPT-4）在二进制逆向工程中的效能","description_en":"The paper evaluates GPT-4 for binary reverse engineering through interpretation of human-written and decompiled code, from basic code explanation to malware analysis.","description_zh":"论文评估 GPT-4 在二进制逆向工程中的表现，考察其对人工编写代码和反编译代码的理解与解释，涵盖基础代码解读和恶意软件分析。","authors":["Saman Pordanesh","Benjamin Tan"],"authors_omitted":null,"venue":"arXiv","doi":null,"arxiv_id":"2406.06637","year":2024,"publication_status":"preprint","targets":["binary"]},{"id":"paper-llm-malware-deobfuscation","title":"Assessing LLMs in Malicious Code Deobfuscation of Real-world Malware Campaigns","title_zh":"评估大语言模型对真实恶意软件活动中恶意代码的去混淆能力","description_en":"The paper evaluates four LLMs on deobfuscating real-world malicious scripts from the Emotet malware campaign and examines their use in reverse engineering.","description_zh":"论文使用 Emotet 恶意软件活动中的真实恶意脚本，评估四种大语言模型的去混淆能力及其在逆向工程中的应用。","authors":["Constantinos Patsakis","Fran Casino","Nikolaos Lykousas"],"authors_omitted":null,"venue":"arXiv","doi":null,"arxiv_id":"2404.19715","year":2024,"publication_status":"preprint","targets":["binary"]},{"id":"paper-cross-inlining-bfsd","title":"Cross-Inlining Binary Function Similarity Detection","title_zh":"跨内联的二进制函数相似性检测","description_en":"Studies binary function similarity when function inlining makes one binary function correspond to several source functions. From BinKit builds of 51 GNU projects with and without -fno-inline (9 GCC and Clang versions, O0–O3, six x86, ARM and MIPS targets; 216 combinations each), debug-line mappings label 5,621,140 cross-inlining pairs. The authors identify Leaf-, Root- and Internal-Inlining patterns, show that Gemini, SAFE and GMN lose accuracy on them, and propose CI-Detector, which trains one attributed-CFG graph neural network per pattern and aggregates their scores, reporting 81% precision and 97% recall.","description_zh":"研究函数内联使一个二进制函数对应多个源码函数时的二进制函数相似性检测。作者基于 BinKit，将 51 个 GNU 项目分别在启用与禁用 -fno-inline 的条件下编译（9 个 GCC 与 Clang 版本、O0–O3、x86、ARM 与 MIPS 共六种目标，各 216 种组合），并利用调试行号映射标注 5,621,140 个跨内联函数对。作者归纳出叶内联、根内联与内部内联三种模式，表明 Gemini、SAFE 与 GMN 在这些模式上准确率下降，并提出 CI-Detector：针对每种模式训练一个基于属性控制流图的图神经网络，再聚合各模型得分，报告精确率为 81%、召回率为 97%。","authors":["Ang Jia","Ming Fan","Xi Xu","Wuxia Jin","Haijun Wang","Ting Liu"],"authors_omitted":null,"venue":"ICSE 2024","doi":"10.1145/3597503.3639080","arxiv_id":"2401.05739","year":2024,"publication_status":"conference-paper","targets":["binary"]},{"id":"paper-binaryai","title":"BinaryAI: Binary Software Composition Analysis via Intelligent Binary Source Code Matching","title_zh":"BinaryAI：基于智能二进制—源代码匹配的二进制软件成分分析","description_en":"BinaryAI identifies which open-source C/C++ libraries a stripped binary reuses by matching its functions to source code. Ghidra decompiles each binary function to pseudo-C, and a Pythia-410M model, trained with a CLIP-style contrastive loss on about 10 million binary–source function pairs, embeds pseudo-code and source functions in one space. Candidates retrieved from a corpus of 56,342,179 source functions from 12,013 libraries are refined with link-time locality and the call graph, and a library is reported when the share of its matched functions exceeds a threshold. The authors report 22.54% recall@1 against 10.75% for CodeCMR, and library-detection precision and recall of 85.84% and 64.98% against 73.36% and 59.81% for an unnamed commercial tool.","description_zh":"BinaryAI 通过将剥离符号的二进制中的函数与源代码匹配，识别其复用了哪些开源 C/C++ 库。它先用 Ghidra 将每个二进制函数反编译为类 C 伪代码，再用以 CLIP 式对比损失、在约 1,000 万对二进制—源码函数上训练的 Pythia-410M 模型，把伪代码与源码函数嵌入同一向量空间。从包含 12,013 个库、56,342,179 个源码函数的语料中检索出候选后，方法借助链接时的位置局部性和调用图加以精炼；当某个库中被匹配函数的比例超过阈值时，即判定二进制包含该库。作者报告其 recall@1 为 22.54%，CodeCMR 为 10.75%；库识别的精确率与召回率分别为 85.84% 和 64.98%，一款未具名商业工具为 73.36% 和 59.81%。","authors":["Ling Jiang","Junwen An","Huihui Huang","Qiyi Tang","Sen Nie","Shi Wu","Yuqun Zhang"],"authors_omitted":null,"venue":"ICSE 2024","doi":"10.1145/3597503.3639100","arxiv_id":"2401.11161","year":2024,"publication_status":"conference-paper","targets":["binary"]},{"id":"paper-foc","title":"FoC: Figure out the Cryptographic Functions in Stripped Binaries with LLMs","title_zh":"FoC：利用大语言模型识别去符号二进制文件中的密码函数","description_en":"FoC uses FoC-BinLLM to summarize cryptographic functions in stripped binaries and FoC-Sim to retrieve similar implementations. It evaluates both models and applications to virus analysis and 1-day vulnerability detection.","description_zh":"FoC 使用 FoC-BinLLM 概括去符号二进制文件中密码函数的语义，并使用 FoC-Sim 检索相似实现。论文评估了两个模型，以及它们在病毒分析和已披露一天的漏洞检测中的应用。","authors":["Xiuwei Shang","Guoqiang Chen","Shaoyin Cheng","Shikai Guo","Yanming Zhang","Weiming Zhang","Nenghai Yu"],"authors_omitted":null,"venue":"arXiv","doi":null,"arxiv_id":"2403.18403","year":2024,"publication_status":"preprint","targets":["binary"]},{"id":"paper-slade","title":"SLaDe: A Portable Small Language Model Decompiler for Optimized Assembly","title_zh":"SLaDe：面向优化汇编的可移植小语言模型反编译器","description_en":"SLaDe translates function-level assembly into C with a 200M-parameter encoder–decoder model, code-specific tokenization and PsycheC type completion. It studies x86 and ARM at -O0 and -O3, combining generated candidates with input/output checks. The input is assembly text, not raw machine bytes; disassembly is outside the method.","description_zh":"SLaDe 使用 200M 参数的编码器—解码器模型、面向代码的分词及 PsycheC 类型补全，将函数级汇编转换为 C。研究覆盖 x86 与 ARM 的 -O0、-O3 设置，并结合生成候选与输入／输出检查。输入是汇编文本而非原始机器字节，反汇编不属于该方法。","authors":["Jordi Armengol-Estapé","Jackson Woodruff","Chris Cummins","Michael F. P. O'Boyle"],"authors_omitted":null,"venue":"IEEE/ACM CGO 2024","doi":"10.1109/CGO57630.2024.10444788","arxiv_id":"2305.12520","year":2024,"publication_status":"conference-paper","targets":["binary"]},{"id":"paper-cebin","title":"CEBin: A Cost-Effective Framework for Large-Scale Binary Code Similarity Detection","title_zh":"CEBin：面向大规模二进制代码相似性检测的低成本框架","description_en":"CEBin combines code embeddings to shortlist candidate functions with pairwise comparison to detect similar binary code, including vulnerable functions.","description_zh":"CEBin结合代码嵌入筛选候选函数，再通过成对比较检测相似的二进制代码，包括含漏洞的函数。","authors":["Hao Wang","Zeyu Gao","Chao Zhang","Mingyang Sun","Yuchen Zhou","Han Qiu","Xi Xiao"],"authors_omitted":null,"venue":"arXiv","doi":null,"arxiv_id":"2402.18818","year":2024,"publication_status":"preprint","targets":["binary"]},{"id":"paper-varbert","title":"“Len or index or count, anything but v1”: Predicting Variable Names in Decompilation Output with Transfer Learning","title_zh":"“len、index 或 count，就是别叫 v1”：基于迁移学习预测反编译输出中的变量名","description_en":"VarBERT suggests variable names for IDA Hex-Rays and Ghidra decompiler output with a BERT-style model pre-trained on 5.2M human-written C functions from Debian and fine-tuned on decompiled code; it also predicts whether each variable came from the developer or was introduced by the decompiler. The authors build VarCorpus from Gentoo C and C++ packages compiled for x86-64 at O0–O3, labeling decompiled variables from debug symbols. On per-function splits of O2 binaries, top-1 accuracy is 54.43% for IDA and 54.49% for Ghidra; on an IDA-O0 subset it reaches 50.70%, against 35.94% for DIRE and 38.00% for DIRTY.","description_zh":"VarBERT 使用 BERT 式模型为 IDA Hex-Rays 与 Ghidra 的反编译输出建议变量名：模型先以来自 Debian 的 520 万个人工编写的 C 函数预训练，再以反编译代码微调；它还预测每个变量出自开发者，还是由反编译器引入。作者从 Gentoo 的 C 与 C++ 软件包构建 VarCorpus，在 O0 至 O3 下编译为 x86-64，并借助调试符号为反编译变量标注名称。在 O2 二进制的按函数划分上，IDA 与 Ghidra 的 Top-1 准确率分别为 54.43% 和 54.49%；在 IDA-O0 子集上为 50.70%，DIRE 与 DIRTY 分别为 35.94% 和 38.00%。","authors":["Kuntal Kumar Pal","Ati Priya Bajaj","Pratyay Banerjee","Audrey Dutcher","Mutsumi Nakamura","Zion Leonahenahe Basque","Himanshu Gupta","Saurabh Arjun Sawant","Ujjwala Anantheswaran","Yan Shoshitaishvili","Adam Doupé","Chitta Baral","Ruoyu Wang"],"authors_omitted":null,"venue":"IEEE S&P 2024","doi":"10.1109/SP54263.2024.00152","arxiv_id":null,"year":2024,"publication_status":"conference-paper","targets":["binary"]},{"id":"paper-degpt","title":"DeGPT: Optimizing Decompiler Output with LLM","title_zh":"DeGPT：使用大语言模型优化反编译器输出","description_en":"Refines existing C-like decompiler output through three coordinated roles that select, propose and check changes. It simplifies structures, adds comments and renames variables; Micro Snippet Semantic Calculation compares simulated symbol values and calls before accepting structural changes. The authors evaluate readability and naming on 620 functions from four codebases, with separate stripped and non-stripped variants.","description_zh":"通过三个协同角色选择、提出并检查修改，改进已有的类 C 反编译输出。其流程简化代码结构、添加注释并重命名变量，在接受结构修改前，使用微代码片段语义计算比较模拟的符号值与调用。作者以四个代码库中的 620 个函数评估可读性与命名效果，并分别测试保留与剥离符号的版本。","authors":["Peiwei Hu","Ruigang Liang","Kai Chen"],"authors_omitted":null,"venue":"NDSS 2024","doi":"10.14722/ndss.2024.24401","arxiv_id":null,"year":2024,"publication_status":"conference-paper","targets":["binary"]},{"id":"paper-assemblage","title":"Assemblage: Automatic Binary Dataset Construction for Machine Learning","title_zh":"Assemblage：面向机器学习的二进制数据集自动构建","description_en":"Assemblage is a distributed system that crawls GitHub and vcpkg, builds C/C++ projects under many compiler configurations, and records source-to-binary mappings such as function addresses, source code, comments and PDB or DWARF debug information. Run on AWS for about a year, it produced 890k Windows PE binaries built with Visual Studio 2015–2022 across optimization levels, architectures and Debug/Release modes, plus 428k Linux ELF binaries from GCC and Clang, in 29 configurations. Case studies use the data for compiler provenance with PassTell, function similarity with a graph neural network and jTrans, and function-boundary identification comparing XDA with IDA.","description_zh":"Assemblage 是一个分布式系统，从 GitHub 与 vcpkg 爬取 C/C++ 项目，在多种编译器配置下构建，并记录源码到二进制的映射，包括函数地址、源代码、注释以及 PDB 或 DWARF 调试信息。该系统在 AWS 上运行约一年，以 Visual Studio 2015–2022 在不同优化级别、架构及 Debug／Release 模式下构建出 89 万个 Windows PE 二进制，另以 GCC 与 Clang 构建出 42.8 万个 Linux ELF 二进制，共涵盖 29 种配置。案例研究将这些数据用于 PassTell 编译器溯源、图神经网络与 jTrans 函数相似性检测，以及比较 XDA 与 IDA 的函数边界识别。","authors":["Chang Liu","Rebecca Saul","Yihao Sun","Edward Raff","Maya Fuchs","Townsend Southard Pantano","James Holt","Kristopher Micinski"],"authors_omitted":null,"venue":"NeurIPS 2024 Datasets and Benchmarks","doi":"10.52202/079017-1871","arxiv_id":"2405.03991","year":2024,"publication_status":"conference-paper","targets":["binary"]},{"id":"paper-binsum","title":"Binary Code Summarization: Benchmarking ChatGPT/GPT-4 and Other Large Language Models","title_zh":"二进制代码摘要：ChatGPT／GPT-4 及其他大语言模型的基准评测","description_en":"BinSum benchmarks LLMs on summarizing binary functions in natural language. The authors compile 44 GNU projects with GCC 7.5 for x86, x64, ARM and MIPS at -O0 to -O3, match 557,664 binary functions to developer comments as reference summaries, and present each function as raw bytes, assembly, IDA microcode or decompiled code with and without symbols. GPT-4, ChatGPT, Llama 2 and Code Llama receive prompts selected from 320 GPT-4-generated candidates, with the fine-tuned BinT5 as a baseline; outputs are scored by embedding similarity alongside BLEU, METEOR and ROUGE-L. Decompiled code is the most useful representation, and stripping symbols lowers the average similarity score from 0.449 to 0.202.","description_zh":"BinSum 评测大语言模型以自然语言概括二进制函数的能力。作者使用 GCC 7.5 将 44 个 GNU 项目编译为 x86、x64、ARM 和 MIPS 架构、-O0 至 -O3 优化级别的二进制，把 557,664 个二进制函数与开发者注释匹配作为参考摘要，并以原始字节、汇编、IDA 微码，以及带或不带符号的反编译代码等形式呈现每个函数。GPT-4、ChatGPT、Llama 2 与 Code Llama 使用从 320 个由 GPT-4 生成的候选中选出的提示词，并以经过微调的 BinT5 作为基线；输出以嵌入相似度并结合 BLEU、METEOR 与 ROUGE-L 评分。反编译代码是最有用的表示形式，剥离符号会使平均相似度分数从 0.449 降至 0.202。","authors":["Xin Jin","Jonathan Larson","Weiwei Yang","Zhiqiang Lin"],"authors_omitted":null,"venue":"arXiv","doi":null,"arxiv_id":"2312.09601","year":2023,"publication_status":"preprint","targets":["binary"]},{"id":"paper-dec-gpt","title":"Refining Decompiled C Code with Large Language Models","title_zh":"利用大语言模型改进反编译的 C 代码","description_en":"The paper proposes a two-step hybrid LLM approach to refine IDA-Pro decompiled C code for recompilation. On popular C test cases, it reports a recompilation success rate above 75% with moderate effort.","description_zh":"论文提出一种两步混合方法，利用大语言模型改进 IDA-Pro 反编译生成的 C 代码，使其能够重新编译。在一组常见的 C 测试用例上，该方法以适度工作量实现了超过 75% 的重新编译成功率。","authors":["Wai Kin Wong","Huaijin Wang","Zongjie Li","Zhibo Liu","Shuai Wang","Qiyi Tang","Sen Nie","Shi Wu"],"authors_omitted":null,"venue":"arXiv","doi":null,"arxiv_id":"2310.06530","year":2023,"publication_status":"preprint","targets":["binary"]},{"id":"paper-ktrans","title":"kTrans: Knowledge-Aware Transformer for Binary Code Embedding","title_zh":"kTrans：用于二进制代码嵌入的知识感知 Transformer","description_en":"kTrans uses a knowledge-aware Transformer to embed binary code. It evaluates the embeddings through outlier detection and visualization, and on binary code similarity, function type recovery, and indirect call recognition.","description_zh":"kTrans 使用融合汇编语言知识的 Transformer 生成二进制代码嵌入。论文通过离群点检测和可视化考察嵌入，并评估其在二进制代码相似性检测、函数类型恢复和间接调用识别中的表现。","authors":["Wenyu Zhu","Hao Wang","Yuchen Zhou","Jiaming Wang","Zihan Sha","Zeyu Gao","Chao Zhang"],"authors_omitted":null,"venue":"arXiv","doi":null,"arxiv_id":"2308.12659","year":2023,"publication_status":"preprint","targets":["binary"]},{"id":"paper-btd","title":"Decompiling x86 Deep Neural Network Executables","title_zh":"反编译 x86 深度神经网络可执行文件","description_en":"BTD (Bin to DNN) decompiles stripped 64-bit x86 executables emitted by deep-learning compilers into model specifications: operator types, network topology, dimensions and parameters. A learned classifier labels disassembled functions as DNN operators, Intel Pin dynamic analysis chains them, and taint-reduced, trace-based symbolic execution with per-operator patterns recovers dimensions and parameter layouts. The authors rebuild recovered models in PyTorch and recompile them to compare behaviour with the original executable.","description_zh":"BTD（Bin to DNN）将深度学习编译器生成、已剥离符号的 64 位 x86 可执行文件反编译为模型规格：算子类型、网络拓扑、维度与参数。学习得到的分类器把反汇编函数标注为 DNN 算子，Intel Pin 动态分析将算子串联起来，再在经污点分析裁剪的执行轨迹上进行符号执行，借助针对各算子的模式恢复维度与参数布局。作者在 PyTorch 中重建恢复出的模型并重新编译，以便与原可执行文件比较行为。","authors":["Zhibo Liu","Yuanyuan Yuan","Shuai Wang","Xiaofei Xie","Lei Ma"],"authors_omitted":null,"venue":"USENIX Security 2023","doi":null,"arxiv_id":"2210.01075","year":2023,"publication_status":"conference-paper","targets":["binary"]},{"id":"paper-xfl","title":"XFL: Naming Functions in Binaries with Extreme Multi-label Learning","title_zh":"XFL：基于极端多标签学习的二进制函数命名","description_en":"XFL treats function naming in stripped binaries as extreme multi-label classification: names are split into tokens, and PfastreXML ranks which tokens from a vocabulary of frequent labels fit each function. Its DEXTER embedding combines static-analysis features built on angr’s VEX IR with call-graph and whole-binary context, and a separate language model orders predicted tokens into a name string. On 741,724 functions from 10,047 x86-64 C binaries in Debian packages, with a 1,024-label vocabulary, the authors report precision 0.835, recall 0.575 and F1 0.681, ahead of Punstrip, Debin and Nero in precision and F1.","description_zh":"XFL 将去符号二进制中的函数命名视为极端多标签分类：函数名被拆分为词元，再由 PfastreXML 从常见标签词表中为每个函数排序合适的词元。其 DEXTER 嵌入结合基于 angr VEX 中间表示的静态分析特征、调用图上下文和整个二进制的全局上下文，另有一个语言模型把预测的词元排列成函数名字符串。在来自 Debian 软件包、共 10,047 个 x86-64 C 二进制中的 741,724 个函数上，以 1,024 个标签的词表，作者报告精确率 0.835、召回率 0.575、F1 0.681，在精确率和 F1 上领先 Punstrip、Debin 与 Nero。","authors":["James Patrick-Evans","Moritz Dannehl","Johannes Kinder"],"authors_omitted":null,"venue":"IEEE S&P 2023","doi":"10.1109/SP46215.2023.10179439","arxiv_id":"2107.13404","year":2023,"publication_status":"conference-paper","targets":["binary"]},{"id":"paper-binkit","title":"Revisiting Binary Code Similarity Analysis Using Interpretable Feature Engineering and Lessons Learned","title_zh":"基于可解释特征工程重新审视二进制代码相似性分析及经验教训","description_en":"Builds BinKit, a reproducible cross-compilation benchmark of 243,128 binaries and 36,256,322 functions from 51 GNU packages, covering 1,352 combinations of eight architectures, nine GCC and Clang versions, five optimization levels, and PIE, LTO, no-inline and Obfuscator-LLVM options. TikNib, an interpretable baseline over simple presemantic function features, measures how compilers, options and architectures change those features. The authors report that a few basic features approach a deep-learning tool’s accuracy, that type features push AUC above 0.99, and trace failures to IDA Pro analysis errors, compiler back-end differences and architecture-specific code.","description_zh":"构建可复现的交叉编译基准 BinKit，包含由 51 个 GNU 软件包生成的 243,128 个二进制和 36,256,322 个函数，覆盖八种架构、九个 GCC 与 Clang 版本、五个优化级别，以及 PIE、LTO、禁止内联和 Obfuscator-LLVM 等选项构成的 1,352 种组合。可解释基线 TikNib 基于简单的前语义函数特征，衡量编译器、编译选项与架构如何改变这些特征。作者报告称，少量基本特征即可接近深度学习工具的准确率，加入类型特征后 AUC 超过 0.99，并将失败案例归因于 IDA Pro 分析错误、编译器后端差异和架构特定代码。","authors":["Dongkwan Kim","Eunsoo Kim","Sang Kil Cha","Sooel Son","Yongdae Kim"],"authors_omitted":null,"venue":"IEEE Transactions on Software Engineering","doi":"10.1109/TSE.2022.3187689","arxiv_id":"2011.10749","year":2023,"publication_status":"journal-article","targets":["binary"]},{"id":"paper-asteria-pro","title":"Asteria-Pro: Enhancing Deep-Learning Based Binary Code Similarity Detection by Incorporating Domain Knowledge","title_zh":"Asteria-Pro：融合领域知识提升基于深度学习的二进制代码相似性检测","description_en":"Asteria-Pro adds domain-knowledge pre-filtration and re-ranking to Tree-LSTM-based binary code similarity detection. It evaluates firmware vulnerability search across diverse IoT hardware architectures.","description_zh":"Asteria-Pro 在基于 Tree-LSTM 的二进制代码相似性检测中加入领域知识预筛选和重排序，并评估其在不同物联网硬件架构的固件漏洞搜索中的表现。","authors":["Shouguo Yang","Chaopeng Dong","Yang Xiao","Yiran Cheng","Zhiqiang Shi","Zhi Li","Limin Sun"],"authors_omitted":null,"venue":"arXiv","doi":null,"arxiv_id":"2301.00511","year":2023,"publication_status":"preprint","targets":["binary","firmware"]},{"id":"paper-symlm","title":"SymLM: Predicting Function Names in Stripped Binaries via Context-Sensitive Execution-Aware Code Embeddings","title_zh":"SymLM：基于上下文敏感、执行感知代码嵌入的去符号二进制函数名预测","description_en":"SymLM predicts function names for stripped binaries as sets of name words. It encodes each function’s instructions with a Trex model pretrained on micro-execution traces, fuses them with embeddings of callers, internal callees and external library calls taken from Ghidra’s interprocedural CFG, and scores words from a fixed vocabulary with an MLP decoder; name preprocessing and a word-embedding module, CodeWordNet, handle abbreviations and synonyms. On 1,431,169 functions from 16,027 binaries of 27 projects across x86, x64, ARM and MIPS, O0–O3 and four Hikari obfuscations, the authors report weighted average precision 0.634, recall 0.677 and F1 0.655, plus a firmware case study.","description_zh":"SymLM 将去符号二进制的函数名预测为一组名称单词。它使用在微执行轨迹上预训练的 Trex 模型编码每个函数的指令，将其与取自 Ghidra 过程间控制流图的调用者、内部被调用函数及外部库调用的嵌入融合，再由 MLP 解码器对固定词表中的单词打分；名称预处理和词嵌入模块 CodeWordNet 用于处理缩写与同义词。在 27 个项目的 16,027 个二进制、共 1,431,169 个函数上（涵盖 x86、x64、ARM 与 MIPS，O0–O3 优化级别及四种 Hikari 混淆），作者报告加权平均精确率 0.634、召回率 0.677、F1 0.655，并给出固件案例研究。","authors":["Xin Jin","Kexin Pei","Jun Yeon Won","Zhiqiang Lin"],"authors_omitted":null,"venue":"ACM CCS 2022","doi":"10.1145/3548606.3560612","arxiv_id":null,"year":2022,"publication_status":"conference-paper","targets":["binary"]},{"id":"paper-binary-function-similarity","title":"How Machine Learning Is Solving the Binary Function Similarity Problem","title_zh":"机器学习如何解决二进制函数相似性问题","description_en":"Measures binary function similarity research by re-implementing ten representative approaches from the security, programming-language and machine-learning communities in one IDA Pro-based framework, from fuzzy hashing (Catalog1, FunctionSimSearch) to graph neural network, NLP-encoder and transformer models. Two new datasets support six tasks that vary optimization, compiler, bitness and architecture, scored by AUC and ranking metrics, plus a firmware vulnerability-search case. The authors report that fuzzy hashing fails in harder cross-architecture settings, GNN-based models perform best in almost all tasks, and many recent models score similarly on common data.","description_zh":"在统一的、基于 IDA Pro 的框架中重新实现来自安全、程序语言与机器学习三个研究社区的十种代表性方法，对二进制函数相似性研究开展测量，方法涵盖模糊哈希（Catalog1、FunctionSimSearch）以及图神经网络、NLP 编码器与 Transformer 模型。两个新数据集支撑六项改变优化级别、编译器、位宽与架构的任务，以 AUC 和排序指标评分，另含一项固件漏洞搜索案例。作者报告称，模糊哈希在较难的跨架构场景中失效，基于图神经网络的模型几乎在所有任务中表现最佳，许多近期模型在相同数据上的得分相近。","authors":["Andrea Marcelli","Mariano Graziano","Xabier Ugarte-Pedrero","Yanick Fratantonio","Mohamad Mansouri","Davide Balzarotti"],"authors_omitted":null,"venue":"USENIX Security 2022","doi":null,"arxiv_id":null,"year":2022,"publication_status":"conference-paper","targets":["binary"]},{"id":"paper-deepdi","title":"DeepDi: Learning a Relational Graph Convolutional Network Model on Instructions for Fast and Accurate Disassembly","title_zh":"DeepDi：在指令上学习关系图卷积网络模型以实现快速准确的反汇编","description_en":"DeepDi disassembles x86 and x64 binaries by decoding a superset of candidate instructions, linking them in an Instruction Flow Graph of forward, backward and overlap relations, and classifying true instructions with a Relational Graph Convolutional Network; heuristics and a small classifier then recover function entry points. On BAP corpora, LLVM 11 built with MSVC on Windows, and SPEC CPU2006 and CPU2017, the authors report accuracy comparable or superior to IDA Pro, Binary Ninja, Ghidra, Datalog Disassembly and XDA, robustness on Linn–Debray and Hikari obfuscated binaries, single-core CPU throughput of 146 KB/s (about twice IDA Pro) and GPU throughput of 24.5 MB/s (about 350 times IDA Pro).","description_zh":"DeepDi 对 x86 与 x64 二进制进行反汇编：先解码候选指令的超集，再以前向、后向与重叠关系将其连接成指令流图，并用关系图卷积网络识别真实指令；随后借助启发式规则和一个小型分类器恢复函数入口。作者在 BAP 语料、Windows 上以 MSVC 构建的 LLVM 11，以及 SPEC CPU2006 与 CPU2017 上报告，其准确率与 IDA Pro、Binary Ninja、Ghidra、Datalog Disassembly 和 XDA 相当或更优，在 Linn–Debray 与 Hikari 混淆二进制上表现稳健，单核 CPU 吞吐量为 146 KB/s（约为 IDA Pro 的两倍），GPU 吞吐量为 24.5 MB/s（约为 IDA Pro 的 350 倍）。","authors":["Sheng Yu","Yu Qu","Xunchao Hu","Heng Yin"],"authors_omitted":null,"venue":"USENIX Security 2022","doi":null,"arxiv_id":null,"year":2022,"publication_status":"conference-paper","targets":["binary"]},{"id":"paper-decomperson","title":"Decomperson: How Humans Decompile and What We Can Learn From It","title_zh":"Decomperson：人类如何反编译以及我们能从中学到什么","description_en":"Reframes manual reverse engineering as perfect decompilation: writing source that, compiled with the original toolchain and options, reproduces the target functions’ binary code exactly. The authors built Decomperson, a web editor that compiles, disassembles, tests and diffs each submission, and used it in Decompetition, a 24-hour Jeopardy-style competition in November 2020 with 23 unstripped challenge binaries written in C, C++, Go, Rust and Swift. Over 150 participants made more than 35,000 submissions, including over 300 perfect ones; all but one challenge was perfectly decompiled, and the recorded edit histories are analyzed to describe how humans decompile.","description_zh":"将人工逆向工程重新表述为“完美反编译”：编写源码，使其在原始工具链与编译选项下编译后，能完全复现目标函数的二进制代码。作者开发了 Decomperson——一个对每次提交进行编译、反汇编、测试与差异比对的网页编辑器，并在 2020 年 11 月举办的 24 小时 Jeopardy 式竞赛 Decompetition 中使用；竞赛包含 23 个未剥离符号、以 C、C++、Go、Rust 与 Swift 编写的挑战二进制。150 余名参与者提交了 35,000 多份代码，其中 300 多份达到完美反编译；除一个挑战外，其余均被完美反编译。作者分析记录下的编辑历史，以描述人类的反编译过程。","authors":["Kevin Burk","Fabio Pagani","Christopher Kruegel","Giovanni Vigna"],"authors_omitted":null,"venue":"USENIX Security 2022","doi":null,"arxiv_id":null,"year":2022,"publication_status":"conference-paper","targets":["binary"]},{"id":"paper-dirty","title":"Augmenting Decompiler Output with Learned Variable Names and Types","title_zh":"利用学习得到的变量名称与类型增强反编译输出","description_en":"Introduces DIRTY, a Transformer model that recommends variable names and types from decompiled code and layout information, together with the DIRT corpus for training and evaluation.","description_zh":"提出 Transformer 模型 DIRTY，根据反编译代码和布局信息推荐变量名与类型，并提供用于训练和评估的 DIRT 语料。","authors":["Qibin Chen","Jeremy Lacomis","Edward J. Schwartz","Claire Le Goues","Graham Neubig","Bogdan Vasilescu"],"authors_omitted":null,"venue":"USENIX Security 2022","doi":null,"arxiv_id":"2108.06363","year":2022,"publication_status":"conference-paper","targets":["binary"]},{"id":"paper-jtrans","title":"jTrans: Jump-Aware Transformer for Binary Code Similarity Detection","title_zh":"jTrans：面向二进制代码相似性检测的跳转感知 Transformer","description_en":"jTrans embeds binary functions for similarity search with a BERT-style Transformer. Its jump-aware representation shares parameters between a direct jump’s operand token and the positional embedding of the jump target, so control flow enters the instruction sequence without a separate graph network. The model is pre-trained with masked language modeling and jump-target prediction, then fine-tuned with a cosine triplet objective on functions compiled from the same source at different optimization levels. The paper also introduces BinaryCorp, built by compiling C/C++ packages from Arch Linux’s official repositories and the AUR with gcc and g++.","description_zh":"jTrans 使用 BERT 风格的 Transformer 为二进制函数生成嵌入，以支持相似性检索。其跳转感知表示让直接跳转的操作数词元与跳转目标的位置嵌入共享参数，从而无需单独的图神经网络即可将控制流引入指令序列。模型先以掩码语言建模和跳转目标预测进行预训练，再以余弦三元组目标在同一源码不同优化级别编译出的函数上微调。论文还发布了 BinaryCorp，它由 gcc 与 g++ 编译 Arch Linux 官方仓库及 AUR 中的 C/C++ 软件包构建而成。","authors":["Hao Wang","Wenjie Qu","Gilad Katz","Wenyu Zhu","Zeyu Gao","Han Qiu","Jianwei Zhuge","Chao Zhang"],"authors_omitted":null,"venue":"ACM ISSTA 2022","doi":"10.1145/3533767.3534367","arxiv_id":"2205.12713","year":2022,"publication_status":"conference-paper","targets":["binary"]},{"id":"paper-exebench","title":"ExeBench: an ML-scale dataset of executable C functions","title_zh":"ExeBench：机器学习规模的可执行 C 函数数据集","description_en":"ExeBench is a dataset, not a decompiler. It extracts C functions from GitHub and AnghaBench, makes them compilable by locating real headers and definitions or injecting synthetic ones, and generates input/output examples from function signatures with a C++ wrapper that runs each function. After exact deduplication the authors report 4,485,817 compilable and 687,843 executable functions, of which 124,612 have rich IO that a constant or identity implementation cannot pass; the paper also describes x86 and ARM assembly at O0, Os and Ofast for each row. Decompilation studies such as SLaDe and LLM4Decompile later used it to test whether decompiled functions re-execute correctly.","description_zh":"ExeBench 是数据集，而非反编译器。它从 GitHub 与 AnghaBench 中提取 C 函数，通过查找真实的头文件与定义或注入合成定义使其可编译，再依据函数签名生成输入／输出样例，并以 C++ 包装器运行每个函数。精确去重后，作者报告共有 4,485,817 个可编译函数和 687,843 个可执行函数，其中 124,612 个带有常量或恒等实现无法通过的丰富 IO；论文还说明每行数据附有 O0、Os 与 Ofast 下的 x86 和 ARM 汇编。SLaDe、LLM4Decompile 等反编译研究随后用它检验反编译函数能否正确重新执行。","authors":["Jordi Armengol-Estapé","Jackson Woodruff","Alexander Brauckmann","José Wesley de Souza Magalhães","Michael F. P. O'Boyle"],"authors_omitted":null,"venue":"ACM SIGPLAN MAPS 2022","doi":"10.1145/3520312.3534867","arxiv_id":null,"year":2022,"publication_status":"conference-paper","targets":["binary"]},{"id":"paper-elipmoc","title":"Elipmoc: Advanced Decompilation of Ethereum Smart Contracts","title_zh":"Elipmoc：以太坊智能合约的高级反编译","description_en":"Elipmoc decompiles Ethereum Virtual Machine bytecode into a structured three-address intermediate representation for security analyses and reverse engineering. Built as an evolution of the Datalog-based Gigahorse decompiler, it adds transactional context sensitivity, path-sensitive inference of function arguments and returns with path merging, and fully context-sensitive reconstruction of private functions. On a uniform random sample of 5,000 unique mainnet contracts first deployed between April and September 2021, the authors report fully resolved operands for 99.5% of contracts versus 62.8% for Gigahorse, 67% more unique external-call signatures than Etherscan’s Panoramix, and over 5x faster decompilation.","description_zh":"Elipmoc 将以太坊虚拟机字节码反编译为结构化的三地址中间表示，服务于安全分析与逆向工程。它由基于 Datalog 的 Gigahorse 反编译器演进而来，新增事务上下文敏感性、结合路径合并的路径敏感函数参数与返回值推断，以及完全上下文敏感的私有函数重建。作者在 2021 年 4 月至 9 月间首次部署于主网的 5,000 个唯一合约的均匀随机样本上，报告 99.5% 的合约操作数被完全解析（Gigahorse 为 62.8%），识别出的唯一外部调用签名比 Etherscan 的 Panoramix 多 67%，且反编译速度快 5 倍以上。","authors":["Neville Grech","Sifis Lagouvardos","Ilias Tsatiris","Yannis Smaragdakis"],"authors_omitted":null,"venue":"Proceedings of the ACM on Programming Languages (OOPSLA 2022)","doi":"10.1145/3527321","arxiv_id":null,"year":2022,"publication_status":"journal-article","targets":["binary"]},{"id":"paper-pop-quiz-llm-re","title":"Pop Quiz! Can a Large Language Model Help With Reverse Engineering?","title_zh":"随堂测验！大语言模型能帮助逆向工程吗？","description_en":"Tests whether OpenAI’s Codex model code-davinci-001 can answer reverse-engineering questions about C code in a zero-shot question-and-answer prompt. Programs come from templates the authors wrote, covering cybersecurity snippets and industrial-control algorithms such as PID controllers and filters, plus five single-file Linux malware samples from vx-underground. Each is presented as original or name-randomized source, or as Ghidra decompilation of gcc -O1 builds with debug information, without it, or stripped. After exploratory open-ended questions, generated true/false and short-answer questions about purpose, capabilities and key variables are graded against an answer oracle; Codex answered 72,754 of 136,260 questions correctly.","description_zh":"检验 OpenAI 的 Codex 模型 code-davinci-001 能否在零样本问答式提示中回答有关 C 代码的逆向工程问题。程序来自作者编写的模板，涵盖网络安全代码片段以及 PID 控制器、滤波器等工业控制算法，另有五个来自 vx-underground 的单文件 Linux 恶意软件样本。每个程序以原始或名称随机化的源码，或以 gcc -O1 构建（带调试信息、不带调试信息或剥离符号）经 Ghidra 反编译的形式呈现。在探索性的开放式提问之后，作者针对程序用途、能力与关键变量自动生成判断题和简答题，并依据答案标准评分；Codex 在 136,260 个问题中答对 72,754 个。","authors":["Hammond Pearce","Benjamin Tan","Prashanth Krishnamurthy","Farshad Khorrami","Ramesh Karri","Brendan Dolan-Gavitt"],"authors_omitted":null,"venue":"arXiv","doi":null,"arxiv_id":"2202.01142","year":2022,"publication_status":"preprint","targets":["binary"]},{"id":"paper-beyond-the-c","title":"Beyond the C: Retargetable Decompilation using Neural Machine Translation","title_zh":"超越 C：基于神经机器翻译的可重定向反编译","description_en":"BTC (Beyond The C) treats decompilation as plain-text translation from compiler-emitted x86-64 assembly to source code. It uses byte-pair-encoding tokenizers trained separately on assembly and source, and a standard fairseq transformer. Function pairs are matched through the compiler's CFI and line directives rather than language-specific parsers, compiler plugins or lifters, so the same pipeline is retrained for Go, Fortran, OCaml and C. Training sets range from about 10,000 functions for small C, Go and Fortran corpora to 2 million C functions built from Debian packages. The best model, trained on the large C set, reaches a normalized average edit distance of 0.46 on held-out functions.","description_zh":"BTC（Beyond The C）将反编译视为从编译器输出的 x86-64 汇编到源码的纯文本翻译，分别在汇编与源码上训练字节对编码分词器，并使用标准 fairseq Transformer。它借助编译器输出的 CFI 与行号指令配对函数，而非依赖特定语言的解析器、编译器插件或提升器，因此同一流程可针对 Go、Fortran、OCaml 与 C 重新训练。训练集规模从小型 C、Go 与 Fortran 语料的约 10,000 个函数，到基于 Debian 软件包构建的 200 万个 C 函数不等。在大型 C 数据集上训练的最佳模型，在留出函数上的归一化平均编辑距离为 0.46。","authors":["Iman Hosseini","Brendan Dolan-Gavitt"],"authors_omitted":null,"venue":"Workshop on Binary Analysis Research (BAR) 2022","doi":"10.14722/bar.2022.23009","arxiv_id":"2212.08950","year":2022,"publication_status":"conference-paper","targets":["binary"]},{"id":"paper-asteria","title":"Asteria: Deep Learning-based AST-Encoding for Cross-platform Binary Code Similarity Detection","title_zh":"Asteria：基于深度学习的抽象语法树编码，用于跨平台二进制代码相似性检测","description_en":"ASTERIA uses a Tree-LSTM to encode function ASTs and compare binary functions across platforms. It was evaluated on function pairs and used to search IoT firmware for vulnerabilities.","description_zh":"ASTERIA 使用 Tree-LSTM 编码函数的抽象语法树，以比较不同平台上的二进制函数。论文评估了函数对的相似性检测，并将其用于物联网固件漏洞搜索。","authors":["Shouguo Yang","Long Cheng","Yicheng Zeng","Zhe Lang","Hongsong Zhu","Zhiqiang Shi"],"authors_omitted":null,"venue":"2021 51st Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN)","doi":"10.1109/dsn48987.2021.00036","arxiv_id":"2108.06082","year":2021,"publication_status":"conference-paper","targets":["binary","firmware"]},{"id":"paper-trex","title":"Trex: Learning Execution Semantics from Micro-Traces for Binary Similarity","title_zh":"Trex：从微轨迹中学习执行语义以识别相似二进制函数","description_en":"Trex learns execution semantics from function micro-traces, then uses that knowledge to match semantically similar binary functions.","description_zh":"Trex 从函数微轨迹中学习执行语义，再利用所学知识匹配语义相似的二进制函数。","authors":["Kexin Pei","Zhou Xuan","Junfeng Yang","Suman Jana","Baishakhi Ray"],"authors_omitted":null,"venue":"arXiv","doi":null,"arxiv_id":"2012.08680","year":2020,"publication_status":"preprint","targets":["binary"]},{"id":"paper-nero","title":"Neural reverse engineering of stripped binaries using augmented control flow graphs","title_zh":"基于增强控制流图的剥离符号二进制神经逆向工程","description_en":"Nero predicts names for procedures in stripped x86-64 Linux executables; it does not produce decompiled code. Static analysis reconstructs call sites, including imported API names, and augments their arguments with concrete and abstract values along control-flow paths. LSTM, Transformer and graph neural network encoders over the resulting augmented call-site graph feed a decoder that generates the name as subtokens. On a GNU-package test set the authors report 45.53 F1 for Nero-GNN, against 35.52 for an adapted DIRE and 33.66 for Debin.","description_zh":"Nero 为剥离符号的 x86-64 Linux 可执行文件中的过程预测名称，并不生成反编译代码。它通过静态分析重建调用点（包括导入的 API 名称），并沿控制流路径为参数补充具体值与抽象值。LSTM、Transformer 与图神经网络编码器处理由此得到的增强调用点图，再由解码器以子词序列生成名称。在 GNU 软件包测试集上，作者报告 Nero-GNN 的 F1 为 45.53，改造后的 DIRE 为 35.52，Debin 为 33.66。","authors":["Yaniv David","Uri Alon","Eran Yahav"],"authors_omitted":null,"venue":"Proceedings of the ACM on Programming Languages (OOPSLA 2020)","doi":"10.1145/3428293","arxiv_id":"1902.09122","year":2020,"publication_status":"journal-article","targets":["binary"]},{"id":"paper-decfuzzer","title":"How far we have come: testing decompilation correctness of C decompilers","title_zh":"我们走了多远：C 反编译器反编译正确性测试","description_en":"Tests whether C decompilers preserve program behavior. The authors' DecFuzzer compiles a Csmith-generated program, decompiles the executable, substitutes the decompiled function for the original in the source, recompiles, and compares the two programs' outputs; equivalence-modulo-inputs (EMI) mutation then derives further test programs from the seeds. Across four popular decompilers the authors report 1,423 inputs that trigger decompilation errors and, after manual analysis, 13 bugs in two open-source decompilers. They argue that modern decompilers are making real progress on functional correctness, while type recovery and optimization still hinder accurate output.","description_zh":"测试 C 反编译器能否保持程序行为。作者的 DecFuzzer 编译由 Csmith 生成的程序，反编译所得可执行文件，在源码中用反编译出的函数替换原函数后重新编译，并比较两个程序的输出；随后通过模输入等价（EMI）变异，从种子程序派生更多测试程序。作者在四种常用反编译器上报告了 1,423 个触发反编译错误的输入，并经人工分析在两个开源反编译器中确认 13 个缺陷。他们认为现代反编译器在功能正确性上取得了切实进展，但类型恢复与优化仍妨碍其输出准确的代码。","authors":["Zhibo Liu","Shuai Wang"],"authors_omitted":null,"venue":"ACM ISSTA 2020","doi":"10.1145/3395363.3397370","arxiv_id":null,"year":2020,"publication_status":"conference-paper","targets":["binary"]},{"id":"paper-e9patch","title":"Binary Rewriting without Control Flow Recovery","title_zh":"无需控制流恢复的二进制重写","description_en":"E9Patch statically rewrites x86-64 binaries by inserting jumps to trampolines without moving any other instruction, so the original set of jump targets is preserved and control-flow recovery, symbolization and debug information are not needed. Where a five-byte jump does not fit, instruction punning, padding and successor or neighbor eviction overlap the jump with existing bytes or relocate neighboring instructions into their own trampolines; physical page grouping reduces the memory and file-size cost of scattered trampolines. Instruction locations come from a separate frontend, a basic linear disassembler in the evaluation. The authors evaluate SPEC2006, Ubuntu 16.04 system binaries, and Chrome and Firefox builds over 100 MB, and demonstrate binary repair and heap-write hardening with low fat pointers.","description_zh":"E9Patch 对 x86-64 二进制进行静态重写：插入跳转到跳板代码的指令，而不移动其他任何指令，从而保留原有跳转目标集合，无需控制流恢复、符号化或调试信息。当五字节跳转放不下时，它通过指令双关、填充以及后继或邻近指令驱逐，使跳转与已有字节重叠，或把邻近指令移入各自的跳板；物理页分组则降低分散跳板带来的内存与文件体积开销。指令位置由独立的前端提供，评测中使用的是基础线性反汇编器。作者评测了 SPEC2006、Ubuntu 16.04 系统二进制以及超过 100 MB 的 Chrome 与 Firefox，并演示了二进制修复和基于低胖指针的堆写加固。","authors":["Gregory J. Duck","Xiang Gao","Abhik Roychoudhury"],"authors_omitted":null,"venue":"PLDI 2020","doi":"10.1145/3385412.3385972","arxiv_id":null,"year":2020,"publication_status":"conference-paper","targets":["binary"]},{"id":"paper-retrowrite","title":"RetroWrite: Statically Instrumenting COTS Binaries for Fuzzing and Sanitization","title_zh":"RetroWrite：为模糊测试与内存检测静态插桩商用现成二进制","description_en":"RetroWrite statically rewrites 64-bit position-independent Linux binaries by generating reassembleable assembly, so instrumentation can be inserted as if at compile time. Instead of heuristics, it symbolizes references from the binary's own metadata: control-flow operands, PC-relative addressing that position-independent code must use, and data relocations become assembler labels, which separates references from scalars. On this base the authors build AFL coverage instrumentation and a binary-only AddressSanitizer. They report fuzzing throughput matching compiler instrumentation and 4.5x faster than AFL's QEMU mode, with more bugs found on LAVA-M, and binary ASan that runs 3x faster than Valgrind memcheck on SPEC CPU2006 and detects 80% more bugs in their evaluation, whose coverage tests use Juliet memory-corruption cases.","description_zh":"RetroWrite 通过生成可重汇编的汇编代码，对 64 位位置无关的 Linux 二进制进行静态改写，从而像在编译时一样插入插桩代码。它不依赖启发式规则，而是依据二进制自身的元数据进行符号化：控制流操作数、位置无关代码必须使用的 PC 相对寻址以及数据重定位均被转换为汇编标签，从而区分引用与标量。作者在此基础上实现了 AFL 覆盖率插桩和仅针对二进制的 AddressSanitizer。他们报告其模糊测试吞吐量与编译器插桩相当，比 AFL 的 QEMU 模式快 4.5 倍，并在 LAVA-M 上发现更多缺陷；在 SPEC CPU2006 上，二进制 ASan 比 Valgrind memcheck 快 3 倍，并在作者的评测中多检测出 80% 的缺陷，其检测覆盖率测试采用 Juliet 内存破坏用例。","authors":["Sushant Dinesh","Nathan Burow","Dongyan Xu","Mathias Payer"],"authors_omitted":null,"venue":"IEEE S&P 2020","doi":"10.1109/SP40000.2020.00009","arxiv_id":null,"year":2020,"publication_status":"conference-paper","targets":["binary"]},{"id":"paper-binrec","title":"BinRec: Dynamic Binary Lifting and Recompilation","title_zh":"BinRec：动态二进制提升与重编译","description_en":"BinRec lifts an executable to LLVM IR from dynamic traces instead of static disassembly, then lowers the IR back to a recovered binary, so compiler passes can optimize, harden or otherwise transform it. Tracing runs the binary under S²E, which translates the executed code through QEMU into LLVM IR; BinRec removes the emulation instrumentation, merges traces from several inputs into one program, and adds optimizations such as register de-aliasing and promotion of emulated state to locals. When the recovered binary reaches a path that was not traced, a configurable handler stops it, falls back to the original code, or lifts the new path incrementally. The authors report recovering all SPEC CINT2006 benchmarks, including C++ programs, and apply it to reoptimization, control-flow integrity, AddressSanitizer and SafeStack hardening, and partial deobfuscation of virtualization-obfuscated code.","description_zh":"BinRec 依据动态执行轨迹而非静态反汇编，将可执行文件提升为 LLVM 中间表示，再将其降级为恢复出的二进制，从而可用编译器优化遍对其进行优化、加固或其他变换。追踪阶段在 S²E 中运行二进制，由 S²E 经 QEMU 将执行到的代码翻译为 LLVM 中间表示；BinRec 去除仿真插桩，将多个输入的轨迹合并为一个程序，并加入寄存器去别名、将仿真状态提升为局部变量等优化。恢复出的二进制若进入未被追踪的路径，可配置的处理程序会停止执行、回退到原始代码，或增量提升新路径。作者报告恢复了全部 SPEC CINT2006 基准程序（包括 C++ 程序），并将其用于重新优化、控制流完整性、AddressSanitizer 与 SafeStack 加固，以及对虚拟化混淆代码的部分去混淆。","authors":["Anil Altinay","Joseph Nash","Taddeus Kroes","Prabhu Rajasekaran","Dixin Zhou","Adrian Dabrowski","David Gens","Yeoul Na","Stijn Volckaert","Cristiano Giuffrida","Herbert Bos","Michael Franz"],"authors_omitted":null,"venue":"EuroSys 2020","doi":"10.1145/3342195.3387550","arxiv_id":null,"year":2020,"publication_status":"conference-paper","targets":["binary"]},{"id":"paper-isadetect","title":"Towards usable automated detection of CPU architecture and endianness for arbitrary binary files and object code sequences","title_zh":"面向任意二进制文件和目标代码序列的实用化 CPU 架构与字节序自动检测","description_en":"The paper builds open datasets and tools to identify CPU architecture and endianness in binary files and object code. It evaluates classifiers on executable code sections, reporting over 98% accuracy.","description_zh":"论文构建开放数据集和工具，用于识别二进制文件及目标代码的 CPU 架构和字节序，并使用可执行文件的代码段评估分类器，报告准确率超过 98%。","authors":["Sami Kairajärvi","Andrei Costin","Timo Hämäläinen"],"authors_omitted":null,"venue":"Proceedings of the Tenth ACM Conference on Data and Application Security and Privacy","doi":"10.1145/3374664.3375742","arxiv_id":"1908.05459","year":2020,"publication_status":"conference-paper","targets":["binary"]},{"id":"paper-egalito","title":"Egalito: Layout-Agnostic Binary Recompilation","title_zh":"Egalito：与布局无关的二进制重编译","description_en":"Egalito statically recompiles stripped x86-64 and ARM64 binaries, using the metadata that position-independent executables and libraries carry to recover a complete disassembly in which every code and data cross-reference becomes an explicit link. Its layout-agnostic intermediate representation, EIR, stays close to machine code, so regenerated output is predictable, while a higher-level view supports analysis; data-flow analyses infer jump tables, which have no metadata. Because the original layout imposes no constraints, tools can move or rewrite code freely; the authors build nine, including continuous code randomization in which Egalito transforms itself, a retpoline defense, and software emulation of Intel CET. They report recovering the compiler's jump tables in 866 of 867 executables and libraries from 172 Debian packages, all tests passing in 90 of 149 transformed packages, and a 1.7% speedup on SPEC CPU 2006.","description_zh":"Egalito 对去除符号的 x86-64 与 ARM64 二进制进行静态重编译，借助位置无关的可执行文件和库所携带的元数据，恢复完整的反汇编，使每一处代码与数据交叉引用都成为显式链接。其与布局无关的中间表示 EIR 贴近机器码，因此重新生成的输出可预测，同时提供更高层的视图用于分析；对于没有元数据的跳转表，则借助数据流分析推断。由于不受原始布局约束，工具可以自由移动或改写代码；作者构建了九种工具，包括由 Egalito 变换自身的持续代码随机化、retpoline 防御以及 Intel CET 的软件模拟。作者报告，在来自 172 个 Debian 软件包的 867 个可执行文件与库中，有 866 个的跳转表与编译器给出的真实结果一致；变换后的 149 个软件包中有 90 个通过全部测试；在 SPEC CPU 2006 上性能提升 1.7%。","authors":["David Williams-King","Hidenori Kobayashi","Kent Williams-King","Graham Patterson","Frank Spano","Yu Jian Wu","Junfeng Yang","Vasileios P. Kemerlis"],"authors_omitted":null,"venue":"ASPLOS 2020","doi":"10.1145/3373376.3378470","arxiv_id":null,"year":2020,"publication_status":"conference-paper","targets":["binary"]},{"id":"paper-dire","title":"DIRE: A Neural Approach to Decompiled Identifier Naming","title_zh":"DIRE：基于神经网络的反编译标识符命名方法","description_en":"Combines lexical and structural information from decompiler output to predict meaningful variable names, with a training and evaluation corpus derived from compiled C projects.","description_zh":"结合反编译输出中的词法与结构信息预测有意义的变量名，并使用编译 C 项目构建训练和评估语料。","authors":["Jeremy Lacomis","Pengcheng Yin","Edward J. Schwartz","Miltiadis Allamanis","Claire Le Goues","Graham Neubig","Bogdan Vasilescu"],"authors_omitted":null,"venue":"ASE 2019","doi":"10.1109/ASE.2019.00064","arxiv_id":"1909.09029","year":2019,"publication_status":"conference-paper","targets":["binary"]},{"id":"paper-manticore","title":"Manticore: A User-Friendly Symbolic Execution Framework for Binaries and Smart Contracts","title_zh":"Manticore：面向二进制程序和智能合约的易用符号执行框架","description_en":"Manticore uses dynamic symbolic execution to analyze binaries and Ethereum smart contracts. The paper presents its architecture and demonstrates bug finding and code verification used for commercial clients.","description_zh":"Manticore 使用动态符号执行分析二进制程序和以太坊智能合约。论文介绍其架构，并展示曾用于商业客户项目的漏洞发现和代码正确性验证能力。","authors":["Mark Mossberg","Felipe Manzano","Eric Hennenfent","Alex Groce","Gustavo Grieco","Josselin Feist","Trent Brunson","Artem Dinaburg"],"authors_omitted":null,"venue":"arXiv","doi":null,"arxiv_id":"1907.03890","year":2019,"publication_status":"preprint","targets":["binary"]},{"id":"paper-internalblue","title":"InternalBlue - Bluetooth Binary Patching and Experimentation Framework","title_zh":"InternalBlue：蓝牙二进制补丁与实验框架","description_en":"The paper reverse engineers Broadcom Bluetooth controllers and presents InternalBlue for patching their firmware. It evaluates the framework through vulnerability tests, bug fixes, and added security features.","description_zh":"论文逆向分析博通蓝牙控制器，并提出用于修改其固件的 InternalBlue 框架。作者通过漏洞测试、漏洞修复和新增安全功能展示并评估该框架。","authors":["Dennis Mantz","Jiska Classen","Matthias Schulz","Matthias Hollick"],"authors_omitted":null,"venue":"Proceedings of the 17th Annual International Conference on Mobile Systems, Applications, and Services","doi":"10.1145/3307334.3326089","arxiv_id":"1905.00631","year":2019,"publication_status":"conference-paper","targets":["binary","firmware","protocol"]},{"id":"paper-neural-decompilation","title":"Towards Neural Decompilation","title_zh":"迈向神经网络反编译","description_en":"The paper trains a neural machine translation decompiler using a compiler. It evaluates translation from LLVM IR and x86 assembly to C, successfully decompiling over 97% and 88% of its respective benchmarks.","description_zh":"论文利用编译器训练基于神经机器翻译的反编译器，并评估将 LLVM IR 和 x86 汇编转换为 C 代码的效果；两组基准的成功率分别超过 97% 和 88%。","authors":["Omer Katz","Yuval Olshaker","Yoav Goldberg","Eran Yahav"],"authors_omitted":null,"venue":"arXiv","doi":null,"arxiv_id":"1905.08325","year":2019,"publication_status":"preprint","targets":["binary"]},{"id":"paper-icsref","title":"ICSREF: A Framework for Automated Reverse Engineering of Industrial Control Systems Binaries","title_zh":"ICSREF：工业控制系统二进制文件自动化逆向工程框架","description_en":"ICSREF automates reverse engineering of PLC binaries compiled with CODESYS. It was evaluated on collected and in-house PLC binaries and used to generate an attack against a chemical process testbed.","description_zh":"ICSREF 自动逆向分析由 CODESYS 编译的可编程逻辑控制器二进制文件。研究使用收集和自行开发的 PLC 二进制文件进行评估，并将其用于生成针对化工过程测试平台的攻击。","authors":["Anastasis Keliris","Michail Maniatakos"],"authors_omitted":null,"venue":"Proceedings 2019 Network and Distributed System Security Symposium","doi":"10.14722/ndss.2019.23271","arxiv_id":"1812.03478","year":2019,"publication_status":"conference-paper","targets":["binary"]},{"id":"paper-coda","title":"Coda: An End-to-End Neural Program Decompiler","title_zh":"Coda：端到端神经程序反编译器","description_en":"Coda decompiles the assembly of short functions into C in two phases. An instruction-type-aware N-ary Tree-LSTM encoder and an attention-fed AST decoder first generate a code sketch; an ensemble of neural error predictors then proposes token corrections, each kept only if recompiling the candidate does not increase its edit distance to the input assembly. On synthetic benchmarks the authors report 82% average program accuracy after correction, against 12% for a sequence-to-sequence baseline with attention.","description_zh":"Coda 分两个阶段将短函数的汇编反编译为 C。首先由区分指令类型的 N 叉 Tree-LSTM 编码器与带注意力输入的 AST 解码器生成代码草图；随后由多个神经错误预测器的集成提出词元修正，只有当候选代码重新编译后与输入汇编的编辑距离不增加时，才保留该修正。在合成基准上，作者报告修正后的平均程序准确率为 82%，而带注意力的序列到序列基线为 12%。","authors":["Cheng Fu","Huili Chen","Haolan Liu","Xinyun Chen","Yuandong Tian","Farinaz Koushanfar","Jishen Zhao"],"authors_omitted":null,"venue":"NeurIPS 2019","doi":null,"arxiv_id":"1906.12029","year":2019,"publication_status":"conference-paper","targets":["binary"]},{"id":"paper-cross-arch-instruction-embedding","title":"A Cross-Architecture Instruction Embedding Model for Natural Language Processing-Inspired Binary Code Analysis","title_zh":"用于受自然语言处理启发的二进制代码分析的跨架构指令嵌入模型","description_en":"The paper learns instruction embeddings that capture semantic relationships within and across architectures. It evaluates them on semantic basic-block comparison, outperforming a code-statistics approach.","description_zh":"论文学习指令嵌入，以捕捉架构内部及跨架构的指令语义关系，并将其用于基于语义的基本块比较；结果优于基于代码统计的方法。","authors":["Kimberly Redmond","Lannan Luo","Qiang Zeng"],"authors_omitted":null,"venue":"arXiv","doi":null,"arxiv_id":"1812.09652","year":2018,"publication_status":"preprint","targets":["binary"]},{"id":"paper-debin","title":"Debin: Predicting Debug Information in Stripped Binaries","title_zh":"Debin：预测去符号二进制中的调试信息","description_en":"Debin predicts debug information for stripped ELF binaries on x86, x64 and ARM. After lifting code to BAP-IR, an Extremely randomized Trees classifier decides which registers and memory offsets hold source-level variables. A conditional random field, solved with Nice2Predict, then jointly predicts names and types for variables and functions, and the result is written back as DWARF sections. On 300 held-out binaries per architecture, the authors report 68.8% precision and 68.3% recall for x64 names and types.","description_zh":"Debin 为 x86、x64 与 ARM 上去符号的 ELF 二进制预测调试信息。它先将代码提升为 BAP-IR，用极端随机树分类器判断哪些寄存器和内存偏移对应源码级变量；再借助 Nice2Predict 求解条件随机场，联合预测变量与函数的名称和类型，并将结果以 DWARF 节写回二进制。作者在每种架构 300 个留出二进制上报告，x64 名称与类型预测的精确率为 68.8%、召回率为 68.3%。","authors":["Jingxuan He","Pesho Ivanov","Petar Tsankov","Veselin Raychev","Martin Vechev"],"authors_omitted":null,"venue":"ACM CCS 2018","doi":"10.1145/3243734.3243866","arxiv_id":null,"year":2018,"publication_status":"conference-paper","targets":["binary"]},{"id":"paper-revng","title":"rev.ng: A Unified Binary Analysis Framework to Recover CFGs and Function Boundaries","title_zh":"rev.ng：用于恢复控制流图与函数边界的统一二进制分析框架","description_en":"rev.ng lifts binaries to LLVM IR through QEMU's tiny code generator, so one front end covers every architecture QEMU supports and the output is compilable IR. On that IR the authors build architecture-independent analyses that recover a program's control-flow graph and function boundaries without symbols or debugging information. A value-range analysis (OSRA) bounds indirect jump targets such as switch tables, and further analyses handle predicated instructions, noreturn functions, tail calls and context-dependent control flow. On coreutils built for MIPS, ARM and x86-64 with GCC and clang at -O2, -O3 and -Os, its function-boundary accuracy is close to IDA Pro and better than BAP/ByteWeight and angr.","description_zh":"rev.ng 借助 QEMU 的微型代码生成器（TCG）将二进制提升为 LLVM 中间表示，因此同一前端可覆盖 QEMU 支持的全部架构，输出的是可编译的中间表示。作者在此基础上构建与架构无关的分析，在没有符号或调试信息的情况下恢复程序的控制流图与函数边界。一种值域分析（OSRA）用于限定 switch 跳转表等间接跳转的目标，其他分析则处理谓词执行指令、noreturn 函数、尾调用以及依赖上下文的控制流。在为 MIPS、ARM 与 x86-64 构建、分别使用 GCC 与 clang 以 -O2、-O3 和 -Os 编译的 coreutils 上，其函数边界恢复的准确度接近 IDA Pro，并优于 BAP/ByteWeight 与 angr。","authors":["Alessandro Di Federico","Mathias Payer","Giovanni Agosta"],"authors_omitted":null,"venue":"CC 2017","doi":"10.1145/3033019.3033028","arxiv_id":null,"year":2017,"publication_status":"conference-paper","targets":["binary"]},{"id":"paper-ramblr","title":"Ramblr: Making Reassembly Great Again","title_zh":"Ramblr：让二进制重汇编重新可行","description_en":"Ramblr produces reassembleable disassembly: assembly recovered from a stripped binary that can be edited and assembled again with an off-the-shelf assembler. Starting from angr's CFG recovery, it classifies the contents of data regions, then decides which immediates and data values are references to code or data that must become symbols. Base-pointer reattribution handles compiler-optimized references that point outside their target object, and sanity checks let Ramblr refuse to reassemble a binary it cannot handle safely, such as one that encrypts pointers. The authors evaluate 106 GNU Coreutils programs for x86 and x86-64 and 143 DARPA Cyber Grand Challenge binaries at six optimization levels. They report that Uroboros broke 22.64% of 32-bit Coreutils binaries at -O0 and 56.61% at -O1, while Ramblr broke none, and that Ramblr reassembled over 98% of CGC binaries at every level.","description_zh":"Ramblr 生成可重汇编的反汇编结果，即从去除符号的二进制中恢复出、可以修改并用现成汇编器重新汇编的汇编代码。它以 angr 的控制流图恢复为基础，对数据区内容进行分类，再判断哪些立即数和数据值是对代码或数据的引用、必须转换为符号。基址指针重归属用于处理经编译器优化后指向目标对象之外的引用；健全性检查则使 Ramblr 能够拒绝重汇编无法安全处理的二进制，例如对指针进行加密的程序。作者在为 x86 与 x86-64 编译的 106 个 GNU Coreutils 程序，以及 143 个 DARPA 网络超级挑战赛（CGC）二进制上，按六种优化级别进行评测。他们报告，Uroboros 会破坏 22.64% 的 -O0 及 56.61% 的 -O1 32 位 Coreutils 二进制，而 Ramblr 一个也未破坏；在 CGC 二进制上，Ramblr 在每种优化级别下的重汇编成功率均超过 98%。","authors":["Ruoyu Wang","Yan Shoshitaishvili","Antonio Bianchi","Aravind Machiry","John Grosen","Paul Grosen","Christopher Kruegel","Giovanni Vigna"],"authors_omitted":null,"venue":"NDSS 2017","doi":"10.14722/ndss.2017.23225","arxiv_id":null,"year":2017,"publication_status":"conference-paper","targets":["binary"]},{"id":"paper-dream","title":"No More Gotos: Decompilation Using Pattern-Independent Control-Flow Structuring and Semantics-Preserving Transformations","title_zh":"告别 goto：基于模式无关控制流结构化与语义保持变换的反编译","description_en":"DREAM is a decompiler whose control-flow structuring recovers loops, conditionals and switch statements from a recovered control-flow graph without matching predefined region patterns. For acyclic regions it computes each node's reaching condition, then refines the resulting conditions into if-then-else and switch constructs; cyclic regions are structured as loops whose type and continuation condition are inferred. Semantics-preserving transformations first rewrite cyclic regions with multiple entries or successors into single-entry, single-successor regions, and a Boolean variable keeps a repeated test equivalent when its operands may change. On GNU coreutils the authors report no goto statements, against thousands from Hex-Rays and Phoenix, and more compact code than Hex-Rays for 72.7% of functions and than Phoenix for 98.8% in one-to-one comparisons.","description_zh":"DREAM 是一种反编译器，其控制流结构化方法无需匹配预定义的区域模式，即可从恢复出的控制流图中还原循环、条件语句与 switch 语句。对于无环区域，它计算每个节点的可达条件，再将这些条件细化为 if-then-else 与 switch 结构；有环区域被结构化为循环，并推断循环类型及继续条件。语义保持变换先将具有多个入口或多个后继的有环区域改写为单入口、单后继区域；当重复测试的条件中变量可能被修改时，引入布尔变量以保持语义等价。作者在 GNU coreutils 上报告其输出不含 goto 语句，而 Hex-Rays 与 Phoenix 各产生数千个；在一对一比较中，DREAM 有 72.7% 的函数比 Hex-Rays 更紧凑，与 Phoenix 相比该比例为 98.8%。","authors":["Khaled Yakdan","Sebastian Eschweiler","Elmar Gerhards-Padilla","Matthew Smith"],"authors_omitted":null,"venue":"NDSS 2015","doi":"10.14722/ndss.2015.23185","arxiv_id":null,"year":2015,"publication_status":"conference-paper","targets":["binary"]},{"id":"paper-prismacoder","title":"PrismaCoder: Pushing the Boundaries of Open Multimodal Code Intelligence through Decomposed Rubric Synthesis","title_zh":"PrismaCoder：通过分解式评分准则生成提升开放多模态代码能力","description_en":"Trains visual-code models using separate code and rendered-output rubrics for data filtering and reinforcement learning. Relevant evaluations include rebuilding webpages, charts and vector graphics from images.","description_zh":"以代码与渲染结果的独立评分准则筛选数据并训练视觉代码模型，相关评测包括根据图像重建网页、图表和矢量图。","authors":["Qiushi Sun","Jingyang Gong","Yang Liu","Qiaosheng Chen","Zhangyue Yin","Zixian Huang","Hanxu Hu","Jing Xiong","Fangzhi Xu","Haochen Tan","Haoli Bai","Lifeng Shang","Xiaoguang Li","Ben Kao","Qipeng Guo","Lingpeng Kong","Jiahui Gao"],"authors_omitted":null,"venue":"arXiv","doi":"10.48550/arxiv.2610.20538","arxiv_id":"2610.20538","year":2026,"publication_status":"preprint","targets":["website","app"]},{"id":"paper-visstatecoder","title":"State-Aware Generation of Deployable Websites from Visual Prototypes and Requirements","title_zh":"从视觉原型与需求生成可部署网站的状态感知方法","description_en":"VisStateCoder links visual prototype elements, project files, interaction requirements and render evidence in a project state graph, then uses those links to generate websites and limit subsequent repairs to selected files.","description_zh":"VisStateCoder 以项目状态图连接视觉原型元素、项目文件、交互需求与渲染证据，据此生成网站，并将后续修复限制在选定文件内。","authors":["Ruwei Pan","Junlei Shen","Linhao Wu","Zixiong Yang","Qisheng Zhang","Yifan Li","Tianyu Ma","Yakun Zhang","Lu Zhang","Hongyu Zhang"],"authors_omitted":null,"venue":"arXiv","doi":"10.48550/arxiv.2610.17861","arxiv_id":"2610.17861","year":2026,"publication_status":"preprint","targets":["website"]},{"id":"paper-taod2c-bench","title":"TaoD2C-Bench: Benchmarking MLLMs for Industrial UI Code Generation Beyond Visual Fidelity","title_zh":"TaoD2C-Bench：超越视觉相似度的工业界面代码生成评测","description_en":"TaoD2C-Bench reconstructs interfaces from design images, layer metadata and component-library documentation. It separates requirement inference from implementation, checking component choices and layout relations through source/runtime evidence alongside rendered appearance.","description_zh":"TaoD2C-Bench 根据设计图、图层元数据与组件库文档重建界面，将需求推断与代码实现分别评测，并结合源码、运行时结构及渲染结果检查组件选择与布局关系。","authors":["Chengwei Shi","Yunnong Chen","Tingting Zhou","Qiang Lu","Shiyu Yue","Xinyuan Hu","Jianfang Ru","Liuqing Chen"],"authors_omitted":null,"venue":"arXiv","doi":"10.48550/arXiv.2610.10374","arxiv_id":"2610.10374","year":2026,"publication_status":"preprint","targets":["website","app"]},{"id":"paper-vision2web","title":"Vision2Web: A Hierarchical Benchmark for Visual Website Development with Agent Verification","title_zh":"Vision2Web：采用智能体验证的分层视觉网站开发基准","description_en":"Benchmarks website development from visual prototypes and written requirements across 100 static-page, 66 interactive-frontend and 27 full-stack tasks, combining workflow-based functional checks with model-judged visual comparison.","description_zh":"基于视觉原型和文字需求评测网站开发，包含 100 项静态页面、66 项交互前端与 27 项全栈任务，将基于工作流的功能检查与模型进行的视觉比较结合。","authors":["Zehai He","Wenyi Hong","Zhen Yang","Ziyang Pan","Mingdao Liu","Xiaotao Gu","Jie Tang"],"authors_omitted":null,"venue":"ICML 2026","doi":null,"arxiv_id":"2603.26648","year":2026,"publication_status":"conference-paper","targets":["website"]},{"id":"paper-ichart2code","title":"IChart2Code: Benchmarking Multimodal Large Language Models for Interactive Chart Code Generation","title_zh":"IChart2Code：面向交互图表代码生成的多模态大语言模型评测","description_en":"Benchmarks reconstruction of interactive charts from a reference screenshot, local data and specified actions. Its TRAIL framework uses Developer and Inspector agents with browser interaction traces to diagnose errors and revise the HTML/JavaScript implementation.","description_zh":"评测根据参照截图、本地数据和指定动作重建交互图表。其 TRAIL 框架结合开发与检查智能体及浏览器交互轨迹，诊断错误并修订 HTML／JavaScript 实现。","authors":["Xu Zhang","Hongzhang Zheng","Zhili Huang","Yaoyi Wang","Ling Xu","Sheng Huang"],"authors_omitted":null,"venue":"arXiv","doi":"10.48550/arxiv.2609.32413","arxiv_id":"2609.32413","year":2026,"publication_status":"preprint","targets":["website"]},{"id":"paper-stage-supervised-js-deobfuscation","title":"Stage-Supervised Latent Reasoning for Single-Shot JavaScript Deobfuscation","title_zh":"阶段监督的潜空间推理：单次生成的 JavaScript 去混淆","description_en":"Uses intermediate Webcrack rewrites to supervise Coconut-style latent reasoning for JavaScript deobfuscation. Training exposes staged code transformations; inference receives obfuscated code and generates a cleaned program in one shot.","description_zh":"利用 Webcrack 的中间重写结果监督 Coconut 式潜空间推理，以完成 JavaScript 去混淆。训练阶段提供分步代码转换，推理阶段仅接收混淆代码并一次生成清理后的程序。","authors":["Rong Feng","Suman Saha"],"authors_omitted":null,"venue":"arXiv","doi":"10.48550/arxiv.2609.27058","arxiv_id":"2609.27058","year":2026,"publication_status":"preprint","targets":["website","app"]},{"id":"paper-programdistill","title":"ProgramDistill: From Interactive Web Apps to Verifiable Reference-Guided SWE Tasks","title_zh":"ProgramDistill：将交互式 Web 应用转化为可验证的参考驱动软件工程任务","description_en":"Evaluates recovery of web-app behavior from a live reference with hidden source. It provides 4,063 feature-restoration tasks across 26 applications and a separate 12-application reconstruction setting, scored by replaying dependent browser workflows.","description_zh":"评测智能体从源码不可见的运行参考中恢复 Web 应用行为的能力，提供覆盖 26 个应用的 4,063 项功能恢复任务，以及独立的 12 应用重建设置，通过重放具有依赖关系的浏览器工作流评分。","authors":["Jeonghye Kim","Minseon Kim","Young Jin Kim","Matheus Pereira","Marc-Alexandre Côté","Alessandro Sordoni","Xingdi Yuan","Zhengyan Shi"],"authors_omitted":null,"venue":"arXiv","doi":"10.48550/arXiv.2609.18805","arxiv_id":"2609.18805","year":2026,"publication_status":"preprint","targets":["website"]},{"id":"paper-webworld-browser-feedback","title":"WebWorld: The Browser as a World Model for Self-Improving Web Code","title_zh":"WebWorld：将浏览器作为自改进网页代码的世界模型","description_en":"Uses typed browser interaction contracts to check progress and preserve previously verified capabilities while improving generated web code. Only accepted transitions become training examples.","description_zh":"将网页改进目标编译成类型化浏览器交互契约，检查目标进展并保持已验证能力，只把通过验收的转移用于训练。","authors":[],"authors_omitted":true,"venue":"arXiv","doi":null,"arxiv_id":"2608.30530","year":2026,"publication_status":"preprint","targets":["website"]},{"id":"paper-webcompat","title":"Does It Render Everywhere? A Study of Cross-Environment Compatibility in MLLM-Generated Webpages","title_zh":"能否处处正确渲染？多模态模型生成网页的跨环境兼容性研究","description_en":"WebCompat evaluates screenshot-reconstructed webpages across browsers and devices. Its XCompat detector combines rendered DOM geometry, viewport metadata and screenshots to identify layout and element failures, independently of similarity to the original design.","description_zh":"WebCompat 评测由截图重建的网页在不同浏览器与设备中的表现。XCompat 结合渲染后 DOM 几何信息、视口元数据及截图检测布局与元素问题，并将跨环境一致性与原始设计的相似度区分开。","authors":["Ziyun Guo","Jingyu Xiao","Yuqiang Sun","Yintong Huo"],"authors_omitted":null,"venue":"arXiv","doi":"10.48550/arXiv.2608.12518","arxiv_id":"2608.12518","year":2026,"publication_status":"preprint","targets":["website"]},{"id":"paper-ui2app","title":"UI2App: Benchmarking Visual Interaction Inference in Executable Web Application Generation","title_zh":"UI2App：评测可执行 Web 应用生成中的视觉交互推断","description_en":"UI2App evaluates runnable React/TypeScript applications generated from 600 screenshots across 95 web applications. It separates build executability, visual fidelity and screenshot-implied interaction behavior, including cross-route state, using a reference interaction taxonomy and public evaluation pipeline.","description_zh":"UI2App 使用来自 95 个 Web 应用的 600 张截图，评测生成的可运行 React/TypeScript 应用。它通过参考交互分类体系和公开评测流水线，分别衡量构建可执行性、视觉保真度，以及包括跨路由状态在内的截图隐含交互行为。","authors":["Grace Man Chen","Litao Guo","Yifan Wu","Yiyu Chen","Yenchi Tseng","Sicheng Liu","Yuyu Luo","Ying-Cong Chen"],"authors_omitted":null,"venue":"arXiv","doi":"10.48550/arXiv.2607.06306","arxiv_id":"2607.06306","year":2026,"publication_status":"preprint","targets":["website"]},{"id":"paper-dashboard2code","title":"Dashboard2Code: Evaluating Multimodal Models on Reconstructing Interactive Dashboards","title_zh":"Dashboard2Code：评估多模态模型重建交互式仪表盘的能力","description_en":"Evaluates agents that actively explore a running dashboard and reconstruct its appearance and interaction logic. DashboardMimic provides 180 Plotly+Dash examples, with code-semantic analysis and dynamic interaction tests for the generated implementations.","description_zh":"评估智能体主动探索运行中的仪表盘后，重建其外观与交互逻辑的能力。DashboardMimic 提供 180 个 Plotly+Dash 示例，并以代码语义分析和动态交互测试评估生成的实现。","authors":["Tianhao Niu","Ziyu Han","Qiguang Chen","Shiqi Zhou","Baocai Shan","Hengjie Fang","Qingfu Zhu","Wanxiang Che"],"authors_omitted":null,"venue":"ACL 2026","doi":"10.18653/v1/2026.acl-long.1750","arxiv_id":"2607.04727","year":2026,"publication_status":"conference-paper","targets":["website"]},{"id":"paper-unicoder","title":"UniCoder: Unified Visual-to-Code Generation via Symbolic Rewards and Reference-Guided Code Optimization","title_zh":"UniCoder：利用符号奖励与参考代码引导优化的统一视觉到代码生成","description_en":"UniCoder trains a visual-to-code model for charts, SVGs and webpages. Its reinforcement-learning objective combines rendering checks, image similarity and code-derived visual attributes; low-reward training groups receive reference-code trajectories to improve exploration.","description_zh":"UniCoder 面向图表、SVG 与网页训练视觉到代码模型。强化学习目标结合渲染检查、图像相似度和代码中的视觉属性，并向低奖励训练组加入参考代码轨迹以改善探索。","authors":["Yaozhi Zheng","Yilei Jiang","Manyuan Zhang","Yuxuan Wan","Kaituo Feng","Tianshuo Peng","Bo Zhang","Xiangyu Yue"],"authors_omitted":null,"venue":"arXiv","doi":"10.48550/arXiv.2606.31732","arxiv_id":"2606.31732","year":2026,"publication_status":"preprint","targets":["website"]},{"id":"paper-cascade","title":"CASCADE: LLM-powered JavaScript Deobfuscator at Google","title_zh":"CASCADE：谷歌基于大语言模型的 JavaScript 反混淆器","description_en":"Uses Gemini to locate the prelude functions that Obfuscator.IO inserts for string obfuscation, then applies constant-propagation and inlining passes in the JSIR compiler IR to restore string literals and API names deterministically.","description_zh":"利用 Gemini 定位 Obfuscator.IO 为字符串混淆插入的前置（prelude）函数，再在 JSIR 编译器中间表示上执行常量传播与内联，以确定性方式还原字符串字面量和 API 名称。","authors":["Shan Jiang","Pranoy Kovuri","David Tao","Zhixun Tan"],"authors_omitted":null,"venue":"ICSE-SEIP 2026","doi":"10.1145/3786583.3786873","arxiv_id":"2507.17691","year":2026,"publication_status":"conference-paper","targets":["website"]},{"id":"paper-screencoder","title":"ScreenCoder: Advancing Visual-to-Code Generation for Front-End Automation via Modular Multimodal Agents","title_zh":"ScreenCoder：以模块化多模态智能体推进面向前端自动化的视觉到代码生成","description_en":"Splits screenshot-to-code generation among grounding, planning and generation agents that label UI regions, build a hierarchical layout tree and write HTML/CSS. The pipeline also produces the Screen-10K training pairs used for supervised and reinforcement fine-tuning, and the paper introduces the 1,000-page ScreenBench.","description_zh":"将截图到代码的生成分配给定位、规划和生成三个智能体，分别标注界面区域、构建层级布局树并编写 HTML/CSS。该流程还生成了用于监督微调和强化学习的 Screen-10K 训练数据；论文另提出包含 1,000 个网页的 ScreenBench。","authors":["Yilei Jiang","Yaozhi Zheng","Yuxuan Wan","Jiaming Han","Qunzhong Wang","Michael R. Lyu","Xiangyu Yue"],"authors_omitted":null,"venue":"EMNLP 2026","doi":null,"arxiv_id":"2507.22827","year":2026,"publication_status":"conference-accepted","targets":["website"]},{"id":"paper-iwr-bench","title":"IWR-Bench: Can LVLMs reconstruct interactive webpage from a user interaction video?","title_zh":"IWR-Bench：大型视觉语言模型能否根据用户交互视频重建可交互网页？","description_en":"Tests reconstruction of interactive webpages from user-interaction videos and supplied static assets. Its 113 tasks replay annotated action sequences to assess visual fidelity and functional behavior across observed page states.","description_zh":"测试模型利用用户交互视频和提供的静态资源重建可交互网页的能力。其 113 项任务通过重放标注的操作序列，评估已观察页面状态的视觉保真度与功能行为。","authors":["Yang Chen","Minghao Liu","Yufan Shen","Yunwen Li","Tianyuan Huang","Xinyu Fang","Tianyu Zheng","Wenxuan Huang","Cheng Yang","Daocheng Fu","Jianbiao Mei","Rong Wu","Licheng Wen","Xuemeng Yang","Song Mao","Qunshu Lin","Zhi Yu","Yongliang Shen","Yu Qiao","Botian Shi"],"authors_omitted":null,"venue":"ICLR 2026","doi":null,"arxiv_id":"2509.24709","year":2026,"publication_status":"conference-paper","targets":["website"]},{"id":"paper-jsimplifier","title":"From Obfuscated to Obvious: A Comprehensive JavaScript Deobfuscation Tool for Security Analysis","title_zh":"从混淆到清晰：面向安全分析的综合性 JavaScript 反混淆工具","description_en":"JSimplifier recovers readable JavaScript from obfuscated scripts in three stages. A preprocessor normalizes malformed or mixed-encoding input; a deobfuscator combines AST-based static simplification with selective execution of obfuscated call sites in a Node.js vm context, feeding the results back into the AST; and an optional humanizer renames identifiers with an LLM, adapting HumanifyJS, then formats the output with Prettier. The authors catalog 20 obfuscation techniques in four categories and assemble MalJS (23,212 malicious scripts) and BenignJS (21,209 scripts). They report that JSimplifier processes all 44,421 samples and reduces Halstead length by 88.2% on 1,296 multi-technique JsDeObsBench samples.","description_zh":"JSimplifier 分三个阶段从混淆脚本中恢复可读的 JavaScript：预处理器规范化格式错误或混合编码的输入；反混淆器将基于 AST 的静态简化与在 Node.js vm 上下文中有选择地执行混淆调用点相结合，并把执行结果写回 AST；可选的人性化模块借鉴 HumanifyJS，利用大语言模型重命名标识符，再用 Prettier 格式化输出。作者将混淆技术归纳为四大类共 20 种，并构建了 MalJS（23,212 个恶意脚本）与 BenignJS（21,209 个脚本）数据集。作者报告 JSimplifier 能处理全部 44,421 个样本，并在 JsDeObsBench 中 1,296 个组合多种技术的样本上将 Halstead 长度降低 88.2%。","authors":["Dongchao Zhou","Lingyun Ying","Huajun Chai","Dongbin Wang"],"authors_omitted":null,"venue":"NDSS 2026","doi":"10.14722/ndss.2026.242198","arxiv_id":"2512.14070","year":2026,"publication_status":"conference-paper","targets":["website"]},{"id":"paper-jsdeobsbench","title":"JsDeObsBench: Measuring and Benchmarking LLMs for JavaScript Deobfuscation","title_zh":"JsDeObsBench：衡量与评测大语言模型的 JavaScript 反混淆能力","description_en":"Builds an execution-verifiable JavaScript deobfuscation benchmark by applying seven JavaScript-Obfuscator transformations to Project CodeNet programs with test cases, then scores LLM and tool outputs for syntax, execution, code simplification and similarity to the original code.","description_zh":"对附带测试用例的 Project CodeNet 程序施加 JavaScript-Obfuscator 的七种混淆变换，构建可通过执行验证的 JavaScript 反混淆基准，并从语法、执行结果、代码简化程度及与原始代码的相似度评估 LLM 和现有工具的输出。","authors":["Guoqiang Chen","Xin Jin","Zhiqiang Lin"],"authors_omitted":null,"venue":"ACM CCS 2025","doi":"10.1145/3719027.3744871","arxiv_id":"2506.20170","year":2025,"publication_status":"conference-paper","targets":["website"]},{"id":"paper-interaction2code","title":"Interaction2Code: Benchmarking MLLM-based Interactive Webpage Code Generation from Interactive Prototyping","title_zh":"Interaction2Code：从交互原型生成网页代码的多模态大语言模型评测基准","description_en":"Benchmarks reconstruction of interactive webpages from screenshots before and after an interaction. The final study covers 127 webpages and 374 interactions, comparing rendered appearance, automated interaction checks, and human usability judgments.","description_zh":"评测模型根据交互前后的截图重建可交互网页的能力。最终研究涵盖 127 个网页、374 项交互，并比较渲染外观、自动交互检查与人工可用性判断。","authors":["Jingyu Xiao","Yuxuan Wan","Yintong Huo","Zixin Wang","Xinyi Xu","Wenxuan Wang","Zhiyao Xu","Yuhang Wang","Michael R. Lyu"],"authors_omitted":null,"venue":"ASE 2025","doi":"10.1109/ASE63991.2025.00028","arxiv_id":"2411.03292","year":2025,"publication_status":"conference-paper","targets":["website"]},{"id":"paper-latcoder","title":"LaTCoder: Converting Webpage Design to Code with Layout-as-Thought","title_zh":"LaTCoder：以“布局即思维”将网页设计转换为代码","description_en":"LaTCoder converts webpage design images to HTML/CSS by making layout an explicit intermediate step. A rule-based divider recursively finds solid-colored horizontal or vertical lines that avoid OCR-detected text, then merges small regions into grid-aligned blocks. An MLLM writes code for each block with a chain-of-thought prompt. The blocks are then assembled by absolute positioning or by the MLLM, and a reference-free verifier combining MAE and CLIP picks the better result. The paper also introduces CC-HARD, 128 complex-layout pages manually sampled from Common Crawl.","description_zh":"LaTCoder 将布局作为显式的中间步骤，把网页设计图转换为 HTML/CSS。基于规则的分割器递归寻找不穿过 OCR 识别文本的纯色水平或垂直线，再将过小区域合并为网格对齐的图块。多模态大语言模型使用思维链提示为每个图块编写代码；随后以绝对定位或由模型组装各图块，并由结合 MAE 与 CLIP、无需参考答案的验证器选出较优结果。论文还提出 CC-HARD，包含从 Common Crawl 人工抽取的 128 个复杂布局网页。","authors":["Yi Gui","Zhen Li","Zhongyi Zhang","Guohao Wang","Tianpeng Lv","Gaoyang Jiang","Yi Liu","Dongping Chen","Yao Wan","Hongyu Zhang","Wenbin Jiang","Xuanhua Shi","Hai Jin"],"authors_omitted":null,"venue":"KDD 2025","doi":"10.1145/3711896.3737016","arxiv_id":"2508.03560","year":2025,"publication_status":"conference-paper","targets":["website"]},{"id":"paper-webuibench","title":"WebUIBench: A Comprehensive Benchmark for Evaluating Multimodal Large Language Models in WebUI-to-Code","title_zh":"WebUIBench：评估多模态大语言模型从网页界面生成代码能力的综合基准","description_en":"Diagnoses webpage-to-code capability through visual perception, HTML programming, image-to-HTML understanding, and screenshot reconstruction tasks. It separates underlying skills using question-answer pairs derived from real websites.","description_zh":"通过视觉感知、HTML 编程、图像与 HTML 对应理解，以及截图重建任务，诊断从网页界面生成代码的能力；利用来自真实网站的问答对，分别考察各项基础技能。","authors":["Zhiyu Lin","Zhengda Zhou","Zhiyuan Zhao","Tianrui Wan","Yilun Ma","Junyu Gao","Xuelong Li"],"authors_omitted":null,"venue":"Findings of ACL 2025","doi":"10.18653/v1/2025.findings-acl.815","arxiv_id":"2506.07818","year":2025,"publication_status":"conference-paper","targets":["website"]},{"id":"paper-waffle","title":"WAFFLE: Fine-tuning Multi-Modal Model for Automated Front-End Development","title_zh":"WAFFLE：面向自动化前端开发的多模态模型微调","description_en":"WAFFLE fine-tunes multimodal LLMs to generate HTML/CSS from UI screenshots. A quarter of the decoder's attention heads use a structure-aware mask that limits each element's tokens to its parent, preceding siblings and its own earlier tokens. A contrastive objective aligns image and code embeddings over groups of four mutated WebSight-v0.1 pages. With VLM-WebSight and Moondream2 backbones, the authors report up to 9.00 pp higher HTML-Match and 0.0982 higher CW-SSIM than standard fine-tuning on WebSight-Test, plus gains on every Design2Code metric.","description_zh":"WAFFLE 微调多模态大语言模型，使其根据界面截图生成 HTML/CSS。解码器中四分之一的注意力头使用结构感知掩码，使每个元素的词元只关注其父元素、前序兄弟元素及自身此前的词元。对比学习目标以四个经变异的 WebSight-v0.1 页面为一组，对齐图像与代码嵌入。以 VLM-WebSight 和 Moondream2 为骨干模型时，作者报告在 WebSight-Test 上比标准微调最多高 9.00 个百分点的 HTML-Match 和 0.0982 的 CW-SSIM，在 Design2Code 的各项指标上也均有提升。","authors":["Shanchao Liang","Nan Jiang","Shangshu Qian","Lin Tan"],"authors_omitted":null,"venue":"ACL 2025","doi":"10.18653/v1/2025.acl-long.1208","arxiv_id":"2410.18362","year":2025,"publication_status":"conference-paper","targets":["website"]},{"id":"paper-dcgen","title":"Divide-and-Conquer: Generating UI Code from Screenshots","title_zh":"分而治之：从截图生成界面代码","description_en":"Recursively divides a webpage screenshot along visual separation lines, has a multimodal model generate HTML/CSS for each leaf segment, and assembles child code upward into the full page; evaluated with GPT-4o, Gemini and Claude models and a small developer study.","description_zh":"沿视觉分隔线递归切分网页截图，由多模态模型为每个叶子片段生成 HTML/CSS，再将子片段代码逐级向上组装为完整页面；评估涵盖 GPT-4o、Gemini 与 Claude 系列模型以及一项小规模开发者研究。","authors":["Yuxuan Wan","Chaozheng Wang","Yi Dong","Wenxuan Wang","Shuqing Li","Yintong Huo","Michael Lyu"],"authors_omitted":null,"venue":"Proceedings of the ACM on Software Engineering (FSE 2025)","doi":"10.1145/3729364","arxiv_id":"2406.16386","year":2025,"publication_status":"journal-article","targets":["website"]},{"id":"paper-structeval","title":"StructEval: Benchmarking LLMs' Capabilities to Generate Structural Outputs","title_zh":"StructEval：评测大语言模型生成结构化输出的能力","description_en":"Evaluates generation and conversion of structured outputs, including HTML, React and SVG, with separate checks for format adherence and structural correctness.","description_zh":"评测结构化输出的生成与转换，包括 HTML、React 和 SVG，并分别检查格式遵循和结构正确性。","authors":[],"authors_omitted":true,"venue":"arXiv","doi":null,"arxiv_id":"2505.20139","year":2025,"publication_status":"preprint","targets":["website"]},{"id":"paper-webcode2m","title":"WebCode2M: A Real-World Dataset for Code Generation from Webpage Designs","title_zh":"WebCode2M：面向网页设计稿代码生成的真实世界数据集","description_en":"WebCode2M pairs about 2.56 million real-world webpage screenshots with purified HTML/CSS code and element bounding-box layout trees. Pages sampled from a Common Crawl snapshot are cleaned (scripts, metadata and hidden elements removed, styles merged into one block), rendered with Playwright, and filtered by a neural scorer trained on 10,000 annotated samples. The paper fine-tunes Pix2Struct-1.3B as the WebCoder baseline, introduces TreeBLEU to measure DOM-structure recall, and benchmarks specialized, open and commercial multimodal models on short, medium and long test subsets of 256 pages each.","description_zh":"WebCode2M 将约 256 万张真实网页截图与净化后的 HTML/CSS 代码及元素边界框布局树配对。数据取样自 Common Crawl 快照，经清洗（移除脚本、元数据与隐藏元素，并将样式合并为单一样式块）后用 Playwright 渲染，再由基于 10,000 条人工标注样本训练的神经评分器筛选。论文以 Pix2Struct-1.3B 微调出基线模型 WebCoder，提出衡量 DOM 结构召回率的 TreeBLEU 指标，并在短、中、长三个各含 256 个网页的测试子集上评测专用、开源及商业多模态模型。","authors":["Yi Gui","Zhen Li","Yao Wan","Yemin Shi","Hongyu Zhang","Bohua Chen","Yi Su","Dongping Chen","Siyuan Wu","Xing Zhou","Wenbin Jiang","Hai Jin","Xiangliang Zhang"],"authors_omitted":null,"venue":"WWW 2025","doi":"10.1145/3696410.3714889","arxiv_id":"2404.06369","year":2025,"publication_status":"conference-paper","targets":["website"]},{"id":"paper-sketch2code","title":"Sketch2Code: Evaluating Vision-Language Models for Interactive Web Design Prototyping","title_zh":"Sketch2Code：评估视觉语言模型的交互式网页设计原型生成能力","description_en":"Sketch2Code benchmarks vision-language models on turning rough hand-drawn wireframe sketches into HTML webpage prototypes. Crowd annotators drew 731 sketches of 484 real-world webpages from the Design2Code test set. Ten models, eight commercial and two 8B open-source, generate pages directly and in two multi-turn settings with a GPT-4o simulated user: following its feedback, or asking it clarification questions. Outputs are scored by Design2Code visual similarity and a new IoU-based layout similarity over component types such as text blocks, images, navigation bars, forms and buttons. Claude 3.5 Sonnet and GPT-4o lead single-turn layout similarity, and feedback rounds help commercial models more than question asking does.","description_zh":"Sketch2Code 评测视觉语言模型把粗略手绘线框草图转换为 HTML 网页原型的能力。众包标注者为来自 Design2Code 测试集的 484 个真实网页绘制了 731 张草图。十个模型（八个商业模型与两个 8B 开源模型）既直接生成页面，也在两种与 GPT-4o 模拟用户进行的多轮场景中工作：遵循其反馈，或向其提出澄清问题。输出依据 Design2Code 视觉相似度，以及基于文本块、图像、导航栏、表单与按钮等组件类型的新 IoU 布局相似度评分。Claude 3.5 Sonnet 与 GPT-4o 在单轮布局相似度上领先，而反馈轮次对商业模型的帮助大于提问方式。","authors":["Ryan Li","Yanzhe Zhang","Diyi Yang"],"authors_omitted":null,"venue":"NAACL 2025","doi":"10.18653/v1/2025.naacl-long.198","arxiv_id":"2410.16232","year":2025,"publication_status":"conference-paper","targets":["website"]},{"id":"paper-design2code","title":"Design2Code: Benchmarking Multimodal Code Generation for Automated Front-End Engineering","title_zh":"Design2Code：面向自动化前端工程的多模态代码生成评测","description_en":"Evaluates reconstruction of frontend code from webpage screenshots using real-world reference pages, visual-element and layout metrics, and human assessment.","description_zh":"使用真实网页参考、视觉元素和布局指标及人工评估，测试从网页截图重建前端代码的能力。","authors":["Chenglei Si","Yanzhe Zhang","Ryan Li","Zhengyuan Yang","Ruibo Liu","Diyi Yang"],"authors_omitted":null,"venue":"NAACL 2025","doi":"10.18653/v1/2025.naacl-long.199","arxiv_id":"2403.03163","year":2025,"publication_status":"conference-paper","targets":["website"]},{"id":"paper-llm-code-analysis","title":"Large Language Models for Code Analysis: Do LLMs Really Do Their Job?","title_zh":"面向代码分析的大语言模型：LLM 真的胜任吗？","description_en":"Evaluates GPT-3.5-turbo, GPT-4, LLaMA-2-13B, Code-LLaMA-2-13B-Instruct and StarChat-Beta on explaining what de-commented JavaScript, Python and C code does, then repeats the task on JavaScript obfuscated with JavaScript Obfuscator (identifier renaming, dead-code injection, control-flow flattening and string splitting) and with Wobfuscator’s WebAssembly transformation. GPT-3.5 and GPT-4 are also asked to rewrite 100 IOCCC winning programs as readable, compilable code. Case studies apply GPT models to a botnet and a benign browser-extension repository, an Android SMS stealer decompiled with JD-GUI, and WannaCry code decompiled with RetDec.","description_zh":"评估 GPT-3.5-turbo、GPT-4、LLaMA-2-13B、Code-LLaMA-2-13B-Instruct 与 StarChat-Beta 解释已去除注释的 JavaScript、Python 和 C 代码功能的能力，再在经 JavaScript Obfuscator（标识符重命名、死代码注入、控制流平坦化与字符串拆分）及 Wobfuscator WebAssembly 变换混淆的 JavaScript 上重复该任务。研究还要求 GPT-3.5 与 GPT-4 将 100 个 IOCCC 获奖程序改写为可读、可编译的代码。案例研究将 GPT 模型用于一个僵尸网络仓库与一个正常浏览器扩展仓库、经 JD-GUI 反编译的 Android 短信窃取程序，以及经 RetDec 反编译的 WannaCry 代码。","authors":["Chongzhou Fang","Ning Miao","Shaurya Srivastav","Jialin Liu","Ruoyu Zhang","Ruijie Fang","Asmita","Ryan Tsang","Najmeh Nazari","Han Wang","Houman Homayoun"],"authors_omitted":null,"venue":"USENIX Security 2024","doi":null,"arxiv_id":"2310.12357","year":2024,"publication_status":"conference-paper","targets":["website","app"]},{"id":"paper-websight","title":"Unlocking the conversion of Web Screenshots into HTML Code with the WebSight Dataset","title_zh":"借助 WebSight 数据集实现网页截图到 HTML 代码的转换","description_en":"WebSight is a synthetic dataset of 2 million HTML documents paired with full-page screenshots for training screenshot-to-HTML models. Mistral-7B-Instruct generates website concepts, Deepseek-Coder-33B-Instruct writes each page in HTML with Tailwind CSS, images come from keyword-based stock-photo URLs, and Playwright renders the screenshots after filtering. This v0.2 release replaces the 823K-pair v0.1, which used traditional CSS and colored rectangles instead of images. The authors fine-tune an 8B vision-language model, Sightseer, on the data with DoRA and show qualitative conversions, including one from a hand-drawn sketch.","description_zh":"WebSight 是一个合成数据集，含 200 万份与整页截图配对的 HTML 文档，用于训练截图到 HTML 的模型。Mistral-7B-Instruct 生成网站构思，Deepseek-Coder-33B-Instruct 以 HTML 加 Tailwind CSS 编写每个页面，图片来自基于关键词的图库链接，经过筛选后由 Playwright 渲染截图。该 v0.2 版本取代了含 82.3 万对样本的 v0.1，后者使用传统 CSS，并以彩色矩形代替图片。作者用 DoRA 在该数据上微调了 8B 视觉语言模型 Sightseer，并展示了定性转换示例，其中包括一个由手绘草图转换的例子。","authors":["Hugo Laurençon","Léo Tronchon","Victor Sanh"],"authors_omitted":null,"venue":"arXiv","doi":null,"arxiv_id":"2403.09029","year":2024,"publication_status":"preprint","targets":["website"]},{"id":"paper-web2code","title":"Web2Code: A Large-scale Webpage-to-Code Dataset and Evaluation Framework for Multimodal LLMs","title_zh":"Web2Code：面向多模态大语言模型的大规模网页转代码数据集与评估框架","description_en":"Studies screenshot-to-HTML reconstruction through instruction tuning and two evaluation benchmarks. Web2Code combines generated webpages, refined WebSight and pix2code image/code pairs, and WebSRC-derived question answering. Models produce HTML from a webpage image and instruction; rendered output is compared visually, while a separate benchmark measures screenshot understanding.","description_zh":"通过指令微调和两个评测基准研究从截图重建 HTML。Web2Code 结合生成网页、经改进的 WebSight 与 pix2code 图像／代码对，以及来自 WebSRC 的问答。模型根据网页图像与指令生成 HTML，渲染输出接受视觉比较，另一个基准则测量截图理解能力。","authors":["Sukmin Yun","Haokun Lin","Rusiru Thushara","Mohammad Qazim Bhat","Yongxin Wang","Zutao Jiang","Mingkai Deng","Jinhong Wang","Tianhua Tao","Junbo Li","Haonan Li","Preslav Nakov","Timothy Baldwin","Zhengzhong Liu","Eric P. Xing","Xiaodan Liang","Zhiqiang Shen"],"authors_omitted":null,"venue":"NeurIPS 2024 Datasets and Benchmarks","doi":"10.52202/079017-3560","arxiv_id":"2406.20098","year":2024,"publication_status":"conference-paper","targets":["website"]},{"id":"paper-clematis","title":"Understanding JavaScript Event-Based Interactions","title_zh":"理解 JavaScript 基于事件的交互","description_en":"Clematis helps developers understand a JavaScript web application's runtime behavior from a recorded user session. A proxy instruments JavaScript on the fly to log DOM events, timeouts, XMLHttpRequest phases, function calls and DOM mutations. The trace is grouped into episodes, each with its triggering event, executed functions and resulting DOM changes, linked by temporal and causal edges and shown in an interactive visualization. In an industrial study with 20 developers on the Phormer photo gallery, the authors report 61% higher task accuracy and 47% less completion time than developers using their preferred tools.","description_zh":"Clematis 根据录制的用户会话，帮助开发者理解 JavaScript 网页应用的运行时行为。代理在传输过程中对 JavaScript 进行插桩，记录 DOM 事件、定时器、XMLHttpRequest 各阶段、函数调用及 DOM 变更。轨迹被划分为若干情节，每个情节包含触发事件、执行的函数及由此产生的 DOM 变化，情节之间以时间与因果边连接，并以交互式可视化呈现。在 Phormer 相册应用上开展、有 20 名开发者参加的工业研究中，作者报告其任务准确率比使用各自惯用工具的开发者高 61%，完成时间少 47%。","authors":["Saba Alimadadi","Sheldon Sequeira","Ali Mesbah","Karthik Pattabiraman"],"authors_omitted":null,"venue":"ICSE 2014","doi":"10.1145/2568225.2568268","arxiv_id":null,"year":2014,"publication_status":"conference-paper","targets":["website"]},{"id":"paper-crawljax","title":"Crawling Ajax-Based Web Applications through Dynamic Analysis of User Interface State Changes","title_zh":"通过动态分析用户界面状态变化爬取基于 Ajax 的 Web 应用","description_en":"Crawljax infers a state-flow graph of an Ajax web application by driving it in a real browser. It scans the DOM for candidate clickable elements, fires events on them, compares the resulting DOM against known states with configurable comparison and similarity thresholds, and records new states and the event transitions between them, backtracking by reloading and replaying paths. A concurrent variant partitions the crawl across browser instances. The Java tool uses Selenium WebDriver and plugins; one plugin writes a static mirror of the crawled states. The authors evaluate six open-source and industrial sites and measure how the number of concurrent browsers affects crawling runtime on Google AdSense.","description_zh":"Crawljax 在真实浏览器中驱动 Ajax Web 应用，以推断其状态流图。它扫描 DOM 中候选的可点击元素并触发事件，再用可配置的比较方法与相似度阈值将得到的 DOM 与已知状态比对，记录新状态及状态间的事件转换，并通过重新加载与重放路径进行回溯。并发版本将爬取任务划分给多个浏览器实例。该 Java 工具基于 Selenium WebDriver 与插件机制，其中一个插件可为已爬取的状态生成静态镜像。作者评测了六个开源与工业网站，并在 Google AdSense 上测量并发浏览器数量对爬取耗时的影响。","authors":["Ali Mesbah","Arie van Deursen","Stefan Lenselink"],"authors_omitted":null,"venue":"ACM Transactions on the Web","doi":"10.1145/2109205.2109208","arxiv_id":null,"year":2012,"publication_status":"journal-article","targets":["website"]},{"id":"paper-schema-program-induction","title":"Schema: Discovering Unknown Environments via Agentic Program Induction","title_zh":"Schema：通过智能体程序归纳发现未知环境机制","description_en":"Infers executable models of game state and transition rules from interaction. Agents revise these models against recorded history, search within them, and compare predicted observations with real outcomes while executing plans.","description_zh":"通过交互推断可执行的游戏状态与转移规则模型。智能体依据已记录的历史修订模型，在模型中搜索方案，并在执行计划时将预测观察与真实结果比较。","authors":["Guanning Zeng","Jiani Wang","Wenjie Ma","Shaofeng Yin","Chenyang Wang","Shichen Liu","Angjoo Kanazawa","Wode Ni","Xiuyu Li","Andrea Zanette","Haiwen Feng"],"authors_omitted":null,"venue":"arXiv","doi":"10.48550/arxiv.2609.39140","arxiv_id":"2609.39140","year":2026,"publication_status":"preprint","targets":["game"]},{"id":"paper-swe-game","title":"SWE-Game: Can Coding Agents Build the Games We Want?","title_zh":"SWE-Game：编程智能体能否构建符合预期的游戏？","description_en":"Evaluates construction, completion, repair and Godot-to-Unity porting against executable reference games. Evaluator-owned probes and input replays check gameplay behavior, while visual rubrics assess presentation separately.","description_zh":"以可执行参考游戏评估构建、补全、修复及 Godot 到 Unity 的移植；由评测方控制的探针与输入回放检查玩法行为，视觉评分准则另行评价表现。","authors":["Xiaoyu Chen","Lai Wei","Jin Wang","Xiangyu Zou","Ruochen Fan","Enze Luo","Mingzhe Yao","Jiahui Zhu","Yuhua Wen","Linghe Kong","Weiran Huang"],"authors_omitted":null,"venue":"arXiv","doi":"10.48550/arxiv.2609.33678","arxiv_id":"2609.33678","year":2026,"publication_status":"preprint","targets":["game"]},{"id":"paper-gamereplica","title":"GameReplica: A Benchmark for Black-Box Visual Game Replication by Vision-Language Agents","title_zh":"GameReplica：视觉语言智能体的黑盒视觉游戏复刻基准","description_en":"Evaluates whether vision-language agents can infer hidden game rules through screenshots and active interaction, then build runnable single-file HTML replicas across 125 tasks from 25 web games, each with five difficulty levels.","description_zh":"通过来自 25 款网页游戏、各设五个难度级别的 125 个任务，评估视觉语言智能体能否通过截图和主动交互推断隐藏规则，并构建可运行的单文件 HTML 游戏复刻。","authors":["Boyu Qiao","Zixin Tang","Xiaoshuai Hao","Wenbo Li"],"authors_omitted":null,"venue":"arXiv","doi":"10.48550/arXiv.2609.22308","arxiv_id":"2609.22308","year":2026,"publication_status":"preprint","targets":["game","website"]},{"id":"paper-tycho","title":"Tycho: Active Abstraction with Programmatic World Models for ARC-AGI-3","title_zh":"Tycho：面向 ARC-AGI-3 的程序化世界模型主动抽象","description_en":"Tycho constructs editable Python models of game state, transitions, rendering and outcomes from action/observation histories in unfamiliar ARC-AGI-3 games. It checks model predictions against recorded transitions and can use, repair or bypass these models during planning.","description_zh":"Tycho 根据陌生 ARC-AGI-3 游戏中的动作与观察历史，构建可编辑的 Python 模型，描述游戏状态、状态转移、渲染与结果。它将模型预测与已记录的转移进行核对，并在规划时选择使用、修复或绕过这些模型。","authors":["Jens Lehmann","Andrei Aioanei","Sahar Vahdati"],"authors_omitted":null,"venue":"arXiv","doi":"10.48550/arXiv.2607.28287","arxiv_id":"2607.28287","year":2026,"publication_status":"preprint","targets":["game"]},{"id":"paper-revengebench","title":"RevengeBench: Reverse Engineering Code-Space Policies from Behavioral Experiments","title_zh":"RevengeBench：通过行为实验逆向恢复代码形式的策略","description_en":"Tests whether agents can recover executable decision policies from behavioral traces and self-designed opponent probes, using 75 synthetic policies across five game arenas and measuring held-out action agreement and downstream competitive value.","description_zh":"使用五种游戏环境中的 75 个合成策略，测试智能体能否通过行为轨迹和自行设计的对手探测恢复可执行决策策略，并衡量留出状态上的动作一致性及后续对抗价值。","authors":["Babak Rahmani","Sebastian Dziadzio","Joschka Strüber","Sergio Hernández-Gutiérrez","Matthias Bethge"],"authors_omitted":null,"venue":"arXiv","doi":"10.48550/arXiv.2606.26094","arxiv_id":"2606.26094","year":2026,"publication_status":"preprint","targets":["game"]},{"id":"paper-sprite-game-ui","title":"SPRITE: From Static Mockups to Engine-Ready Game UI","title_zh":"SPRITE：从静态设计稿重建可用于游戏引擎的界面","description_en":"Transforms game-interface screenshots into editable engine assets through hierarchical YAML, visual grounding, asset extraction, and Unity UXML/USS synthesis, with evaluation on a curated game-UI benchmark and review by three senior UI/UX designers.","description_zh":"通过层级化 YAML、视觉定位、素材提取和 Unity UXML／USS 生成，将游戏界面截图转化为可编辑的引擎资源，并在精选游戏界面基准上评估，由三位资深 UI／UX 设计师进行审阅。","authors":["Yunshu Bai","RuiHao Li","Hao Zhang","Chien Her Lim","Ming Yan","Mengtian Li"],"authors_omitted":null,"venue":"CHI EA 2026 (poster/extended abstract)","doi":"10.1145/3772363.3798742","arxiv_id":"2604.18591","year":2026,"publication_status":"conference-paper","targets":["game"]},{"id":"paper-poe-world","title":"PoE-World: Compositional World Modeling with Products of Programmatic Experts","title_zh":"PoE-World：基于程序化专家乘积的组合式世界建模","description_en":"PoE-World represents an Atari world model as an exponentially weighted product of many small Python programs, or programmatic experts, each synthesized by an LLM to explain one aspect of the observed dynamics; learned weights and optional synthesized hard constraints combine them. From object lists that OCAtari parses out of a demonstration of fewer than 1,000 frames, the authors learn stochastic, partially observed models of Pong and Montezuma's Revenge and use them in a planning agent, including on rearranged Pong-Alt and Montezuma's Revenge-Alt variants that have no demonstrations.","description_zh":"PoE-World 将 Atari 世界模型表示为许多小型 Python 程序（即程序化专家）的指数加权乘积，每个专家由大语言模型合成，用于解释观测动态中的一个方面；学习得到的权重和可选的合成硬约束把它们组合起来。作者从 OCAtari 在不足 1,000 帧的演示中解析出的对象列表出发，学习 Pong 与 Montezuma's Revenge 的随机、部分可观测模型，并将其用于规划智能体，包括没有演示的重排变体 Pong-Alt 和 Montezuma's Revenge-Alt。","authors":["Wasu Top Piriyakulkij","Yichao Liang","Hao Tang","Adrian Weller","Marta Kryven","Kevin Ellis"],"authors_omitted":null,"venue":"NeurIPS 2025","doi":"10.52202/085713-0896","arxiv_id":"2505.10819","year":2025,"publication_status":"conference-paper","targets":["game"]},{"id":"paper-gamengen","title":"Diffusion Models Are Real-Time Game Engines","title_zh":"扩散模型即实时游戏引擎","description_en":"GameNGen learns to simulate DOOM interactively with a diffusion model instead of game code. A PPO agent first plays the game in ViZDoom, and its recorded trajectories, from random to trained play, become the training data. Stable Diffusion v1.4 is then fine-tuned to predict the next frame from the last 64 frames and actions, with noise added to context frames to keep long autoregressive rollouts stable and a fine-tuned latent decoder for detail. With 4 sampling steps it runs at 20 frames per second on one TPU-v5. The authors report next-frame PSNR of 29.43 and human raters picking the real game in 58–60% of short clips.","description_zh":"GameNGen 以扩散模型而非游戏代码交互式地模拟 DOOM。首先由 PPO 智能体在 ViZDoom 中游玩，记录下从随机策略到训练后期的轨迹作为训练数据。随后微调 Stable Diffusion v1.4，使其根据最近 64 帧画面与动作预测下一帧；训练时向上下文帧加入噪声，以保持长时间自回归生成的稳定，并微调潜空间解码器以改善细节。使用 4 步采样时，它在单个 TPU-v5 上以每秒 20 帧运行。作者报告下一帧预测 PSNR 为 29.43，人工评估者在短片段中辨认出真实游戏的比例为 58%–60%。","authors":["Dani Valevski","Yaniv Leviathan","Moab Arar","Shlomi Fruchter"],"authors_omitted":null,"venue":"ICLR 2025","doi":null,"arxiv_id":"2408.14837","year":2025,"publication_status":"conference-paper","targets":["game"]},{"id":"paper-worldcoder","title":"WorldCoder, a Model-Based LLM Agent: Building World Models by Writing Code and Interacting with the Environment","title_zh":"WorldCoder：通过编写代码并与环境交互构建世界模型的基于模型的语言智能体","description_en":"WorldCoder learns executable Python transition and reward models from environment interactions and natural-language goals. It refines code against recorded experiences and an optimistic planning constraint, studying transfer and task solving in Sokoban, MiniGrid and ALFWorld.","description_zh":"WorldCoder 根据环境交互和自然语言目标学习可执行的 Python 状态转移与奖励模型，利用已记录经验和乐观规划约束修正代码，并在 Sokoban、MiniGrid 与 ALFWorld 中研究迁移和任务求解。","authors":["Hao Tang","Darren Key","Kevin Ellis"],"authors_omitted":null,"venue":"NeurIPS 2024","doi":"10.52202/079017-2243","arxiv_id":"2402.12275","year":2024,"publication_status":"conference-paper","targets":["game"]},{"id":"paper-code-world-models","title":"Generating Code World Models with Large Language Models Guided by Monte Carlo Tree Search","title_zh":"通过蒙特卡洛树搜索引导大语言模型生成代码世界模型","description_en":"GIF-MCTS generates executable Python transition and reward models from natural-language environment descriptions and offline state-transition trajectories, using prediction feedback to generate, improve and repair code. CWMB evaluates 18 reinforcement-learning environments and downstream planning; a separate experiment uses a simplified Read to Fight Monsters grid world.","description_zh":"GIF-MCTS 根据环境的自然语言描述与离线状态转移轨迹生成可执行的 Python 状态转移和奖励模型，并利用预测反馈生成、改进和修复代码。CWMB 评估 18 个强化学习环境及后续规划；另一个实验使用简化的 Read to Fight Monsters 网格世界。","authors":["Nicola Dainese","Matteo Merler","Minttu Alakuijala","Pekka Marttinen"],"authors_omitted":null,"venue":"NeurIPS 2024","doi":"10.52202/079017-1933","arxiv_id":"2405.15383","year":2024,"publication_status":"conference-paper","targets":["game"]},{"id":"paper-autumnsynth","title":"Combining Functional and Automata Synthesis to Discover Causal Reactive Programs","title_zh":"结合函数合成与自动机合成以发现因果反应式程序","description_en":"AutumnSynth synthesizes a program in Autumn, a functional reactive language for Atari-style grid worlds, from a trace of observed frames and user actions such as clicks and arrow keys. Heuristic perception parses each frame into typed objects and tracking links them across time steps. The synthesizer then finds an update function for each observed change and searches for the event that triggers it. When no event over the observed state explains an update, automata synthesis invents latent state, such as counters or modes, using a SAT-based Sketch encoding or a faster heuristic. The authors introduce the 30-program Causal Inductive Synthesis Corpus (CISC), on which the heuristic variant synthesizes 27 programs. A slightly modified version synthesizes 21 of 27 games from the third-party EMPA grid-world corpus.","description_zh":"AutumnSynth 根据观察到的画面帧及用户动作（如点击和方向键）构成的轨迹，合成 Autumn 程序；Autumn 是面向 Atari 风格网格世界的函数式反应式语言。基于启发式的感知步骤将每帧解析为带类型的对象，跟踪步骤再将对象跨时间步关联起来。随后，合成器为每个观察到的变化寻找更新函数，并搜索触发该变化的事件。当基于可观察状态的事件都无法解释某次更新时，自动机合成会借助基于 SAT 的 Sketch 编码或更快的启发式方法，引入计数器、模式等潜在状态。作者提出了含 30 个程序的 Causal Inductive Synthesis Corpus（CISC），启发式版本在其中合成出 27 个程序；经少量修改的版本在第三方 EMPA 网格世界语料库的 27 个游戏中合成出 21 个。","authors":["Ria Das","Joshua B. Tenenbaum","Armando Solar-Lezama","Zenna Tavares"],"authors_omitted":null,"venue":"Proceedings of the ACM on Programming Languages (POPL 2023)","doi":"10.1145/3571249","arxiv_id":null,"year":2023,"publication_status":"journal-article","targets":["game"]},{"id":"paper-mappyland","title":"MappyLand: Fast, Accurate Mapping for Console Games","title_zh":"MappyLand：快速、准确的主机游戏地图构建","description_en":"MappyLand, a Rust rewrite of the earlier Mappy system, instruments the FCEUMM NES emulator core to map action/adventure games as they are played from controller inputs. It hooks accesses to the picture-processing unit's scrolling registers and reads emulator memory to register scrolling, separate the playfield from menus, detect and track sprites, build grid-based tile maps and recognize room transitions. An online merging step combines observed rooms into a consistent room graph across backtracking and multiple play sessions. In a 34,514-frame test the authors report about 1.5 ms of mapping overhead per frame, against about 0.2 ms for emulation alone.","description_zh":"MappyLand 是早期 Mappy 系统的 Rust 重写版，它对 FCEUMM NES 模拟器核心进行插桩，在依据手柄输入运行动作／冒险游戏的同时绘制地图。系统拦截对图像处理单元滚动寄存器的访问并读取模拟器内存，据此完成滚动配准、区分游戏区域与菜单、检测和跟踪精灵、构建网格化图块地图并识别房间切换。一个在线合并步骤再把观测到的房间整合为一致的房间图，可覆盖折返路线和多次游玩会话。作者在一次 34,514 帧的测试中报告，地图构建每帧约增加 1.5 毫秒开销，而单纯模拟约为每帧 0.2 毫秒。","authors":["Joseph C. Osborn","Adam Summerville","Nathan Dailey","Soksamnang Lim"],"authors_omitted":null,"venue":"AIIDE 2021","doi":"10.1609/aiide.v17i1.18892","arxiv_id":null,"year":2021,"publication_status":"conference-paper","targets":["game"]},{"id":"paper-gamegan","title":"Learning to Simulate Dynamic Environments with GameGAN","title_zh":"使用 GameGAN 学习模拟动态环境","description_en":"GameGAN learns an action-conditioned neural simulator of a game from recorded frames and the actions taken, without access to the game’s logic or engine. An action-conditioned LSTM dynamics engine with a stochastic latent variable predicts the next state, an optional external memory module builds an internal map so that revisited locations stay consistent, and a rendering engine decodes frames while separating static from dynamic components. Training is end-to-end with adversarial losses, including an action-conditioned discriminator, and a temporal cycle loss for memory consistency. The authors evaluate on a modified Pac-Man, a ghost-free Pac-Man-Maze and VizDoom “take cover”, training RL agents inside the learned simulators and testing them in the real games, and measure long-term consistency with a come-back-home task; a human-playable model of the official Pac-Man is shown qualitatively.","description_zh":"GameGAN 从录制的画面帧及对应动作中学习游戏的动作条件神经模拟器，无需访问游戏逻辑或引擎。带随机潜变量的动作条件 LSTM 动力学引擎预测下一状态；可选的外部记忆模块构建内部地图，使重新访问的位置保持一致；渲染引擎在解码画面时区分静态与动态成分。模型以端到端方式训练，采用包括动作条件判别器在内的对抗损失，并用时间循环损失保持记忆一致性。作者在修改版 Pac-Man、无幽灵的 Pac-Man-Maze 及 VizDoom “take cover” 上进行评测：在学得的模拟器中训练强化学习智能体并在真实游戏中测试，并用“返回原点”任务衡量长期一致性；论文还定性展示了可由人类游玩的官方 Pac-Man 模型。","authors":["Seung Wook Kim","Yuhao Zhou","Jonah Philion","Antonio Torralba","Sanja Fidler"],"authors_omitted":null,"venue":"CVPR 2020","doi":"10.1109/CVPR42600.2020.00131","arxiv_id":"2005.12126","year":2020,"publication_status":"conference-paper","targets":["game"]},{"id":"paper-nes-jump-mechanics","title":"Mechanics Automatically Recognized via Interactive Observation: Jumping","title_zh":"通过交互式观察自动识别游戏机制：跳跃","description_en":"Infers platform-game jump mechanics by running controlled experiments in a modified FCEUX NES emulator. A person first plays each game to a safe state; the system then repeatedly holds the jump button for 1 to 120 frames, waits 120 frames and resets, recording every sprite from the PPU sprite table. Sprites that usually touch one another are merged into characters and tracked. A hand-designed four-state jump automaton (ground, rising with and without the button, falling) is then fitted with linear support vector regression, giving per-state velocity and gravity parameters plus minimum and maximum button-hold durations. Across 48 games (about 30% of NES platformers) and 52 characters, the authors cluster the learned jumps into three styles.","description_zh":"该研究在修改后的 FCEUX NES 模拟器中开展受控实验，推断平台游戏的跳跃机制。先由人工将每款游戏玩到安全状态；系统随后反复按住跳跃键 1 至 120 帧、等待 120 帧并复位，同时从 PPU 精灵表记录所有精灵。经常相互接触的精灵被合并为角色并加以跟踪。随后以线性支持向量回归拟合人工设计的四状态跳跃自动机（地面、按键上升、松键上升、下落），得到各状态的速度与重力参数，以及按键持续时间的最小值和最大值。在 48 款游戏（约占 NES 平台游戏的 30%）、52 个角色上，作者将学得的跳跃聚类为三种风格。","authors":["Adam Summerville","Joseph C. Osborn","Christoffer Holmgård","Daniel W. Zhang"],"authors_omitted":null,"venue":"FDG 2017","doi":"10.1145/3102071.3102104","arxiv_id":"1707.03865","year":2017,"publication_status":"conference-paper","targets":["game"]},{"id":"paper-game-engine-learning","title":"Game Engine Learning from Video","title_zh":"从视频中学习游戏引擎","description_en":"Learns a rule-based forward simulator of a 2D game from gameplay video. Using a supplied sprite palette, OpenCV locates sprites in each frame; matched sprites are converted into hand-designed fact types for animation, position, relative distance, x and y velocity and camera offset. Game Engine Search then scans the frames, and whenever the current engine’s predicted next frame differs from the real one by more than a threshold, it runs a greedy search over engines that add or modify condition–effect rules or mark them as player-controlled. Engines are ranked by pixel error and rule count. Trained on one Super Mario Bros. Level 1-1 video, the learned engine predicts frames of a different player’s video more accurately than a CNN frame predictor and a previous-frame baseline, and a value-iteration agent planning with it shows no significant difference from one using the Infinite Mario engine’s native forward simulation.","description_zh":"从游戏录像中学习二维游戏的基于规则的前向模拟器。系统借助提供的精灵图集，用 OpenCV 定位每帧中的精灵；匹配后的精灵被转换为人工设计的事实类型，包括动画、位置、相对距离、x 与 y 方向速度及镜头偏移。随后 Game Engine Search 逐帧扫描，每当当前引擎预测的下一帧与真实帧的差异超过阈值时，便对引擎进行贪心搜索：新增或修改“条件—效果”规则，或将规则标记为玩家控制。引擎按像素误差与规则数量排序。在一段《超级马力欧兄弟》1-1 关卡视频上训练后，所学引擎预测另一位玩家视频帧的准确度高于 CNN 帧预测器与沿用上一帧的基线，基于它进行规划的价值迭代智能体，其表现与使用 Infinite Mario 引擎原生前向模拟的智能体无显著差异。","authors":["Matthew Guzdial","Boyang Li","Mark O. Riedl"],"authors_omitted":null,"venue":"IJCAI 2017","doi":"10.24963/ijcai.2017/518","arxiv_id":null,"year":2017,"publication_status":"conference-paper","targets":["game"]},{"id":"paper-revivebench","title":"From Dead Code and Static Requirements to Working Engines: Software Revival with Coding Agents","title_zh":"从失效代码与静态需求到可运行引擎：利用编程智能体恢复软件","description_en":"ReviveBench evaluates repair of nonrunning software and source-unavailable implementation of bounded computational and transactional engines from open specifications, using hidden reference-based checks. It also audits grading defects that can wrongly accept or reject reconstructions.","description_zh":"ReviveBench 利用隐藏的参考检查，评估无法运行的软件修复，以及依据公开规范、在无法访问目标源码时实现限定范围的计算与事务引擎；同时审计可能误收或误拒重建结果的评分缺陷。","authors":["Tianyu Liu","Dingyuan Dai","Yufan Du","Zhen Yang"],"authors_omitted":null,"venue":"arXiv","doi":"10.48550/arxiv.2609.36161","arxiv_id":"2609.36161","year":2026,"publication_status":"preprint","targets":["app"]},{"id":"paper-agentic-business-rule-recovery","title":"From Code to Requirements: Agentic Reverse Engineering of Business Rules at Enterprise Scale","title_zh":"从代码到需求：企业规模的智能体业务规则逆向恢复","description_en":"Uses seven agents and human review to recover business requirements from source, tests, configuration and documentation. A reported enterprise migration checks extracted rules against production-defect records.","description_zh":"利用七个智能体与人工审查，从源码、测试、配置及文档恢复业务需求；企业迁移案例以生产缺陷记录核对提取的规则。","authors":["Garima Agrawal","Prasun Das","Priyanka L","Minisha N","Akshay Sarvade","Hemath Manivanan","Sravani Joshna","Prasad Kalyansundaram"],"authors_omitted":null,"venue":"arXiv","doi":"10.48550/arxiv.2609.22719","arxiv_id":"2609.22719","year":2026,"publication_status":"preprint","targets":["app"]},{"id":"paper-requirements-generation-viability","title":"On the Viability of Requirements Generation from Code: An Experience Report","title_zh":"从代码生成需求是否可行：一份经验报告","description_en":"Studies a RAG-based, human-supervised pipeline for recovering requirements and code traces from two projects. It also tests deliberate generation of unimplemented requirements and requirements smells (potential quality issues), exposing verification and labeling difficulties.","description_zh":"研究以 RAG 和人工监督从两个项目恢复需求与代码追踪关系的流程，并测试刻意生成未实现需求及需求异味（潜在质量问题），揭示验证与标注的困难。","authors":["Alexander Korn","Jone Bartel","Max Unterbusch","Andreas Vogelsang"],"authors_omitted":null,"venue":"IEEE REW 2026 / AIRE","doi":"10.1109/rew72749.2026.00023","arxiv_id":"2606.25550","year":2026,"publication_status":"conference-paper","targets":["app"]},{"id":"paper-widgetgen","title":"From Visual Widgets to UI Code: Efficient Tool-Grounded Generation","title_zh":"从视觉组件到界面代码：借助工具证据的高效生成","description_en":"WidgetGen reconstructs widget screenshots as React JSX. OCR text boxes and color palettes guide whole-widget layout reasoning and optional chart generation before one terminal render; generated render/code pairs also support model fine-tuning.","description_zh":"WidgetGen 将组件截图重建为 React JSX，利用 OCR 文本框与调色板支持整体布局推理及可选图表生成，最后渲染一次；生成的渲染图与代码配对还用于模型微调。","authors":["Houston H. Zhang","Tao Zhang","Li Gu","Linfeng Ye","Yuanhao Yu","Xinxin Zuo","Yang Wang","Zhixiang Chi"],"authors_omitted":null,"venue":"MUCG @ ECCV 2026","doi":"10.48550/arXiv.2608.12611","arxiv_id":"2608.12611","year":2026,"publication_status":"conference-accepted","targets":["app","website"]},{"id":"paper-dio-agent","title":"Agentic Reverse Engineering: From I/O to Code with Discovery Agent","title_zh":"智能体逆向工程：利用发现智能体从输入输出行为恢复代码","description_en":"Synthesizes executable programs from input/output observations using LLM-guided evolutionary search, progressively revealed examples, simple-to-complex mutations and execution-error feedback. An active variant chooses inputs and queries a hidden reference program.","description_zh":"通过 LLM 引导的演化搜索、逐步展示的样例、由简到繁的修改及执行错误反馈，从输入输出观察合成可执行程序；主动变体自行选择输入并查询隐藏的参考程序。","authors":["Yihong Dong","Jiaru Qian","Haoran Zhang","Peixu Wang","Binhua Li","Zhi Jin","Yongbin Li","Ge Li","Xiaokang Yang","Xue Jiang"],"authors_omitted":null,"venue":"NeurIPS 2026","doi":"10.48550/arxiv.2605.15334","arxiv_id":"2605.15334","year":2026,"publication_status":"conference-accepted","targets":["app"]},{"id":"paper-uiorchestra","title":"UIOrchestra: Generating High-Fidelity Code from UI Designs with a Multi-agent System","title_zh":"UIOrchestra：通过多智能体系统将 UI 设计转换为高保真代码","description_en":"UIOrchestra converts static mobile UI designs into React/CSS through layout-description, code-generation and rendered-image comparison agents. Its APPUI benchmark contains 1,101 human-refined code/rendering pairs based on screenshots from 165 apps across 12 categories. The reference code is reconstructed for evaluation, rather than recovered original application source.","description_zh":"UIOrchestra 通过布局描述、代码生成及渲染图像比较三个智能体，将静态移动 UI 设计转换为 React/CSS。其 APPUI 基准包含 1,101 组经人工修订的代码与渲染图像，依据 12 类中的 165 款应用截图构建。参考代码为评测而重建，并非恢复出的原始应用源码。","authors":["Chuhuai Yue","Jiajun Chai","Yufei Zhang","Zixiang Ding","Xihao Liang","Peixin Wang","Shihai Chen","Wang Yixuan","Yanping Wang","Guojun Yin","Wei Lin"],"authors_omitted":null,"venue":"Findings of EMNLP 2025","doi":"10.18653/v1/2025.findings-emnlp.150","arxiv_id":null,"year":2025,"publication_status":"conference-paper","targets":["app","website"]},{"id":"paper-declarui","title":"DeclarUI: Bridging Design and Development with Automated Declarative UI Code Generation","title_zh":"DeclarUI：以自动生成声明式界面代码连接设计与开发","description_en":"Combines visual component extraction, multimodal models, page-transition graphs and iterative checks to reconstruct multi-page mobile UI code from designs or screenshots, evaluated with React Native, Flutter and ArkUI.","description_zh":"结合视觉组件提取、多模态模型、页面跳转图与迭代检查，从设计稿或截图重建多页面移动界面代码，并在 React Native、Flutter 和 ArkUI 上评测。","authors":["Ting Zhou","Yanjie Zhao","Xinyi Hou","Xiaoyu Sun","Kai Chen","Haoyu Wang"],"authors_omitted":null,"venue":"Proceedings of the ACM on Software Engineering (FSE 2025)","doi":"10.1145/3715726","arxiv_id":"2409.11667","year":2025,"publication_status":"journal-article","targets":["app"]},{"id":"paper-cama","title":"On Benchmarking Code LLMs for Android Malware Analysis","title_zh":"面向 Android 恶意软件分析的代码大语言模型基准评测","description_en":"CAMA is a framework for benchmarking how code LLMs read decompiled Android malware. Androguard decompiles each APK into Java functions, and each model returns a structured output per function: a summary, a refined function name and a 0–10 maliciousness score. Two analysis tasks build on these outputs. Malicious-function identification is scored by consistency (whether scores and names stay stable when the model is re-prompted with its own summaries) and by fidelity (how much a LightGBM malware-category classifier loses confidence when the top-scored function descriptors are removed). Malware-purpose summarization is scored by semantic relevance (BLEU, METEOR and ROUGE-L against reference app descriptions). The benchmark holds 118 APKs from 6 categories and 13 families, with 7,542,799 decompiled functions. Of the four models evaluated, StarChat-Beta has the highest maliciousness consistency (0.813, against 0.381 for CodeLlama) and narrowly the highest semantic-relevance scores, while fidelity varies widely across models and removal sizes. Renaming functions with model-suggested names raises fidelity for CodeLlama and StarChat but lowers METEOR by about 10%.","description_zh":"CAMA 是一个评测代码大语言模型理解反编译 Android 恶意软件能力的基准框架。它使用 Androguard 将每个 APK 反编译为 Java 函数，并要求模型为每个函数输出结构化结果：功能摘要、改进后的函数名以及 0–10 分的恶意程度评分。两项分析任务以这些输出为基础。恶意函数识别以一致性（模型依据自身摘要再次作答时评分与命名是否稳定）和保真度（移除评分最高的函数描述后，LightGBM 恶意软件类别分类器的置信度下降多少）衡量；恶意软件用途摘要则以语义相关性（与参考应用描述之间的 BLEU、METEOR 和 ROUGE-L）衡量。基准包含来自 6 个类别、13 个家族的 118 个 APK，共 7,542,799 个反编译函数。在四个受测模型中，StarChat-Beta 的恶意程度一致性最高（0.813，CodeLlama 为 0.381），语义相关性得分也以微弱优势居首；保真度则随模型和移除数量大幅波动。用模型建议的名称重命名函数会提高 CodeLlama 和 StarChat 的保真度，但会使 METEOR 下降约 10%。","authors":["Yiling He","Hongyu She","Xingzhi Qian","Xinran Zheng","Zhuo Chen","Zhan Qin","Lorenzo Cavallaro"],"authors_omitted":null,"venue":"ISSTA Companion 2025 (LLMSC Workshop)","doi":"10.1145/3713081.3731745","arxiv_id":"2504.00694","year":2025,"publication_status":"conference-paper","targets":["app"]},{"id":"paper-redraw","title":"Machine Learning-Based Prototyping of Graphical User Interfaces for Mobile Apps","title_zh":"基于机器学习的移动应用图形用户界面原型生成","description_en":"ReDraw turns screenshots or design mock-ups into native Android GUI prototypes by detecting components, classifying widget types with a CNN, and assembling a plausible view hierarchy with a data-driven nearest-neighbor method.","description_zh":"ReDraw 通过组件检测、CNN 控件类型分类及数据驱动的近邻层级组装，将截图或设计稿转换为原生 Android 图形界面原型。","authors":["Kevin Moran","Carlos Bernal-Cárdenas","Michael Curcio","Richard Bonett","Denys Poshyvanyk"],"authors_omitted":null,"venue":"IEEE Transactions on Software Engineering","doi":"10.1109/TSE.2018.2844788","arxiv_id":"1802.02312","year":2020,"publication_status":"journal-article","targets":["app"]},{"id":"paper-pix2code","title":"pix2code: Generating Code from a Graphical User Interface Screenshot","title_zh":"pix2code：从图形用户界面截图生成代码","description_en":"Learns screenshot-to-DSL generation for native Android XML, iOS Storyboards and web HTML/CSS interfaces, then compiles the DSL into platform UI code.","description_zh":"学习从界面截图生成领域专用语言（DSL），再编译为原生 Android XML、iOS Storyboard 或网页 HTML/CSS 界面代码。","authors":["Tony Beltramelli"],"authors_omitted":null,"venue":"EICS 2018","doi":"10.1145/3220134.3220135","arxiv_id":"1705.07962","year":2018,"publication_status":"conference-paper","targets":["app","website"]},{"id":"paper-ui2code","title":"From UI Design Image to GUI Skeleton: A Neural Machine Translator to Bootstrap Mobile GUI Implementation","title_zh":"从 UI 设计图到 GUI 骨架：辅助启动移动界面实现的神经机器翻译器","description_en":"UI2code translates a mobile UI image into an Android component hierarchy and layout skeleton using a neural encoder-decoder. The paper evaluates structural prediction and a small developer study of implementing layouts from generated skeletons.","description_zh":"UI2code 使用神经编码器—解码器，将移动 UI 图像转换为 Android 组件层级与布局骨架。论文评估了结构预测，并通过小规模开发者实验研究如何基于生成的骨架实现布局。","authors":["Chunyang Chen","Ting Su","Guozhu Meng","Zhenchang Xing","Yang Liu"],"authors_omitted":null,"venue":"ICSE 2018","doi":"10.1145/3180155.3180240","arxiv_id":null,"year":2018,"publication_status":"conference-paper","targets":["app"]},{"id":"paper-rico","title":"Rico: A Mobile App Dataset for Building Data-Driven Design Applications","title_zh":"Rico：用于构建数据驱动设计应用的移动应用数据集","description_en":"Rico is a dataset of Android app designs and a runtime mining system that needs no access to or modification of app source code. Crowd workers used free Google Play apps through a web interface to a device farm, recording interaction traces. An automated crawler then replayed each trace and kept exploring, using a screenshot-and-resource-id similarity heuristic to identify new UI states. The paper reports 10,811 traces and 72,219 unique UIs from 9,772 apps in 27 categories. Each UI has a screenshot, augmented view hierarchy, explored interactions, transition animations and a 64-dimensional autoencoder layout vector.","description_zh":"Rico 是一个 Android 应用设计数据集，也是一套无需获取或修改应用源码的运行时挖掘系统。众包人员通过网页界面使用设备农场中的免费 Google Play 应用，并记录交互轨迹。自动爬虫随后重放每条轨迹并继续探索，借助基于截图与 resource-id 的相似度启发式识别新的界面状态。论文报告共获得来自 27 个类别、9,772 个应用的 10,811 条轨迹和 72,219 个唯一界面。每个界面附有截图、增强的视图层级、已探索的交互、转场动画，以及由自编码器得到的 64 维布局向量。","authors":["Biplab Deka","Zifeng Huang","Chad Franzen","Joshua Hibschman","Daniel Afergan","Yang Li","Jeffrey Nichols","Ranjitha Kumar"],"authors_omitted":null,"venue":"UIST 2017","doi":"10.1145/3126594.3126651","arxiv_id":null,"year":2017,"publication_status":"conference-paper","targets":["app"]},{"id":"paper-deguard","title":"Statistical Deobfuscation of Android Applications","title_zh":"Android 应用的统计式反混淆","description_en":"DeGuard reverses layout obfuscation in Android APKs, predicting original names for the fields, methods, classes and packages that ProGuard renames. Built on Soot, it represents an app as a dependency graph over program elements and keeps Android API and other unobfuscated names fixed. It then runs MAP inference with Nice2Predict on a conditional random field learned from 1,684 F-Droid apps, under constraints that keep the renamed APK semantically equivalent. On 100 held-out F-Droid apps obfuscated with ProGuard, names identical to the originals rise from 13.3% to 79.1%, and third-party library prediction reaches 91.3% precision and 91.0% recall.","description_zh":"DeGuard 逆转 Android APK 中的布局混淆，为被 ProGuard 重命名的字段、方法、类和包预测原始名称。它基于 Soot 将应用表示为程序元素之间的依赖图，并保持 Android API 及其他未混淆名称不变；随后在从 1,684 个 F-Droid 应用学习的条件随机场上借助 Nice2Predict 进行 MAP 推断，并以约束保证重命名后的 APK 语义等价。在 100 个留出的、经 ProGuard 混淆的 F-Droid 应用上，与原始名称完全相同的比例从 13.3% 提升至 79.1%，第三方库预测的精确率为 91.3%、召回率为 91.0%。","authors":["Benjamin Bichsel","Veselin Raychev","Petar Tsankov","Martin Vechev"],"authors_omitted":null,"venue":"ACM CCS 2016","doi":"10.1145/2976749.2978422","arxiv_id":null,"year":2016,"publication_status":"conference-paper","targets":["app"]},{"id":"paper-remaui","title":"Reverse Engineering Mobile Application User Interfaces with REMAUI (T)","title_zh":"使用 REMAUI 逆向重建移动应用用户界面","description_en":"Reconstructs native Android UI code from screenshots or design bitmaps using OCR, computer vision, and layout heuristics; evaluates visual similarity and view hierarchies on 488 screenshots from over 100 Android and iOS applications.","description_zh":"利用 OCR、计算机视觉和布局启发式规则，从截图或设计位图重建原生 Android 界面代码，并使用来自 100 多款 Android 与 iOS 应用的 488 张截图评估视觉相似性和视图层级。","authors":["Tuan Anh Nguyen","Christoph Csallner"],"authors_omitted":null,"venue":"ASE 2015","doi":"10.1109/ASE.2015.32","arxiv_id":null,"year":2015,"publication_status":"conference-paper","targets":["app"]},{"id":"paper-swifthand","title":"Guided GUI Testing of Android Apps with Minimal Restart and Approximate Learning","title_zh":"以最少重启与近似学习引导的 Android 应用图形界面测试","description_en":"SwiftHand generates test inputs for Android apps while learning an approximate GUI model during testing. It instruments Dalvik bytecode to read the GUI component tree and derive each screen's enabled touch, scroll, text, Back and Menu inputs; screens with the same enabled inputs are treated as equivalent states of an extended deterministic labeled transition system. The learned model steers execution toward unexplored frontier states and avoids restarts, since reinstalling an app took about 30 seconds. On 10 F-Droid apps, the authors report higher branch coverage than random and L*-based testing within the time budget, reached faster.","description_zh":"SwiftHand 在为 Android 应用生成测试输入的同时，于测试过程中学习近似的图形界面模型。它对 Dalvik 字节码插桩，读取界面组件树，并推导每个屏幕可用的触摸、滚动、文本、返回键和菜单键输入；可用输入相同的屏幕被视为扩展确定性标记迁移系统中的等价状态。学习得到的模型引导执行进入尚未探索的前沿状态，并尽量避免重启，因为重新安装一次应用约需 30 秒。在 10 个 F-Droid 应用上，作者报告其在给定时间预算内的分支覆盖率高于随机测试和基于 L* 的测试，且达到覆盖率的速度更快。","authors":["Wontae Choi","George Necula","Koushik Sen"],"authors_omitted":null,"venue":"OOPSLA 2013","doi":"10.1145/2509136.2509552","arxiv_id":null,"year":2013,"publication_status":"conference-paper","targets":["app"]},{"id":"paper-gui-ripping","title":"GUI ripping: reverse engineering of graphical user interfaces for testing","title_zh":"GUI 抓取：面向测试的图形用户界面逆向工程","description_en":"GUI ripping reverse engineers a test model from a running desktop application rather than from its source code or specifications. Starting from the top-level windows, a ripper opens each child window by programmatically clicking executable widgets, records every window’s widgets, properties and values, and builds a GUI forest of windows. From that forest it derives event-flow graphs, which record which events can follow one another within a component, and an integration tree of component invocations. The paper describes rippers for Microsoft Windows applications, using window handles and the Windows API, and for Java Swing applications, using Java’s AWT and Swing APIs. It applies them to WordPad, Notepad, Yahoo Messenger and four applications of the TerpOffice student office suite, with the models feeding automated test generation in the authors’ GUITAR and DART systems.","description_zh":"GUI 抓取从运行中的桌面应用程序逆向工程出测试模型，而不依赖其源码或规格说明。抓取器从顶层窗口开始，以编程方式点击可执行控件逐一打开子窗口，记录每个窗口的控件、属性与取值，并构建由窗口组成的 GUI 森林。它再从森林推导出事件流图（记录组件内哪些事件可以相继发生）以及表示组件调用关系的集成树。论文介绍了两种抓取器：面向 Microsoft Windows 应用、基于窗口句柄与 Windows API 的实现，以及面向 Java Swing 应用、基于 Java AWT 与 Swing API 的实现。作者将其应用于 WordPad、Notepad、Yahoo Messenger 及学生开发的 TerpOffice 办公套件中的四个应用，所得模型用于作者 GUITAR 与 DART 系统中的自动化测试生成。","authors":["Atif Memon","Ishan Banerjee","Adithya Nagarajan"],"authors_omitted":null,"venue":"WCRE 2003","doi":"10.1109/WCRE.2003.1287256","arxiv_id":null,"year":2003,"publication_status":"conference-paper","targets":["app"]},{"id":"paper-cortexm-emulation-sok","title":"SoK: A Large-Scale Empirical Study of Emulation-Based Dynamic Analysis Research for ARM Cortex-M Firmware (Extended Version)","title_zh":"ARM Cortex-M 固件仿真动态分析研究的大规模实证综述（扩展版）","description_en":"Organizes 24 MCU analysis tools into configuration recovery, emulation, fuzzing and diagnosis stages, then evaluates the runnable, pipeline-compatible subset on 4,571 filtered Cortex-M firmware images. Studies where recovered configurations and emulation artifacts fail to support later analysis.","description_zh":"将 24 项 MCU 分析工具组织为配置恢复、仿真、模糊测试及诊断阶段，并在 4,571 个筛选后的 Cortex-M 固件镜像上评估可运行且兼容流程的子集，研究恢复的配置和仿真产物为何无法支撑后续分析。","authors":["Hongyuan Li","Ke Wang","Wei Zhou","Le Guan"],"authors_omitted":null,"venue":"arXiv (extended version)","doi":null,"arxiv_id":"2609.38872","year":2026,"publication_status":"preprint","targets":["firmware","binary"]},{"id":"paper-pozzer","title":"POZZER: A Power Side Channel-guided Fuzzer for Black-Box Embedded Systems","title_zh":"POZZER：面向黑盒嵌入式系统的功耗侧信道引导模糊测试器","description_en":"Builds a noise-tolerant pseudo execution-flow graph from one power trace per test input, using newly observed behavior as LibAFL feedback. It explores embedded firmware without access to its binary, source or instrumentation.","description_zh":"根据每个测试输入的一条功耗轨迹构建可容忍噪声的近似执行流图，将新观察到的行为用作 LibAFL 反馈；无需取得固件二进制、源码或插桩即可探索嵌入式固件。","authors":["Pouya Narimani","Kseniia Rogova","Addison Crump","Martin Mohl","Meng Wang","Ulysse Planta","Pansilu Pitigalaarachchi","Ali Abbasi"],"authors_omitted":null,"venue":"arXiv","doi":null,"arxiv_id":"2609.23583","year":2026,"publication_status":"preprint","targets":["firmware","binary"]},{"id":"paper-bluezz-rpm","title":"Reactive Peripheral Modeling for Faithful Firmware Rehosting","title_zh":"面向忠实固件运行迁移的响应式外设建模","description_en":"Bluezz models peripherals as stateful event-condition-action systems, coordinating interrupts, MMIO and DMA rather than treating accesses independently. It uses these models to rehost BLE firmware and reach connected protocol states for analysis and fuzzing.","description_zh":"Bluezz 将外设建模为具有状态的事件—条件—动作系统，协调中断、MMIO 与 DMA，而非孤立处理各次访问；据此迁移 BLE 固件，进入已连接协议状态进行分析与模糊测试。","authors":["Qinying Wang","Florian Hofhammer","Eduard Vlad","Jianqiang Wang","Marcel Busch","Shouling Ji","Mathias Payer"],"authors_omitted":null,"venue":"arXiv","doi":null,"arxiv_id":"2608.29737","year":2026,"publication_status":"preprint","targets":["firmware","protocol"]},{"id":"paper-khost","title":"Khost: KVM-based Near Native MCU Firmware Rehosting","title_zh":"Khost：基于 KVM 的近原生 MCU 固件重托管","description_en":"Extends KVM with MCU instruction handling, memory mapping and interrupt modeling to rehost firmware on ARMv8-A hosts. An MMIO monitor and firmware wrapper support peripheral interaction and coverage-guided testing.","description_zh":"扩展 KVM 的 MCU 指令处理、内存映射及中断建模，在 ARMv8-A 主机上重托管固件；MMIO 监控器与固件包装层支持外设交互及覆盖率引导测试。","authors":["Chunlin Wang","Yicheng Yang","Yuan Zhang","Haoyu Xiao","Yifan Zhang","Jiarun Dai"],"authors_omitted":null,"venue":"USENIX Security '26","doi":null,"arxiv_id":null,"year":2026,"publication_status":"conference-paper","targets":["firmware","binary"]},{"id":"paper-firmpilot","title":"FirmPilot: Evidence-Guided Multi-Agent Environment Recovery for IoT Firmware Rehosting","title_zh":"FirmPilot：证据引导的多智能体物联网固件运行环境恢复","description_en":"FirmPilot reconstructs QEMU execution environments through coordinated retrieval, planning, filesystem, persistent-state and network recovery. Proposed changes are applied as constrained artifact deltas, then checked by rerunning the firmware and fixed probes.","description_zh":"FirmPilot 协调检索、规划、文件系统、持久状态与网络恢复来重建 QEMU 执行环境。候选修改被落实为受约束的产物差异，再通过重新运行固件与固定探测检查。","authors":["Yanbing Shen","Fan Zhang","Haitao Xu"],"authors_omitted":null,"venue":"arXiv","doi":null,"arxiv_id":"2607.14903","year":2026,"publication_status":"preprint","targets":["firmware","binary"]},{"id":"paper-firmcure","title":"FirmCure:Towards Autonomous and Adaptive Rehosting of Linux-Based Firmware","title_zh":"FirmCure：面向自主、自适应的 Linux 固件运行环境迁移","description_en":"FirmCure combines static dependency analysis, iterative boot-configuration repair and runtime fault diagnosis to rehost Linux firmware in QEMU. Specialized agents apply targeted repairs and use execution feedback to recover service behavior.","description_zh":"FirmCure 将静态依赖分析、启动配置迭代修复与运行时故障诊断结合起来，在 QEMU 中迁移 Linux 固件。专门的智能体执行针对性修复，并利用执行反馈恢复服务行为。","authors":["Chuan Hong","Zheng Zhang","Lei Zhou","Laisong Li","Chenyifan Liu","Ze Huang","Xu Zhou","Peihong Lin"],"authors_omitted":null,"venue":"arXiv","doi":null,"arxiv_id":"2606.24549","year":2026,"publication_status":"preprint","targets":["firmware","binary"]},{"id":"paper-satbleed","title":"SatBleed: Security of Commoditized Communication Modules in Satellites","title_zh":"SatBleed：卫星商用通信模块的安全性","description_en":"Studies satellite communication modules through hardware inspection, firmware reverse engineering, protocol analysis, partial rehosting and targeted testing. A component-level threat model connects recovered data flows to security boundaries.","description_zh":"通过硬件检查、固件逆向、协议分析、部分重托管及针对性测试研究卫星通信模块，以组件级威胁模型将恢复的数据流与安全边界联系起来。","authors":["Ulysse Planta","Julian Rederlechner","Martin Strohmeier","Mathias Fischer","Ali Abbasi"],"authors_omitted":null,"venue":"IEEE S&P 2026","doi":"10.1109/SP63933.2026.00213","arxiv_id":"2610.06258","year":2026,"publication_status":"conference-paper","targets":["firmware","protocol","binary"]},{"id":"paper-firmwell","title":"User-Space Dependency-Aware Rehosting for Linux-Based Firmware Binaries","title_zh":"面向 Linux 固件二进制的用户空间依赖感知重托管","description_en":"FIRMWELL reconstructs the execution environment of Linux firmware services by running their initialization processes, locating blocking dependencies and repairing missing system-level behavior. It combines containerized QEMU-user emulation with a QEMU-system fallback, using process traces and binary analysis to recover resources needed by the target service.","description_zh":"FIRMWELL 通过运行初始化进程、定位阻塞依赖并修补缺失的系统层行为，重建 Linux 固件服务的执行环境。它结合容器化 QEMU-user 仿真与 QEMU-system 回退，并利用进程轨迹和二进制分析恢复目标服务所需的资源。","authors":["Chuan Qin","Cen Zhang","Yaowen Zheng","Puzhuo Liu","Jian Zhang","Yeting Li","Weidong Zhang","Yang Liu","Limin Sun"],"authors_omitted":null,"venue":"NDSS 2026","doi":"10.14722/ndss.2026.230249","arxiv_id":null,"year":2026,"publication_status":"conference-paper","targets":["firmware"]},{"id":"paper-penguin","title":"Target-Centric Firmware Rehosting with Penguin","title_zh":"使用 Penguin 进行以目标为中心的固件重托管","description_en":"Penguin rehosts embedded Linux firmware from an extracted filesystem by deriving an editable configuration of emulation transformations, such as file changes, pseudofiles, NVRAM values and network interfaces, from static analysis. Dynamic-analysis plugins expose failures so the configuration can be refined for each target, and a minimizer identifies which transformations a working rehosting needs.","description_zh":"Penguin 以提取出的固件文件系统为输入，通过静态分析生成可编辑的仿真变换配置（如文件修改、伪文件、NVRAM 值和网络接口），用于重托管嵌入式 Linux 固件。动态分析插件揭示运行失败，便于针对具体目标完善配置；配置最小化工具则找出可用的重托管所必需的变换。","authors":["Andrew Fasano","Zachary Estrada","Luke Craig","Ben Levy","Jordan McLeod","Jacques Becker","Caden Kline","Elysia Witham","Cole DiLorenzo","Ali Bobi","Dinko Dermendzhiev","Tim Leek","Wil Robertson"],"authors_omitted":null,"venue":"Workshop on Binary Analysis Research (BAR) 2025","doi":"10.14722/bar.2025.23010","arxiv_id":null,"year":2025,"publication_status":"conference-paper","targets":["firmware"]},{"id":"paper-semu","title":"What Your Firmware Tells You Is Not How You Should Emulate It: A Specification-Guided Approach for Firmware Emulation","title_zh":"固件所示并非应有的仿真方式：一种规范引导的固件仿真方法","description_en":"SEmu builds microcontroller peripheral models from vendor reference manuals rather than from the firmware itself. An NLP pipeline built on the Stanford tagger and parser turns register descriptions, interrupt tables and DMA channel tables taken from the manuals into structured condition-action rules, which the emulator checks, executes and chains at run time to answer MMIO accesses and raise interrupts or DMA requests. A symbolic-execution diagnostic tool built on S2E and µEmu traces invalid states back to the rules likely responsible, so that a person can correct them. The authors also use the models for fuzzing and to check driver code against specification rules.","description_zh":"SEmu 依据厂商参考手册而非固件本身构建微控制器外设模型。一条基于 Stanford 词性标注器和句法分析器的 NLP 流程，把取自手册的寄存器说明、中断表和 DMA 通道表转换为结构化的条件—动作规则；仿真器在运行时检查、执行并串联这些规则，以响应 MMIO 访问并触发中断或 DMA 请求。基于 S2E 和 µEmu 的符号执行诊断工具会把无效状态回溯到可能出错的规则，供人工修正。作者还将这些模型用于模糊测试，以及依据规范规则检查驱动代码。","authors":["Wei Zhou","Lan Zhang","Le Guan","Peng Liu","Yuqing Zhang"],"authors_omitted":null,"venue":"ACM CCS 2022","doi":"10.1145/3548606.3559386","arxiv_id":"2208.07833","year":2022,"publication_status":"conference-paper","targets":["firmware"]},{"id":"paper-fuzzware","title":"Fuzzware: Using Precise MMIO Modeling for Effective Firmware Fuzzing","title_zh":"Fuzzware：利用精确的 MMIO 建模提升固件模糊测试效果","description_en":"Rehosts monolithic ARM Cortex-M firmware for fuzzing, using locally scoped symbolic execution to model memory-mapped I/O accesses and focus input mutations on values relevant to firmware logic.","description_zh":"重托管单体 ARM Cortex-M 固件以开展模糊测试，利用局部符号执行为内存映射 I/O 访问建模，使输入变异集中于影响固件逻辑的值。","authors":["Tobias Scharnowski","Nils Bars","Moritz Schloegel","Eric Gustafson","Marius Muench","Giovanni Vigna","Christopher Kruegel","Thorsten Holz","Ali Abbasi"],"authors_omitted":null,"venue":"USENIX Security 2022","doi":null,"arxiv_id":null,"year":2022,"publication_status":"conference-paper","targets":["firmware"]},{"id":"paper-ecmo","title":"ECMO: Peripheral Transplantation to Rehost Embedded Linux Kernels","title_zh":"ECMO：通过外设移植重托管嵌入式 Linux 内核","description_en":"ECMO transplants peripheral drivers into embedded Linux kernels to boot firmware in QEMU. It evaluated 815 firmware images across 20 kernel versions, 37 device models, and 24 vendors; 710 reached a user-space shell.","description_zh":"ECMO 将外设驱动移植到嵌入式 Linux 内核中，使固件能够在 QEMU 中启动。研究评估了 815 个固件镜像，涵盖 20 个内核版本、37 种设备型号和 24 家厂商；其中 710 个成功启动用户空间 shell。","authors":["Muhui Jiang","Lin Ma","Yajin Zhou","Qiang Liu","Cen Zhang","Zhi Wang","Xiapu Luo","Lei Wu","Kui Ren"],"authors_omitted":null,"venue":"Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security","doi":"10.1145/3460120.3484753","arxiv_id":"2105.14295","year":2021,"publication_status":"conference-paper","targets":["firmware"]},{"id":"paper-jetset","title":"Jetset: Targeted Firmware Rehosting for Embedded Systems","title_zh":"Jetset：面向嵌入式系统的定向固件重托管","description_en":"Jetset rehosts firmware only as far as an analyst-chosen goal address, such as the point where a fuzzer can inject input. Given the architecture, the MMIO address range, an entry point and the goal, it symbolically executes the firmware with angr against a modified QEMU, treating peripheral reads as symbolic, cycling interrupts, and steering toward the goal with CFG distances and Tabu search. Solved constraints become C peripheral models for QEMU that replay the inferred values and interrupts so the firmware boots concretely to the goal. The authors evaluate 13 targets across x86, ARM and Motorola ColdFire, including Linux on a Raspberry Pi 2, a BeagleBoard-xM bootloader, a SEL-751 relay, a Boeing 737 CMU-900 and nine P²IM firmware, and use the CMU model with AFL to find a privilege escalation in its VRTX kernel.","description_zh":"Jetset 只将固件重托管到分析人员指定的目标地址，例如模糊测试器可以注入输入的位置。给定体系结构、MMIO 地址范围、入口点与目标地址后，它使用 angr 配合修改过的 QEMU 对固件进行符号执行，将外设读取视为符号值、轮流触发中断，并借助控制流图距离与禁忌搜索向目标推进。求解得到的约束被转换为供 QEMU 使用的 C 语言外设模型，重放推断出的取值与中断，使固件以具体执行方式启动到目标处。作者在 x86、ARM 与 Motorola ColdFire 上评测了 13 个目标，包括 Raspberry Pi 2 上的 Linux、BeagleBoard-xM 引导程序、SEL-751 继电器、波音 737 的 CMU-900 以及九个 P²IM 固件，并利用 CMU 模型结合 AFL 在其 VRTX 内核中发现一个提权漏洞。","authors":["Evan Johnson","Maxwell Bland","YiFei Zhu","Joshua Mason","Stephen Checkoway","Stefan Savage","Kirill Levchenko"],"authors_omitted":null,"venue":"USENIX Security 2021","doi":null,"arxiv_id":null,"year":2021,"publication_status":"conference-paper","targets":["firmware"]},{"id":"paper-uemu","title":"Automatic Firmware Emulation through Invalidity-guided Knowledge Inference","title_zh":"基于无效性引导知识推断的自动化固件仿真","description_en":"µEmu emulates ARM Cortex-M microcontroller firmware without real hardware or hand-written peripheral models by symbolically executing the image with unknown peripheral registers as symbols. Invalidity-guided exploration detects invalid states such as unexpected infinite loops and steers execution toward valid paths, caching the chosen responses at individual peripheral access points in a tiered knowledge base whose rules range from simple storage to PC- and calling-context-based matching. During dynamic analysis the knowledge base answers peripheral reads while an integrated, modified AFL fuzzer supplies data-register input. The prototype extends S2E 2.0 with Cortex-M support.","description_zh":"µEmu 将未知外设寄存器表示为符号，对固件映像进行符号执行，从而在没有真实硬件或人工编写外设模型的情况下仿真 ARM Cortex-M 微控制器固件。无效性引导的探索会检测意外死循环等无效状态，并把执行引向有效路径；所选响应按单个外设访问点缓存在分层知识库中，规则从简单存储到基于程序计数器和调用上下文的匹配。动态分析阶段由知识库响应外设读取，集成的改造版 AFL 模糊测试器则提供数据寄存器输入。原型在 S2E 2.0 基础上增加了 Cortex-M 支持。","authors":["Wei Zhou","Le Guan","Peng Liu","Yuqing Zhang"],"authors_omitted":null,"venue":"USENIX Security 2021","doi":null,"arxiv_id":"2107.07759","year":2021,"publication_status":"conference-paper","targets":["firmware"]},{"id":"paper-rehosting-sok","title":"SoK: Enabling Security Analyses of Embedded Systems via Rehosting","title_zh":"SoK：通过重托管实现嵌入式系统的安全分析","description_en":"Systematizes rehosting: moving embedded firmware from its physical hardware into a virtual environment that models enough hardware behavior for dynamic analysis such as fuzzing and symbolic execution. The authors measure why whole-system emulation does not scale using 2,574 hardware configurations, 1,956 device tree blobs from Linux 5.11.4 and 618 vendor ARM Cortex SVD files. They compare corpus CPU models with QEMU support, count unique peripherals, use driver source lines as a complexity proxy, and run a Monte Carlo simulation of adding peripheral models SoC by SoC. Supporting a random 10% of the SoCs would need about 3,947 peripherals for the Linux corpus and 1,730 for the ARM Cortex corpus, against 1,083 implemented in QEMU 5.2. The paper then classifies prior systems by how they emulate, replace, symbolically model, pass through to hardware or leave each layer unmodified, describes an iterative rehosting process with fidelity evaluation, and sets out open problems.","description_zh":"系统化梳理“重托管”：把嵌入式固件从实体硬件迁移到虚拟环境中，该环境对硬件行为的建模足以支持模糊测试、符号执行等动态分析。作者以 2,574 个硬件配置衡量全系统仿真为何难以扩展，包括来自 Linux 5.11.4 的 1,956 个设备树二进制文件（DTB）和 618 个厂商提供的 ARM Cortex SVD 文件。他们将语料中的 CPU 型号与 QEMU 的支持情况对比，统计不同外设的数量，以驱动源码行数作为复杂度的近似指标，并以蒙特卡罗模拟逐个 SoC 添加外设模型。若要支持随机抽取的 10% SoC，Linux 语料约需 3,947 种外设，ARM Cortex 语料约需 1,730 种，而 QEMU 5.2 实现的外设为 1,083 种。论文随后按各系统在每一层采用仿真、替换、符号建模、透传至硬件或保持不变的方式对既有工作分类，描述含保真度评估的迭代式重托管流程，并列出开放问题。","authors":["Andrew Fasano","Tiemoko Ballo","Marius Muench","Tim Leek","Alexander Bulekov","Brendan Dolan-Gavitt","Manuel Egele","Aurélien Francillon","Long Lu","Nick Gregory","Davide Balzarotti","William Robertson"],"authors_omitted":null,"venue":"ACM ASIA CCS 2021","doi":"10.1145/3433210.3453093","arxiv_id":null,"year":2021,"publication_status":"conference-paper","targets":["firmware"]},{"id":"paper-conware","title":"Conware: Automated Modeling of Hardware Peripherals","title_zh":"Conware：硬件外设的自动化建模","description_en":"Conware builds reusable software models of hardware peripherals from recordings of real firmware–peripheral interactions. An LLVM pass instruments Arduino source code to log MMIO reads, writes and interrupts on the real board, with existing hardware-in-the-loop recording as an alternative. Each recording becomes a per-peripheral graph whose read values are summarized as simple sub-models such as patterns; graphs are merged and optimized into automata that can be combined across peripherals and run in an Avatar²-based emulator. The authors model ten peripherals on an Arduino Due (SAM3X Cortex-M3) and emulate an uninstrumented smart-door-lock firmware from models trained only on vendor example code.","description_zh":"Conware 根据真实固件与外设交互的记录，构建可复用的硬件外设软件模型。一个 LLVM 编译遍对 Arduino 源码插桩，在真实开发板上记录 MMIO 读写和中断；也可改用已有的硬件在环记录方法。每份记录被转换为按外设划分的图，读取值以模式等简单子模型概括；这些图再经合并与优化形成自动机，可跨外设组合，并在基于 Avatar² 的仿真器中运行。作者在 Arduino Due（SAM3X Cortex-M3）上为十种外设建模，并仅用基于厂商示例代码训练的模型，仿真了一个未经插桩的智能门锁固件。","authors":["Chad Spensky","Aravind Machiry","Nilo Redini","Colin Unger","Graham Foster","Evan Blasband","Hamed Okhravi","Christopher Kruegel","Giovanni Vigna"],"authors_omitted":null,"venue":"ACM ASIA CCS 2021","doi":"10.1145/3433210.3437532","arxiv_id":null,"year":2021,"publication_status":"conference-paper","targets":["firmware"]},{"id":"paper-snipuzz","title":"Snipuzz: Black-box Fuzzing of IoT Firmware via Message Snippet Inference","title_zh":"Snipuzz：通过消息片段推断对物联网固件进行黑盒模糊测试","description_en":"Snipuzz fuzzes IoT firmware as a client, using device responses to infer message snippets that guide mutations. It was evaluated on 20 real-world IoT devices and compared with four IoT fuzzing approaches.","description_zh":"Snipuzz 作为客户端与物联网设备通信，根据设备响应推断消息片段，以指导固件黑盒模糊测试中的消息变异。论文在 20 款真实物联网设备上进行了评估，并与四种物联网模糊测试方法比较。","authors":["Xiaotao Feng","Ruoxi Sun","Xiaogang Zhu","Minhui Xue","Sheng Wen","Dongxi Liu","Surya Nepal","Yang Xiang"],"authors_omitted":null,"venue":"ACM CCS 2021","doi":null,"arxiv_id":"2105.05445","year":2021,"publication_status":"conference-accepted","targets":["firmware"]},{"id":"paper-dice","title":"DICE: Automatic Emulation of DMA Input Channels for Dynamic Firmware Analysis","title_zh":"DICE：面向动态固件分析的 DMA 输入通道自动仿真","description_en":"DICE adds DMA input emulation to microcontroller firmware emulators that model neither peripherals nor DMA controllers. It watches firmware writes to the memory-mapped DMA controller region for pairs of source and destination transfer pointers, and infers the transfer direction from later firmware accesses. When firmware reads a peripheral-to-RAM destination buffer, DICE answers with analyzer-supplied input such as fuzzer data, growing buffer bounds conservatively. Prototypes patch the QEMU forks of P2IM (ARM Cortex-M) and a PIC32 emulator (MIPS M4K/M-Class). On 83 sample firmware covering 9 DMA controllers from 5 vendors, the authors report 33 of 37 input channels detected with no false positives, correct input for 21 of 22 buffers and 3.4% average overhead. Fuzzing 7 real firmware for 48 hours found 5 previously unknown bugs.","description_zh":"DICE 为既不模拟外设也不模拟 DMA 控制器的微控制器固件仿真器增加 DMA 输入仿真。它监视固件向内存映射 DMA 控制器区域写入的源与目的传输指针对，并根据固件随后的访问推断传输方向。当固件读取外设到 RAM 的目的缓冲区时，DICE 以分析器提供的输入（如模糊测试数据）作答，并以保守方式扩展缓冲区边界。原型修改了 P2IM（ARM Cortex-M）与一款 PIC32 仿真器（MIPS M4K/M-Class）所用的 QEMU 分支。在覆盖 5 家厂商 9 种 DMA 控制器的 83 个示例固件上，作者报告检测出 37 个输入通道中的 33 个且无误报，为 22 个缓冲区中的 21 个提供了正确输入，平均开销为 3.4%。对 7 个真实固件进行 48 小时模糊测试，发现 5 个此前未知的缺陷。","authors":["Alejandro Mera","Bo Feng","Long Lu","Engin Kirda"],"authors_omitted":null,"venue":"IEEE S&P 2021","doi":"10.1109/SP40001.2021.00018","arxiv_id":"2007.01502","year":2021,"publication_status":"conference-paper","targets":["firmware"]},{"id":"paper-para-rehosting","title":"From Library Portability to Para-rehosting: Natively Executing Microcontroller Software on Commodity Hardware","title_zh":"从库可移植性到辅助重宿主：在通用硬件上原生运行微控制器软件","description_en":"The paper uses a POSIX-based portable MCU and replaceable peripheral drivers to rehost MCU software for native execution and security testing on commodity hardware.","description_zh":"论文通过基于 POSIX 的可移植微控制器模型和可替换的外设驱动，将微控制器软件迁移到通用硬件上原生运行并进行安全测试。","authors":["Wenqiang Li","Le Guan","Jingqiang Lin","Jiameng Shi","Fengjun Li"],"authors_omitted":null,"venue":"Proceedings 2021 Network and Distributed System Security Symposium","doi":"10.14722/ndss.2021.24308","arxiv_id":"2107.12867","year":2021,"publication_status":"conference-paper","targets":["firmware"]},{"id":"paper-firmae","title":"FirmAE: Towards Large-Scale Emulation of IoT Firmware for Dynamic Analysis","title_zh":"FirmAE：面向动态分析的物联网固件大规模仿真","description_en":"Extends Firmadyne with empirically derived interventions for boot, networking, NVRAM, kernel behavior, and other runtime failures, enabling Linux router and IP-camera firmware web services to run for dynamic analysis.","description_zh":"在 Firmadyne 基础上，针对启动、网络、NVRAM、内核行为及其他运行失败加入经验性干预，使 Linux 路由器与 IP 摄像机固件的 Web 服务能够运行并接受动态分析。","authors":["Mingeun Kim","Dongkwan Kim","Eunsoo Kim","Suryeon Kim","Yeongjin Jang","Yongdae Kim"],"authors_omitted":null,"venue":"ACSAC 2020","doi":"10.1145/3427228.3427294","arxiv_id":null,"year":2020,"publication_status":"conference-paper","targets":["firmware"]},{"id":"paper-halucinator","title":"HALucinator: Firmware Re-hosting Through Abstraction Layer Emulation","title_zh":"HALucinator：通过抽象层仿真实现固件重托管","description_en":"HALucinator rehosts monolithic ARM Cortex-M firmware by identifying hardware-abstraction-library functions and replacing them with authored Python handlers and peripheral models. LibMatch locates library interfaces; the QEMU/Avatar2 implementation supports interactive I/O, while the paper-associated HAL-fuzz variant uses AFL-Unicorn for fuzzing.","description_zh":"HALucinator 识别单体 ARM Cortex-M 固件中的硬件抽象库函数，并用人工编写的 Python 处理函数和外设模型替换它们，从而重托管固件。LibMatch 定位库接口；QEMU/Avatar2 实现支持交互式输入输出，与论文关联的 HAL-fuzz 变体则使用 AFL-Unicorn 进行模糊测试。","authors":["Abraham A Clements","Eric Gustafson","Tobias Scharnowski","Paul Grosen","David Fritz","Christopher Kruegel","Giovanni Vigna","Saurabh Bagchi","Mathias Payer"],"authors_omitted":null,"venue":"USENIX Security 2020","doi":null,"arxiv_id":null,"year":2020,"publication_status":"conference-paper","targets":["firmware"]},{"id":"paper-manually-re-iot-protocols","title":"On Manually Reverse Engineering Communication Protocols of Linux Based IoT Systems","title_zh":"基于 Linux 的物联网系统通信协议的人工逆向工程","description_en":"Presents a manual framework for reverse engineering communication protocols in embedded Linux IoT systems. It applies the framework to several systems and details a WeMo smart plug case study.","description_zh":"提出一种针对嵌入式 Linux 物联网系统通信协议的人工逆向工程框架，并将其应用于多个系统，详细展示了 WeMo 智能插座的案例。","authors":["Kaizheng Liu","Ming Yang","Zhen Ling","Huaiyu Yan","Yue Zhang","Xinwen Fu","Wei Zhao"],"authors_omitted":null,"venue":"arXiv","doi":null,"arxiv_id":"2007.11981","year":2020,"publication_status":"preprint","targets":["firmware","protocol"]},{"id":"paper-basesafe","title":"BaseSAFE: Baseband SAnitized Fuzzing through Emulation","title_zh":"BaseSAFE：通过仿真实现基带净化模糊测试","description_en":"BaseSAFE partially rehosts closed-source cellular baseband firmware for instrumented fuzzing and uses a sanitizing allocator to detect heap buffer overflows.","description_zh":"BaseSAFE 将闭源蜂窝基带固件部分迁移到仿真环境中进行插桩模糊测试，并用净化分配器检测堆缓冲区溢出。","authors":["Dominik Maier","Lukas Seidel","Shinjo Park"],"authors_omitted":null,"venue":"Proceedings of the 13th ACM Conference on Security and Privacy in Wireless and Mobile Networks","doi":"10.1145/3395351.3399360","arxiv_id":"2005.07797","year":2020,"publication_status":"conference-paper","targets":["firmware","protocol"]},{"id":"paper-frankenstein","title":"Frankenstein: Advanced Wireless Fuzzing to Exploit New Bluetooth Escalation Targets","title_zh":"Frankenstein：利用高级无线模糊测试攻击新的蓝牙权限提升目标","description_en":"Frankenstein emulates Bluetooth firmware dumps and fuzzes a virtual modem. It evaluates Broadcom and Cypress stacks, finding three zero-click vulnerabilities, host escalation issues, and BlueFrag on Android.","description_zh":"Frankenstein 仿真蓝牙固件转储，并对虚拟调制解调器进行模糊测试。论文评估了博通和赛普拉斯蓝牙协议栈，发现三个零点击漏洞、涉及主机的权限提升问题，以及 Android 上的 BlueFrag 漏洞。","authors":["Jan Ruge","Jiska Classen","Francesco Gringoli","Matthias Hollick"],"authors_omitted":null,"venue":"USENIX Security 2020","doi":null,"arxiv_id":"2006.09809","year":2020,"publication_status":"conference-accepted","targets":["firmware","protocol"]},{"id":"paper-firmadyne","title":"Towards Automated Dynamic Analysis for Linux-based Embedded Firmware","title_zh":"面向基于 Linux 的嵌入式固件的自动化动态分析","description_en":"Firmadyne crawls, extracts and emulates Linux-based firmware for network-connected commercial devices such as routers and IP cameras. It replaces the vendor kernel with pre-built, instrumented kernels for little-endian ARM and little- and big-endian MIPS, boots the extracted filesystem under QEMU full-system emulation with a userspace NVRAM library, infers the network configuration, then runs automated analyses including 60 known and 14 newly found exploits. From 23,035 images across 42 vendors, the authors extracted 9,486 and report 887 of the 1,971 network-reachable images vulnerable to at least one sampled exploit.","description_zh":"Firmadyne 对路由器、IP 摄像头等联网商用设备中基于 Linux 的固件进行爬取、提取与仿真。它以预先构建并插桩的小端 ARM 及小端、大端 MIPS 内核替换厂商内核，在 QEMU 全系统仿真中配合用户态 NVRAM 库启动提取出的文件系统，推断网络配置，再运行自动化分析，包括 60 个已知漏洞利用和 14 个新发现的漏洞利用。作者从 42 家厂商的 23,035 个固件映像中提取出 9,486 个，并报告在 1,971 个网络可达映像中有 887 个至少受一个所选漏洞利用影响。","authors":["Daming D. Chen","Manuel Egele","Maverick Woo","David Brumley"],"authors_omitted":null,"venue":"NDSS 2016","doi":"10.14722/ndss.2016.23415","arxiv_id":null,"year":2016,"publication_status":"conference-paper","targets":["firmware"]},{"id":"paper-dynamic-firmware-analysis-at-scale","title":"Automated Dynamic Firmware Analysis at Scale: A Case Study on Embedded Web Interfaces","title_zh":"大规模自动化动态固件分析：嵌入式 Web 界面案例研究","description_en":"The paper emulates firmware images and uses static and dynamic tools to find vulnerabilities in embedded web interfaces. It evaluated 1,925 images from 54 vendors and found vulnerabilities in 185 images.","description_zh":"论文通过全系统仿真运行固件镜像，并结合静态与动态工具发现嵌入式 Web 界面的漏洞。研究评估了来自 54 家厂商的 1,925 个固件镜像，在其中 185 个镜像中发现漏洞。","authors":["Andrei Costin","Apostolis Zarras","Aurélien Francillon"],"authors_omitted":null,"venue":"arXiv","doi":null,"arxiv_id":"1511.03609","year":2015,"publication_status":"preprint","targets":["firmware"]},{"id":"paper-avatar","title":"Avatar: A Framework to Support Dynamic Security Analysis of Embedded Systems’ Firmwares","title_zh":"Avatar：支持嵌入式系统固件动态安全分析的框架","description_en":"Avatar runs embedded firmware in an instrumented emulator, S²E on QEMU, while forwarding memory-mapped I/O to the real device and injecting the device's interrupts back into the emulator, so firmware that depends on undocumented peripherals can still be analyzed dynamically. The device is reached through JTAG via OpenOCD or through a small debugging stub over a serial line. Because forwarding every access over a 38400-baud serial link is very slow, about five instructions per second in one of the authors' measurements, Avatar also keeps memory that never behaves like I/O local to the emulator, migrates selected code to run natively on the device, and switches state between the two. With S²E's selective symbolic execution, the authors probe a hard-disk mask-ROM bootloader for hidden commands, an IEEE 802.15.4 sensor node for an injected overflow, and the SMS decoding routines of a GSM feature phone.","description_zh":"Avatar 在插桩模拟器（基于 QEMU 的 S²E）中运行嵌入式固件，同时把内存映射 I/O 转发给真实设备，并将设备产生的中断注入回模拟器，使依赖无文档外设的固件仍可接受动态分析。框架经由 OpenOCD 通过 JTAG 访问设备，或通过串口上的小型调试桩访问。由于经 38400 波特串口转发每次访问非常缓慢（作者的一次测量中约为每秒五条指令），Avatar 还会把从不表现为 I/O 的内存保留在模拟器本地，将选定代码迁移到设备上原生运行，并在两者之间切换状态。结合 S²E 的选择性符号执行，作者检查了硬盘掩膜 ROM 引导程序中的隐藏命令、一个 IEEE 802.15.4 传感器节点中人为注入的溢出，以及一部 GSM 功能手机的短信解码例程。","authors":["Jonas Zaddach","Luca Bruno","Aurélien Francillon","Davide Balzarotti"],"authors_omitted":null,"venue":"NDSS 2014","doi":"10.14722/ndss.2014.23229","arxiv_id":null,"year":2014,"publication_status":"conference-paper","targets":["firmware"]},{"id":"paper-transre","title":"Protocol Reverse Engineering via Deep Transfer Learning","title_zh":"通过深度迁移学习进行协议逆向工程","description_en":"Transfers field-boundary patterns from standardized protocol traces labeled by Tshark to poorly documented target protocols. A source-selection stage chooses related protocols, and a neural domain-adaptation model infers message syntax from their shared patterns.","description_zh":"将 Tshark 标注的标准协议流量中的字段边界模式迁移到文档不足的目标协议。先选择相关源协议，再通过神经网络领域适应模型依据共享模式推断消息语法。","authors":["Yanyang Zhao","Zhengxiong Luo","Wenlong Zhang","Feifan Wu","Yuanliang Chen","Fuchen Ma","Qi Xu","Heyuan Shi","Yu Jiang"],"authors_omitted":null,"venue":"Proceedings of the ACM on Software Engineering / FSE 2026","doi":"10.1145/3797124","arxiv_id":null,"year":2026,"publication_status":"journal-article","targets":["protocol"]},{"id":"paper-rfcllm","title":"RFCLLM: Evaluating LLMs' Reasoning Ability of Network Protocol State Machines","title_zh":"RFCLLM：评估大语言模型对网络协议状态机的推理能力","description_en":"Tests reasoning over protocol state machines using 1,482 questions across 16 protocols. Four context settings distinguish RFC retrieval from reasoning over supplied transitions; tasks cover next states, conditions, predecessor states and paths.","description_zh":"以 16 种协议的 1,482 个问题评测协议状态机推理。四种上下文设置区分 RFC 检索与依据给定转换进行推理，任务涵盖后继状态、条件、前驱状态及路径。","authors":["Anqi Chen","Dan Goldwasser","Cristina Nita-Rotaru"],"authors_omitted":null,"venue":"Findings of EMNLP 2026","doi":null,"arxiv_id":"2609.13389","year":2026,"publication_status":"conference-accepted","targets":["protocol"]},{"id":"paper-pvparser","title":"Recovering Process Variables from Industrial Network Traffic via Search-Based Optimization","title_zh":"基于搜索优化从工业网络流量恢复过程变量","description_en":"PVParser recovers process-variable layouts from industrial traffic and historian records. Periodic-pattern detection locates relevant payloads; a modified Monte Carlo tree search proposes field boundaries, types and endianness, then aligns decoded sequences with observed process variables.","description_zh":"PVParser 根据工业流量与历史过程记录恢复过程变量布局：周期模式检测定位相关载荷，改进的蒙特卡洛树搜索推断字段边界、类型和字节序，再将解码序列与已观察的过程变量对齐。","authors":["Chuan Sheng","Shan Jiang","Jianming Zhao","Yu Yao"],"authors_omitted":null,"venue":"CCS 2026","doi":null,"arxiv_id":"2608.16403","year":2026,"publication_status":"conference-accepted","targets":["protocol"]},{"id":"paper-icepre","title":"ICEPRE: ICS Protocol Reverse Engineering via Data-Driven Concolic Execution","title_zh":"ICEPRE：基于数据驱动混合符号执行的工控协议逆向工程","description_en":"Infers message-field boundaries by following concrete message-guided paths through binary protocol parsers, then symbolically replaying them to extract byte-level data flow. It merges bytes using value-preserving operations and similar processing traces. For the 1,000-message datasets of four public ICS protocols, the authors report average boundary F1 of 0.76 and field perfection of 0.67.","description_zh":"在二进制协议解析器中沿具体报文引导的路径分析，再进行符号化重放，提取字节级数据流以推断报文字段边界。它依据保持原值的运算和相似处理轨迹合并字节。作者在四种公开工控协议、每组 1,000 条报文的数据集上，报告平均边界 F1 分数为 0.76、字段完美分割率为 0.67。","authors":["Yibo Qu","Dongliang Fang","Zhen Wang","Jiaxing Cheng","Shuaizong Si","Yongle Chen","Limin Sun"],"authors_omitted":null,"venue":"Proceedings of the ACM on Software Engineering (ISSTA 2025)","doi":"10.1145/3728982","arxiv_id":null,"year":2025,"publication_status":"journal-article","targets":["protocol"]},{"id":"paper-protocolgpt","title":"Unleashing the Power of LLM to Infer State Machine From the Protocol Implementation","title_zh":"释放大语言模型潜力：从协议实现推断状态机","description_en":"ProtocolGPT infers protocol state machines from implementation source code with a retrieval-augmented LLM. It extracts state-machine-related code with regular expressions and a code filter, splits it into syntax-aware chunks stored in a FAISS vector store with OpenAI embeddings, and prompts GPT-4 step by step to recover states and message-triggered transitions. On six protocols in five open-source code bases (IKEv2, TLS 1.3, TLS 1.2, BGP, RTSP and L2TP), the authors report transition precision above 90%, more than 30% higher precision and 55% higher recall than baselines. Seeding AFLNet with the inferred machines raised coverage by more than 20% and found two previously unknown crash bugs in an RTSP server.","description_zh":"ProtocolGPT 借助检索增强的大语言模型，从协议实现源码推断协议状态机。它先用正则表达式和代码过滤器提取与状态机相关的代码，再按语法感知方式切分，以 OpenAI 嵌入存入 FAISS 向量库，并逐步提示 GPT-4 恢复状态及由报文触发的迁移。在五个开源代码库中的六种协议（IKEv2、TLS 1.3、TLS 1.2、BGP、RTSP 与 L2TP）上，作者报告迁移精确率超过 90%，精确率比基线高 30% 以上、召回率高 55% 以上。以推断出的状态机为 AFLNet 生成种子后，覆盖率提升 20% 以上，并在一个 RTSP 服务器中发现两个此前未知的崩溃漏洞。","authors":["Haiyang Wei","Ligeng Chen","Zhengjie Du","Yuhan Wu","Haohui Huang","Yue Liu","Guang Cheng","Fengyuan Xu","Linzhang Wang","Bing Mao"],"authors_omitted":null,"venue":"IWQoS 2025","doi":"10.1109/IWQoS65803.2025.11143461","arxiv_id":"2405.00393","year":2025,"publication_status":"conference-paper","targets":["protocol"]},{"id":"paper-binpre","title":"BinPRE: Enhancing Field Inference in Binary Analysis Based Protocol Reverse Engineering","title_zh":"BinPRE：增强基于二进制分析的协议逆向工程中的字段推断","description_en":"Infers protocol-message field boundaries and semantics from instrumented server binaries and input messages. BinPRE groups bytes by the instruction operators that process them, applies detectors for field types and functions, then refines results across similar messages. On eight protocols with 50 messages each, the authors report average field perfection of 0.73 and type/function F1 scores of 0.74/0.81.","description_zh":"根据受插桩监测的服务端二进制及输入报文，推断协议报文的字段边界与语义。BinPRE 按处理字节的指令操作符进行分组，使用检测器识别字段类型和功能，再借助相似报文细化结果。作者在八种协议、每种 50 条报文上报告平均字段完美分割率为 0.73，类型／功能推断的 F1 分数为 0.74／0.81。","authors":["Jiayi Jiang","Xiyuan Zhang","Chengcheng Wan","Haoyi Chen","Haiying Sun","Ting Su"],"authors_omitted":null,"venue":"ACM CCS 2024","doi":"10.1145/3658644.3690299","arxiv_id":"2409.01994","year":2024,"publication_status":"conference-paper","targets":["protocol"]},{"id":"paper-dynpre","title":"DynPRE: Protocol Reverse Engineering via Dynamic Inference","title_zh":"DynPRE：基于动态推断的协议逆向工程","description_en":"DynPRE starts from captured client–server traces and then interacts with a live protocol server to infer message formats and types. It detects session-specific identifiers such as cookies and rewrites them on the fly so that replayed requests stay valid. It then sends byte-level probe requests whose responses serve as semantic feedback for field identification, aligns the responses, and applies a request–response mapping refinement that also recognizes message types. On 12 protocols with 10-, 100- and 1,000-message datasets, the authors report average field perfection of 0.50 and message-type V-measure of 0.94, against 0.15–0.31 perfection for Netzob, NetPlier, FieldHunter, BinaryInferno and NEMESYS.","description_zh":"DynPRE 以捕获的客户端—服务端流量为起点，再与在线协议服务端交互，推断报文格式与类型。它检测 Cookie 等会话特定标识符并实时改写，使重放的请求保持有效；随后发送字节级探测请求，以服务端响应作为字段识别的语义反馈，对响应进行对齐分析，并通过请求—响应映射细化格式，同时识别报文类型。作者在 12 种协议、规模分别为 10、100 与 1,000 条报文的数据集上，报告平均字段完美分割率为 0.50、报文类型 V-measure 为 0.94，而 Netzob、NetPlier、FieldHunter、BinaryInferno 与 NEMESYS 的完美分割率为 0.15–0.31。","authors":["Zhengxiong Luo","Kai Liang","Yanyang Zhao","Feifan Wu","Junze Yu","Heyuan Shi","Yu Jiang"],"authors_omitted":null,"venue":"NDSS 2024","doi":"10.14722/ndss.2024.24083","arxiv_id":null,"year":2024,"publication_status":"conference-paper","targets":["protocol"]},{"id":"paper-netlifter","title":"Lifting Network Protocol Implementation to Precise Format Specification with Security Applications","title_zh":"从网络协议实现提取精确格式规范及其安全应用","description_en":"NetLifter statically lifts source-available C protocol parsers into BNF-style message grammars and first-order constraints between packet fields. It analyzes annotated LLVM bitcode using abstract format graphs, localized path-sensitive analysis, unfolding and reordering. The resulting field boundaries, constraints and names can support packet generation and parser construction.","description_zh":"NetLifter 将可获取源码的 C 协议解析器静态转换为 BNF 风格的报文文法及报文字段之间的一阶逻辑约束。它分析经过标注的 LLVM 位码，结合抽象格式图、局部路径敏感分析、展开与重排序。所得字段边界、约束与名称可用于报文生成及解析器构建。","authors":["Qingkai Shi","Junyang Shao","Yapeng Ye","Mingwei Zheng","Xiangyu Zhang"],"authors_omitted":null,"venue":"ACM CCS 2023","doi":"10.1145/3576915.3616614","arxiv_id":"2305.11781","year":2023,"publication_status":"conference-paper","targets":["protocol"]},{"id":"paper-protocol-format-state-machine","title":"Extracting Protocol Format as State Machine via Controlled Static Loop Analysis","title_zh":"通过受控静态循环分析将协议格式提取为状态机","description_en":"The paper extracts protocol message formats from parser code by analyzing parsing loops as state machines. It evaluates format inference and the use of the extracted machines in protocol fuzzers.","description_zh":"论文通过将解析循环分析为状态机，从解析器代码中提取协议消息格式，并评估格式推断效果及所提取状态机在协议模糊测试中的应用。","authors":["Qingkai Shi","Xiangzhe Xu","Xiangyu Zhang"],"authors_omitted":null,"venue":"arXiv","doi":null,"arxiv_id":"2305.13483","year":2023,"publication_status":"preprint","targets":["protocol"]},{"id":"paper-binaryinferno","title":"BinaryInferno: A Semantic-Driven Approach to Field Inference for Binary Message Formats","title_zh":"BinaryInferno：面向二进制报文格式字段推断的语义驱动方法","description_en":"Infers partial binary-message formats from static message samples without instrumenting an executable. Specialized detectors recognize floats, timestamps, lengths, entropy boundaries and serialization patterns; a graph-based integration step reconciles their descriptions. Across samples from ten protocols, the authors report top-level field-boundary precision of 0.69, recall of 0.73 and false-positive rate of 0.04 for the 1,000-message setting without analyst priors.","description_zh":"无需对可执行程序插桩，即可从静态报文样本推断部分二进制报文格式。专用检测器识别浮点数、时间戳、长度、熵边界和序列化模式，再通过基于图的集成步骤协调各自的描述。作者对十种协议的样本开展评估，在每组 1,000 条报文且不使用分析者先验的设置下，报告顶层字段边界的精确率为 0.69、召回率为 0.73、假阳性率为 0.04。","authors":["Jared Chandler","Adam Wick","Kathleen Fisher"],"authors_omitted":null,"venue":"NDSS 2023","doi":"10.14722/ndss.2023.23131","arxiv_id":null,"year":2023,"publication_status":"conference-paper","targets":["protocol"]},{"id":"paper-stateinspector","title":"The Closer You Look, The More You Learn: A Grey-box Approach to Protocol State Machine Learning","title_zh":"越仔细观察，学到的越多：用于协议状态机学习的灰盒方法","description_en":"StateInspector learns protocol Mealy machines by combining active message queries with snapshots of runtime memory, without requiring the target’s source code. It identifies candidate state-defining heap locations and uses taint and concolic analysis to merge states, evaluated by the authors on TLS 1.2 and WPA/2 implementations.","description_zh":"StateInspector 将主动消息查询与运行时内存快照结合起来，学习协议的 Mealy 状态机，无需目标实现的源代码。它识别可能决定状态的堆内存位置，并通过污点分析与混合执行合并状态；作者在 TLS 1.2 和 WPA/2 实现上进行了评估。","authors":["Chris McMahon Stone","Sam L. Thomas","Mathy Vanhoef","James Henderson","Nicolas Bailluet","Tom Chothia"],"authors_omitted":null,"venue":"ACM CCS 2022","doi":"10.1145/3548606.3559365","arxiv_id":null,"year":2022,"publication_status":"conference-paper","targets":["protocol"]},{"id":"paper-ble-automata-learning","title":"Fingerprinting and analysis of Bluetooth devices with automata learning","title_zh":"基于自动机学习的蓝牙设备指纹识别与分析","description_en":"Learns Mealy-machine models of Bluetooth Low Energy implementations on physical peripherals by active automata learning. An nRF52840 central running SweynTooth-derived firmware sends abstract BLE inputs, with error handling, repeated queries and caching for lost packets and non-deterministic replies. The authors learn connection-procedure models of six devices and legacy-pairing models of three, and use model differences to fingerprint their SoCs.","description_zh":"通过主动自动机学习，为实体外设上的低功耗蓝牙（BLE）协议实现推断 Mealy 状态机模型。运行 SweynTooth 衍生固件的 nRF52840 中心设备发送抽象 BLE 输入，并以错误处理、重复查询和缓存应对丢包与不确定的响应。作者学习了六款设备的连接过程模型和其中三款的传统配对（legacy pairing）模型，并利用模型差异识别各设备的 SoC。","authors":["Andrea Pferscher","Bernhard K. Aichernig"],"authors_omitted":null,"venue":"Formal Methods in System Design","doi":"10.1007/s10703-023-00425-y","arxiv_id":"2211.16074","year":2022,"publication_status":"journal-article","targets":["protocol"]},{"id":"paper-attack-synthesis-fsm","title":"Automated Attack Synthesis by Extracting Finite State Machines from Protocol Specification Documents","title_zh":"从协议规范文档中提取有限状态机以自动合成攻击","description_en":"Extracts protocol FSMs from RFC prose using technical word representations, zero-shot text mapping, and rules, then uses the extracted FSMs to synthesize attacks.","description_zh":"从 RFC 文本中提取协议有限状态机，方法结合技术词表示学习、零样本文本映射和规则映射，并用提取的状态机合成攻击。","authors":["Maria Leonor Pacheco","Max von Hippel","Ben Weintraub","Dan Goldwasser","Cristina Nita-Rotaru"],"authors_omitted":null,"venue":"IEEE Symposium on Security and Privacy 2022","doi":null,"arxiv_id":"2202.09470","year":2022,"publication_status":"conference-accepted","targets":["protocol"]},{"id":"paper-dikeue","title":"Noncompliance as Deviant Behavior: An Automated Black-box Noncompliance Checker for 4G LTE Cellular Devices","title_zh":"将不合规视为偏离行为：面向 4G LTE 蜂窝设备的自动化黑盒不合规检查器","description_en":"DIKEUE checks 4G LTE control-plane (NAS and RRC) implementations in commercial phones and modems for noncompliance through differential testing rather than predefined security properties. Its FSM inference module runs TTT active automata learning in LearnLib through an LTE-specific adapter on a modified srsLTE network with a USRP B210 radio, adding a context checker, query cache, inconsistency resolver and reset without rebooting. An equivalence checker then encodes pairs of learned input-output finite state machines for the nuXmv model checker and enumerates diverse deviation-inducing input sequences, which the authors analyze manually.","description_zh":"DIKEUE 通过差分测试而非预先定义的安全属性，检查商用手机和调制解调器中 4G LTE 控制面（NAS 与 RRC）实现的不合规之处。其状态机推断模块借助 LearnLib 中的 TTT 主动自动机学习，经由面向 LTE 的适配器在改造后的 srsLTE 网络和 USRP B210 无线电上运行，并加入上下文检查器、查询缓存、不一致消解器以及无需重启的复位机制。随后，等价性检查器将两两学到的输入输出有限状态机编码给 nuXmv 模型检查器，枚举多样的偏离诱发输入序列，再由作者人工分析。","authors":["Syed Rafiul Hussain","Imtiaz Karim","Abdullah Al Ishtiaq","Omar Chowdhury","Elisa Bertino"],"authors_omitted":null,"venue":"ACM CCS 2021","doi":"10.1145/3460120.3485388","arxiv_id":null,"year":2021,"publication_status":"conference-paper","targets":["protocol"]},{"id":"paper-netplier","title":"NetPlier: Probabilistic Network Protocol Reverse Engineering from Message Traces","title_zh":"NetPlier：基于报文记录的概率网络协议逆向工程","description_en":"Uses multiple sequence alignment and probabilistic keyword-field inference to cluster network messages by type, evaluated across ten protocols with downstream format and state-machine analysis.","description_zh":"通过多序列比对与概率式关键字段推断，按类型对网络报文聚类，并在十种协议上评测及开展后续格式与状态机分析。","authors":["Yapeng Ye","Zhuo Zhang","Fei Wang","Xiangyu Zhang","Dongyan Xu"],"authors_omitted":null,"venue":"NDSS 2021","doi":"10.14722/ndss.2021.24531","arxiv_id":null,"year":2021,"publication_status":"conference-paper","targets":["protocol"]},{"id":"paper-librecan","title":"LibreCAN: Automated CAN Message Translator","title_zh":"LibreCAN：自动化 CAN 报文翻译器","description_en":"LibreCAN reverse-engineers proprietary CAN message formats from traffic recorded at a vehicle's OBD-II port, without the OEM's DBC translation files. Phase 0 extracts candidate signal boundaries from bit-flip behaviour, extending the earlier READ algorithm; Phase 1 correlates extracted signals with standard OBD-II PIDs and smartphone IMU data to identify kinematic signals and estimate their scale and offset; Phase 2 filters the CAN IDs recorded while a driver performs 53 scripted body-related events to shortlist candidate IDs for each event.","description_zh":"LibreCAN 在没有整车厂 DBC 翻译文件的情况下，根据在车辆 OBD-II 接口记录的流量逆向专有的 CAN 报文格式。阶段 0 扩展早期的 READ 算法，依据比特翻转行为提取候选信号边界；阶段 1 将提取出的信号与标准 OBD-II PID 及智能手机惯性测量数据做相关分析，识别运动学相关信号并估计其比例系数和偏移量；阶段 2 对驾驶者执行 53 个预定车身相关事件时记录的 CAN ID 进行过滤，为每个事件筛选候选 ID。","authors":["Mert D. Pesé","Troy Stacer","C. Andrés Campos","Eric Newberry","Dongyao Chen","Kang G. Shin"],"authors_omitted":null,"venue":"ACM CCS 2019","doi":"10.1145/3319535.3363190","arxiv_id":null,"year":2019,"publication_status":"conference-paper","targets":["protocol"]},{"id":"paper-wireless-protocol-re","title":"Automatic Wireless Protocol Reverse Engineering","title_zh":"无线协议自动逆向工程","description_en":"Infers message formats of proprietary wireless protocols from demodulated physical-layer captures: it aligns messages by preamble and sync word, then uses RSSI and dedicated engines to label length, address, sequence-number and checksum fields, optionally using known addresses or field positions.","description_zh":"从解调后的物理层捕获数据推断专有无线协议的报文格式：先依据前导码和同步字对齐报文，再结合 RSSI 与专用引擎标注长度、地址、序列号和校验和字段，并可利用已知地址或字段位置等先验信息。","authors":["Johannes Pohl","Andreas Noack"],"authors_omitted":null,"venue":"13th USENIX Workshop on Offensive Technologies (WOOT 19)","doi":null,"arxiv_id":null,"year":2019,"publication_status":"conference-paper","targets":["protocol"]},{"id":"paper-nemesys","title":"NEMESYS: Network Message Syntax Reverse Engineering by Analysis of the Intrinsic Structure of Individual Messages","title_zh":"NEMESYS：通过分析单条报文的内在结构逆向推断网络报文语法","description_en":"Infers approximate field boundaries within individual binary-protocol messages from changes in bit congruence, and introduces Format Match Score to compare inferred segmentation with known protocol dissectors.","description_zh":"根据单条二进制协议报文内比特一致性的变化，推断近似字段边界，并提出格式匹配分数，将推断的分段结果与已知协议解析器进行比较。","authors":["Stephan Kleber","Henning Kopp","Frank Kargl"],"authors_omitted":null,"venue":"12th USENIX Workshop on Offensive Technologies (WOOT 18)","doi":null,"arxiv_id":null,"year":2018,"publication_status":"conference-paper","targets":["protocol"]},{"id":"paper-netzob","title":"Towards Automated Protocol Reverse Engineering Using Semantic Information","title_zh":"利用语义信息实现自动化协议逆向工程","description_en":"Infers the vocabulary of an undocumented protocol, its message types and formats, from communication traces. The approach uses contextual information embedded in the messages to improve message clustering and the identification of field boundaries; the HAL record lists contextual clustering and semantic sequence alignment as keywords. The authors motivate the work with parsers and traffic generators for network security products, and compare it with their own reimplementations of ASAP, Discoverer and ScriptGen. The first two authors are the authors of Netzob, the open-source protocol reverse-engineering framework.","description_zh":"从通信流量记录中推断未公开协议的词汇，即报文类型与格式。该方法利用报文中嵌入的上下文信息改进报文聚类和字段边界识别；HAL 记录列出的关键词为上下文聚类与语义序列比对。作者以为网络安全产品构建解析器与流量生成器作为研究动机，并与自行重新实现的 ASAP、Discoverer 和 ScriptGen 进行比较。前两位作者也是开源协议逆向框架 Netzob 的作者。","authors":["Georges Bossert","Frédéric Guihéry","Guillaume Hiet"],"authors_omitted":null,"venue":"ACM ASIA CCS 2014","doi":"10.1145/2590296.2590346","arxiv_id":null,"year":2014,"publication_status":"conference-paper","targets":["protocol"]},{"id":"paper-prospex","title":"Prospex: Protocol Specification Extraction","title_zh":"Prospex：协议规范提取","description_en":"Prospex infers message formats and a protocol state machine from execution traces of a Linux server handling client sessions. Dynamic taint analysis splits each session into messages and recovers their formats; messages are then clustered into types by input-format, execution and server-impact similarity, such as the system calls, outputs and file paths a message triggers. The observed type sequences form an augmented prefix tree acceptor, which prerequisite and end-state heuristics label before Exbar computes a minimal consistent automaton. The resulting specifications are translated for the Peach fuzzer to reach later protocol states. The evaluation covers the Agobot command-and-control protocol, SMTP on Sendmail, SMB on Samba and SIP on Asterisk.","description_zh":"Prospex 从 Linux 服务端处理客户端会话时的执行轨迹推断报文格式与协议状态机。它利用动态污点分析把每个会话切分为报文并恢复其格式；再依据输入格式、执行过程及对服务端影响（如报文触发的系统调用、输出与文件路径）的相似度将报文聚类为不同类型。观察到的类型序列构成增广前缀树接受器，先由前置条件与结束状态启发式标注，再用 Exbar 求出一致的最小自动机。所得规范被转换供 Peach 模糊测试器使用，以到达协议的后续状态。评测覆盖 Agobot 命令与控制协议、Sendmail 上的 SMTP、Samba 上的 SMB 以及 Asterisk 上的 SIP。","authors":["Paolo Milani Comparetti","Gilbert Wondracek","Christopher Kruegel","Engin Kirda"],"authors_omitted":null,"venue":"IEEE S&P 2009","doi":"10.1109/SP.2009.14","arxiv_id":null,"year":2009,"publication_status":"conference-paper","targets":["protocol"]},{"id":"paper-tupni","title":"Tupni: Automatic Reverse Engineering of Input Formats","title_zh":"Tupni：输入格式的自动逆向工程","description_en":"Tupni infers an input format from an execution trace of an x86 program parsing one input, using byte-level dynamic taint tracking. It segments the input into fields from the instructions that operate on tainted bytes, finds record sequences from parsing loops, groups records into types by the code that handles them, and emits an enhanced BNF grammar with length, value and some inter-message constraints. Grammars from several inputs can be merged into a more complete specification. The evaluation covers five file formats (WMF, BMP, JPG, PNG, TIF) and five network protocols (DNS, RPC, TFTP, HTTP, FTP), and the output is used for zero-day vulnerability signature generation with ShieldGen.","description_zh":"Tupni 利用字节级动态污点跟踪，从 x86 程序解析单个输入时的执行轨迹推断输入格式。它依据处理污点字节的指令把输入切分为字段，从解析循环中找出记录序列，按处理代码将记录归为不同记录类型，并输出带有长度、取值及部分跨报文约束的增强 BNF 文法。多个输入得到的文法可以合并为更完整的规范。评测覆盖五种文件格式（WMF、BMP、JPG、PNG、TIF）和五种网络协议（DNS、RPC、TFTP、HTTP、FTP），并将输出用于 ShieldGen 的零日漏洞签名生成。","authors":["Weidong Cui","Marcus Peinado","Karl Chen","Helen J. Wang","Luis Irun-Briz"],"authors_omitted":null,"venue":"ACM CCS 2008","doi":"10.1145/1455770.1455820","arxiv_id":null,"year":2008,"publication_status":"conference-paper","targets":["protocol","binary"]},{"id":"paper-polyglot","title":"Polyglot: Automatic Extraction of Protocol Message Format using Dynamic Binary Analysis","title_zh":"Polyglot：基于动态二进制分析的协议报文格式自动提取","description_en":"Polyglot infers the format of a message that a program receives by monitoring how the program binary processes it, an approach the authors call shadowing. An execution monitor taints network input and records an instruction trace; offline analyses then find direction fields, such as length and pointer fields, from tainted memory accesses and loop conditions, separators from comparisons between tainted bytes and constants, multi-byte fixed-length fields from how instructions group input bytes, and protocol keywords from successful comparisons. It works on stripped IA-32 binaries without source code or debugging information.","description_zh":"Polyglot 通过监测程序二进制如何处理接收到的报文来推断其格式，作者称这一方法为“影随”（shadowing）。执行监控器对网络输入施加污点标记并记录指令轨迹；离线分析再依据受污点数据参与的内存访问与循环条件识别长度字段、指针字段等指向字段，依据受污点字节与常量之间的比较识别分隔符，依据指令如何组合输入字节识别多字节定长字段，并依据成功的比较提取协议关键字。该方法适用于剥离符号的 IA-32 二进制，无需源码或调试信息。","authors":["Juan Caballero","Heng Yin","Zhenkai Liang","Dawn Song"],"authors_omitted":null,"venue":"ACM CCS 2007","doi":"10.1145/1315245.1315286","arxiv_id":null,"year":2007,"publication_status":"conference-paper","targets":["protocol"]}]}