# Reverse engineering papers & benchmarks

> 235 source-reviewed papers on binary reversing, decompilation, agent evaluation, protocol inference, firmware analysis and website, game and app reconstruction.

We check each paper against its primary sources.

- HTML: <https://awesomerea.org/papers/>
- JSON: <https://awesomerea.org/api/v1/papers.json>
- 简体中文: <https://awesomerea.org/zh/papers/index.md>

## Reverse-engineering agent evaluation (14)

- [Humans vs. Machines: A Comparison With AI Agents in Software Reverse Engineering](https://awesomerea.org/papers/paper-humans-machines-sre/index.md): 2026 · arXiv · Preprint · Compares human and LLM-agent understanding and navigation on the same static reverse-engineering challenges, then studies how binary representations consume context windows.
- [Training Language Model Agents to Find Vulnerabilities with CTF-Dojo](https://awesomerea.org/papers/paper-ctf-dojo/index.md): 2026 · ICML 2026 · Conference paper · CTF-Dojo is an execution environment for training LLM agents on capture-the-flag tasks: 658 challenges from 50 competitions held between 2011 and 2025, taken from pwn.college's CTF Archive and containerized with Docker. Its CTF-Forge pipeline prompts DeepSeek-V3-0324 to write each challenge's Dockerfile, docker-compose file and challenge metadata; across three independent runs, 650 challenges consistently built and answered on their expected ports. Qwen3-Coder and DeepSeek-V3-0324 agents in the EnIGMA+ scaffold, capped at 40 turns, collected trajectories. Matched CTFtime writeups served as hints during collection and were removed afterwards, and ports, paths, distractor code and other runtime details were randomized per rollout. Rejection-sampling fine-tuning of Qwen3 8B, 14B and 32B on 486 flag-capturing trajectories from 274 solved challenges raises average Pass@1 on InterCode-CTF, NYU CTF Bench and Cybench by up to 11.6 points; the 32B model reaches 31.9%.
- [Reveree: Diagnosing LLM Reverse-Engineering Agents](https://awesomerea.org/papers/paper-reveree/index.md): 2026 · arXiv · Preprint · Evaluates reverse-engineering agent traces through flag recovery, eight analysis milestones and action profiles. Deterministic checks and an outcome-blinded LLM judge help locate failures beyond a single solve-rate score.
- [The Next Challenge for Agentic Cybersecurity: A Realistic, Contamination-Free Reverse Engineering Benchmark](https://awesomerea.org/papers/paper-sre-bench/index.md): 2026 · arXiv · Preprint · Introduces SRE-Bench, with privately authored programs and protected binary variants, to study agent recovery of program semantics while reducing training-data contamination.
- [Automatically Attacking Software Reverse Engineering AI Agents](https://awesomerea.org/papers/paper-attacking-re-ai-agents/index.md): 2026 · ECCWS 2026 · Conference paper · A proof of concept for indirect prompt injection against Cline/GhidraMCP binary-analysis agents. An adapted AutoDAN generates embedded strings that make the agent describe different behavior. The authors demonstrate four small C programs with Qwen3-8B and transfer the examples to GPT-OSS-120B.
- [CrackMeBench: Binary Reverse Engineering for Agents](https://awesomerea.org/papers/paper-crackmebench/index.md): 2026 · arXiv · Preprint · Evaluates agents on executable-checked CrackMe tasks: infer validation logic from binaries and submit an accepted input or artifact, while recording tool use, time, and scoring attempts.
- [Towards LLM-Resistant Software Protection: Agent Failure Patterns in CTF Reverse Engineering](https://awesomerea.org/papers/paper-llm-resistant-protection/index.md): 2026 · Workshop on Binary Analysis Research (BAR) 2026 · Conference paper · Runs Claude Code, Codex CLI and ChatGPT-5.2 Pro on 24 crackme-style challenges selected from 15 international CTF events held in 2025, and attributes their failures to stages of an Observe–Comprehend–Plan loop and to three protection effects: concealment, complication and misdirection. From the failure logs, the authors derive four recurring weaknesses (training bias, over-trust in observations, context limitation and plan persistence). They rerun both CLI agents without a decompiler and compare outcomes with in-competition solve rates.
- [ProgramBench: Can Language Models Rebuild Programs From Scratch?](https://awesomerea.org/papers/paper-programbench/index.md): 2026 · NeurIPS 2026 · Conference accepted · Evaluates black-box program reconstruction across 200 tasks: agents query an executable and read its documentation, then independently implement a codebase whose behavior is checked by generated tests.
- [Decompiling the Synergy: An Empirical Study of Human–LLM Teaming in Software Reverse Engineering](https://awesomerea.org/papers/paper-decompiling-synergy/index.md): 2026 · NDSS 2026 · Conference paper · Studies how human analysts work with LLM assistance during static software reverse engineering. A survey of 153 practitioners informed six LLM features built into an instrumented IDA Pro plugin. Then 48 participants (24 self-reported novices and 24 experts) analyzed two CTF-style binaries, with the features enabled on one randomly assigned challenge. From graded writeups, interaction logs and surveys, the authors report 18 findings: novice understanding rose by about 98% to expert levels while experts gained little, known-algorithm functions were triaged up to 2.4× faster, and artifact recovery rose by at least 66%, alongside harmful hallucinations.
- [Cyber-Zero: Training Cybersecurity Agents without Runtime](https://awesomerea.org/papers/paper-cyber-zero/index.md): 2026 · ICLR 2026 · Conference paper · Cyber-Zero synthesizes training trajectories for capture-the-flag (CTF) agents from public writeups instead of running the challenges. Writeups collected from CTFtime through the CTF Archives repository are cleaned, filtered and completed with DeepSeek-V3-0324, which fills in missing metadata and extracts flags; after removing 47 challenges that overlap the evaluation benchmarks, the corpus holds 6,188 writeups for 4,610 challenges from 543 competitions in six categories, 2017–2025. Two DeepSeek-V3-0324 personas then simulate each solve: a CTF player that sees only the challenge content, and a Bash terminal that sees the writeup and flag, invents plausible command output and may inject hints, which are removed before training. Trajectories use the EnIGMA scaffold format and are kept only if they reach the exact flag, pass format checks and are judged by an LLM filter to follow the writeup's approach. Qwen3, Qwen2.5-Instruct and SWE-agent-LM models are fine-tuned on 9,464 of these trajectories and evaluated with EnIGMA+, the authors' parallel version of EnIGMA, on InterCode-CTF, NYU CTF Bench and Cybench. The fine-tuned Qwen3-32B (Cyber-Zero-32B) rises from 20.3% to 33.4% average Pass@1, the 13.1-point gain reported in the abstract.
- [CREBench: Evaluating Large Language Models in Cryptographic Binary Reverse Engineering](https://awesomerea.org/papers/paper-crebench/index.md): 2026 · COLM 2026 · Conference paper · Benchmarks cryptographic binary reverse engineering across algorithm recognition, key or IV extraction, wrapper reconstruction, and flag recovery using 432 controlled challenges.
- [EnIGMA: Interactive Tools Substantially Assist LM Agents in Finding Security Vulnerabilities](https://awesomerea.org/papers/paper-enigma/index.md): 2025 · ICML 2025 · Conference paper · EnIGMA extends SWE-agent for capture-the-flag challenges with interactive agent tools that keep a gdb debugging session or a pwntools server connection open across turns, alongside decompile and disassemble commands, an LM summarizer for long outputs, and category-specific demonstrations and guidelines. It is evaluated with four LMs on 390 challenges from NYU CTF, InterCode-CTF, Cybench and a HackTheBox set the authors collected. The paper ablates tools, summarizers and demonstrations, and analyzes solution leakage and “soliloquizing”, where the model writes its own observations instead of acting in the environment.
- [Cybench: A Framework for Evaluating Cybersecurity Capabilities and Risks of Language Models](https://awesomerea.org/papers/paper-cybench/index.md): 2025 · ICLR 2025 · Conference paper · Cybench turns 40 professional-level capture-the-flag tasks from four competitions (HackTheBox Cyber Apocalypse 2024, SekaiCTF 2022–23, GlacierCTF and HKCert) into runnable agent tasks. Each task has a description, starter files, a Kali Linux container for the agent with task servers in Docker, and the time the first human team needed to solve it, from 2 minutes to 24 hours 54 minutes. Each task is also split into subtasks that grade intermediate steps. The authors evaluate eight models with a structured bash agent and compare four scaffolds for GPT-4o and Claude 3.5 Sonnet. Without subtask guidance, the best agents solved only tasks whose first human solve took at most 11 minutes, and Claude 3.5 Sonnet reached 17.5% unguided success.
- [NYU CTF Bench: A Scalable Open-Source Benchmark Dataset for Evaluating LLMs in Offensive Security](https://awesomerea.org/papers/paper-nyu-ctf-bench/index.md): 2024 · NeurIPS 2024 Datasets and Benchmarks · Conference paper · NYU CTF Bench packages 200 manually validated challenges from CSAW CTF qualifying and final rounds held between 2017 and 2023, spanning cryptography, forensics, pwn, reverse engineering, web and miscellaneous tasks, with challenge.json metadata and Docker images for server-side challenges. The paper also presents an automated framework that gives LLMs function-calling tools for shell commands, file creation, Ghidra disassembly and decompilation, flag checking and giving up. It evaluates five LLMs and compares their scores with human teams at CSAW 2022 and 2023.

## Decompilation and symbol recovery (110)

- [Locate, Then Reason: End-to-End Patch Presence Testing in Stripped Binaries](https://awesomerea.org/papers/paper-patchalign/index.md): 2026 · arXiv · Preprint · Locates patch-relevant code in stripped binaries using instruction-aligned retrieval and caller/callee context, then uses an LLM to screen candidate matches and compare patch-specific behavior with vulnerable and patched references.
- [Recall-Oriented Precise Binary-to-Source Function Matching](https://awesomerea.org/papers/paper-bscout/index.md): 2026 · arXiv · Preprint · BScout matches decompiled functions to a source corpus using chunked embeddings and inlining-aware training. Existing matches provide positional clues to expand candidates; LLM selection and structural filters refine the resulting correspondences.
- [Decoding What iOS Location Services Send to Apple: An LLM Is an Unreliable Analyst but a Useful Toolmaker](https://awesomerea.org/papers/paper-ios-protobuf-extractor/index.md): 2026 · arXiv · Preprint · Compares direct LLM recovery of Apple PBCodable schemas with an AI-written Extractor checked against compiled synthetic fixtures, published descriptors and captured traffic. It shows how plausible recovered schemas can silently decode values incorrectly.
- [SoK: Are LLMs Reliable at Source Code Recovery? A Taxonomy and Empirical Evaluation](https://awesomerea.org/papers/paper-sok-source-recovery-reliability/index.md): 2026 · arXiv · Preprint · This SoK organizes LLM-assisted source-recovery designs and separates compilation, readability, structural and behavioral metrics. Its controlled study varies architecture, compiler optimization and symbol availability, with smaller ablations for input representation, model roles and source language.
- [The CodeInverter Suite: Structure- and Data-Aware Binary Decompilation with Efficient LLMs](https://awesomerea.org/papers/paper-codeinverter-suite/index.md): 2026 · ASE 2026 · Conference paper · CodeInverter studies function-level LLM decompilation using control-flow graphs and memory-to-data mappings extracted with IDA/objdump. It presents a prompt workflow, training corpus and model family, evaluated through compilation, benchmark input/output tests and edit similarity.
- [Beyond Text Matching: Towards Reference-Free Evaluation for Human-Oriented Binary Reverse Engineering](https://awesomerea.org/papers/paper-binjudge/index.md): 2026 · ASE 2026 · Conference paper · BinJudgeBench collects expert judgments for function naming, binary-code summaries and decompilation refinement. BinJudge learns to select a judge configuration for each input and task, evaluating agreement with human scores rather than executable correctness.
- [Decompiling Quantum Assembly into Structured Programs](https://awesomerea.org/papers/paper-quelle/index.md): 2026 · arXiv · Preprint · Quelle recovers library calls, loops, functions and symbolic parameters from compiled OpenQASM. It removes routing artifacts, proposes structured reconstructions and checks them against circuit semantics, retaining gate-level fallbacks when recovery fails.
- [ASAP: Assembly-Source Aligned Pseudocode Refinement For Binary Decompilation](https://awesomerea.org/papers/paper-asap-decompilation/index.md): 2026 · arXiv · Preprint · ASAP aligns assembly and source representations during training, compresses assembly features into tokens, and supplies them alongside decompiler pseudocode to an LLM refiner. Masking and an assembly-advantage objective encourage the refiner to use low-level evidence.
- [Faultless: A Program Equivalence Technique for Validating and Evaluating Neural Decompilers](https://awesomerea.org/papers/paper-faultless/index.md): 2026 · arXiv · Preprint · Compares neural-decompiler C output with deterministic decompilation or reference functions using symbolic execution and a specialized memory model. It supports both analyst-facing validation and model evaluation without requiring the surrounding codebase.
- [Between the Commits: Process, Error, and Claim Reliability in a Wholly AI-Authored Codebase](https://awesomerea.org/papers/paper-extractor-development-reliability/index.md): 2026 · arXiv · Preprint · Studies development of the Extractor reverse-engineering tool through commits, available session logs and code-provenance tracing. Taxonomies separate instruction intent, change triggers and agent claims, exposing errors corrected before commits that ordinary repository history misses.
- [Echo: Learning-based Matching Decompilation using Trusted Back Translation](https://awesomerea.org/papers/paper-echo-matching-decompilation/index.md): 2026 · arXiv · Preprint · Echo iteratively generates source and compiler configurations, recompiles candidates, and uses assembly differences to guide configuration search and code refinement. It evaluates matching on function benchmarks and selected functions from a Mirai binary.
- [A Memorization Floor for LLM Refinement of Decompiled Code](https://awesomerea.org/papers/paper-memorization-floor/index.md): 2026 · arXiv · Preprint · Studies whether LLM refinement of decompiled C recovers identifiers from input evidence or prior knowledge. Within-item ablations and output-matched chance baselines test naming gains on textbook and newly authored functions, including a second-model replication.
- [When LLM Decompilers Recompile More and Preserve Less](https://awesomerea.org/papers/paper-decompile-diverge/index.md): 2026 · arXiv · Preprint · Decompile-Diverge builds function-level behavioral comparisons from source-derived drivers and fuzzed reference inputs. The study compares reconstructed functions on the same inputs and examines divergences and missing crashes that compilation and supplied tests can miss.
- [Decoupling is a Necessity: Transformation-Agnostic Decompiled Code Recovery under Optimization and Obfuscation](https://awesomerea.org/papers/paper-resource/index.md): 2026 · arXiv · Preprint · ReSource refines decompiled functions affected by compiler optimization and obfuscation. Its stages retrieve guidance from a Semantic Distortion Database, predict a control-flow skeleton, and refine names and formatting. Evaluation measures code similarity and retrieval of the corresponding original function from a source corpus.
- [STILL: Recovering Lowered STL Semantics for LLM-assisted C++ Decompilation](https://awesomerea.org/papers/paper-still-stl/index.md): 2026 · arXiv · Preprint · STILL predicts function-level STL container presence from stripped control-flow graphs and turns those predictions into compact hints for LLM refinement of Ghidra output. StlBench supplies controlled labels for five container classes.
- [The Evolution of Binary Decompilation in the Modern Era: A Taxonomy, Literature Review, and Future Perspectives](https://awesomerea.org/papers/paper-evolution-binary-decompilation/index.md): 2026 · arXiv · Preprint · This survey maps traditional, dynamic, matching and neural decompilation approaches, then organizes type recovery, control-flow restructuring, naming and refinement tasks alongside evaluation metrics and benchmark choices. An accompanying repository provides the reviewed literature list.
- [Lifting Optimized Binaries to Canonical Compiler IR via Structure-Aware Retrieval and Iterative Verification](https://awesomerea.org/papers/paper-bridge-lifting/index.md): 2026 · ACL 2026 · Conference paper · BRIDGE lifts stripped, optimized x86-64 and ARM64 functions, given as llvm-objdump disassembly, to LLVM IR. Its target is the unoptimized IR that a fixed clang -O0 configuration emits for the original source. Offline, it builds a retrieval database from 69,253 ExeBench functions compiled at -O0 to -O3, using LLVM pseudo-probe instrumentation to align assembly fragments with the matching -O0 IR regions. At inference it splits each function's angr-recovered control-flow graph into control-flow segments such as loops and if–else regions, retrieves the three nearest aligned assembly–IR pairs per segment from a FAISS index of Nova-1.3B embeddings, and prompts a hosted general-purpose LLM (DeepSeek-chat) to write the IR. Up to five refinement rounds then feed LLVM verifier and compiler diagnostics and unit-test failures back to the model. On HumanEval-Decompile and MBPP compiled with Clang 19 at -O0 to -O3, average re-executability is 65.2% and 65.4% on x86-64 and 45.6% and 42.1% on ARM64. The rule-based MCTOLL reaches 62.1% and 64.9% on x86-64, and the five directly prompted API LLMs reach at most 21.5%.
- [Fool Me If You Can: On the Robustness of Binary Code Similarity Detection Models against Semantics-Preserving Transformations](https://awesomerea.org/papers/paper-asmfooler/index.md): 2026 · Proceedings of the ACM on Software Engineering (FSE 2026) · Journal article · The paper builds asmFooler to test whether learned binary code similarity detection (BCSD) models keep matching functions after semantics-preserving changes. From 620 baseline x86-64 ELF binaries (coreutils, binutils, PuTTY, nginx, SPEC2006 and others, built with Clang at O0–O3), it generates 9,565 variants using in-place instruction rewriting, basic-block reordering, Obfuscator-LLVM, semantic NOPs and junk code, and it adds a greedy search for dead-code sequences that make dissimilar functions look similar. Across Genius, Gemini, Asm2Vec, SAFE, Trex and BinShot, robustness depends on each model's preprocessing, architecture and features: block reordering drops BinShot's recall from 0.972 to 0.036 but lowers it by under 0.05 for the CFG-based Genius and Gemini. The false-positive attack reaches up to 100% success with 14.75 inserted instructions on average.
- [MirrorCode: AI can rebuild entire programs from behavior alone](https://awesomerea.org/papers/paper-mirrorcode/index.md): 2026 · arXiv · Preprint · Tests reimplementation of 25 command-line programs using execute-only reference access, documentation and visible examples. Separate scoring environments compare exact outputs on visible and held-out end-to-end tests.
- [SoK: AI-Augmented Binary Reversing](https://awesomerea.org/papers/paper-sok-ai-binary-reversing/index.md): 2026 · arXiv · Preprint · A systematization-of-knowledge survey of machine-learning, LLM and agentic approaches to binary reversing. Version 2 collects 246 papers published since 2015, found through keyword searches of 11 security, software-engineering and AI venues plus citation snowballing, and organizes them into 22 domains by inference task: from code-boundary detection and recovery of function names, types and struct layouts to code similarity, malware and vulnerability analysis, and decompilation. Its taxonomy links conventional triage, static, dynamic and security-testing analyses to AI pipelines through the binary-derived artifacts they exchange, and it derives 12 insights and open directions such as binary-aligned ground truth and goal-driven agentic reversing.
- [Binary Decompilation LLM with Feedback-Driven Multi-Turn Refinement](https://awesomerea.org/papers/paper-autodecompiler/index.md): 2026 · arXiv · Preprint · AutoDecompiler trains function-level decompilation models to revise assembly- or pseudocode-derived outputs using compilation, execution and I/O feedback. Its reinforcement-learning design combines diagnostic feedback with rewards for valid code, tested behavior, syntax and data-flow structure.
- [LLM Agent-Assisted Reverse Engineering with Quantitative Readability Metrics](https://awesomerea.org/papers/paper-qrs-readability/index.md): 2026 · arXiv · Preprint · Uses a composite Quantitative Readability Score (QRS) to guide agents refining decompiled C. Lexical familiarity, structural simplicity and coding idioms are combined with a binary-structure similarity gate. Experiments compare refinement with and without shell access on 210 simple C binaries.
- [SCDBench: A Benchmark for LLM-Based Smart Contract Decompilers](https://awesomerea.org/papers/paper-scdbench/index.md): 2026 · arXiv · Preprint · Benchmarks LLM-based EVM decompilation on 600 source-verified Ethereum Solidity contracts, sampled in easy, medium and hard thirds from 772,736 unique bytecode–source pairs after near-duplicate filtering. Each task supplies EVM assembly and optional four-byte selector hints and asks for self-contained Solidity with compiler settings. Outputs are scored in four cumulative stages: format completeness, compilation, ABI recovery, and semantic consistency, where 227,383 recorded test cases for 14,553 public functions are replayed on the recompiled output. With one compiler-feedback repair call, GPT-5.3-Codex compiled 90.3% of contracts, while the best semantic results were 29.4% of functions and 42 of 600 contracts recovered perfectly, both by Claude Opus 4.7.
- [Semantic Validation of Packer Identification Tools: Characterization, Repair, and Downstream Impact](https://awesomerea.org/papers/paper-packer-identification-semantic-validation/index.md): 2026 · arXiv · Preprint · Uses unpacking outcomes as reference evidence to assess packer labels, normalizes heterogeneous tool results, and evaluates complementary signature/heuristic pools with static predicates derived from unpacker implementations. It traces how identification errors affect later unpacking and malware classification.
- [Decaf: Improving Neural Decompilation with Automatic Feedback and Search](https://awesomerea.org/papers/paper-decaf/index.md): 2026 · arXiv · Preprint · Decaf samples multiple candidate decompilations, recompiles them and ranks them using compiler-derived byte distance or a learned reranker. The work studies candidate selection as a way to improve neural decompilation without an iterative source-repair conversation.
- [NotDec: WebAssembly Decompilation With Inter-Procedural Type Recovery](https://awesomerea.org/papers/paper-notdec/index.md): 2026 · ICSE 2026 · Conference paper · NotDec lifts WebAssembly into SSA-based IR, uses Retypd-derived type constraints and pointer/value distinctions to recover structures, and emits C. Its study separates full interprocedural analysis from a faster intraprocedural variant.
- [HELIOS: Hierarchical Graph Abstraction for Structure-Aware LLM Decompilation](https://awesomerea.org/papers/paper-helios/index.md): 2026 · arXiv · Preprint · HELIOS gives an LLM a hierarchical summary of binary control flow and function calls alongside decompiler output, with optional compiler feedback. It evaluates compilability and functional correctness.
- [The Deception Delta: Adversarial Evaluation of LLM-Based Smart Contract Bytecode Forensics](https://awesomerea.org/papers/paper-deception-delta/index.md): 2026 · ACM CCS 2026 · Conference accepted · Evaluates how language models interpret raw EVM bytecode from purpose-built deceptive and control contracts. It distinguishes recognizing a hidden transfer mechanism from correctly judging its risk, using model judges alongside judge-independent checks.
- [SK2Decompile: LLM-based Two-Phase Binary Decompilation from Skeleton to Skin](https://awesomerea.org/papers/paper-sk2decompile/index.md): 2026 · ICLR 2026 · Conference paper · Splits LLM decompilation into two phases: a Structure Recovery model turns decompiler pseudocode into an identifier-free IR that keeps control flow and data structures, trained with compiler-based RL rewards, and an Identifier Naming model then restores names under a semantic-similarity reward. The authors report a 21.6% average re-executability gain over GPT-5-mini on HumanEval and a 29.4% average R2I improvement over Idioms on GitHub2025.
- [ShieldedCode: Learning Robust Representations for Virtual Machine Protected Code](https://awesomerea.org/papers/paper-shieldedcode/index.md): 2026 · ICLR 2026 · Conference paper · ShieldedCode studies software protection from the defender's side: it trains code language models on pairs of C source functions and their virtualization-protected (VMP) x86-64 code so that the models can generate, compare and rank protected variants. Training pairs come from AnghaBench functions compiled at O0–O3, protected at levels L0–L3 by a commercial VMP tool, then disassembled and normalized. The model adds attention masks for dependencies within, between adjacent and across virtual instructions, contrastive objectives for functional equivalence and protection strength, and a protection-effectiveness task that ranks variants of the same source. Continual pre-training starts from CodeLlama 34B and adds The Stack to the corpus, and fine-tuning uses 2.5 million source–VM pairs. On HumanEval-compile, VM code generation reaches 26.95% Pass@1 at level L0 (GPT-4o: 22.58%) and 14.71% at L3. On BinaryCorp-VirtualAssembly similarity detection, Recall@1 for the O0+L1 setting is 0.488, against 0.333 for jTrans with a linear probe. The authors also run a manual reverse-engineering study and pattern-matching and angr attacks on the generated protection.
- [Idioms: A Simple and Effective Framework for Turbo-Charging Local Neural Decompilation with Well-Defined Types](https://awesomerea.org/papers/paper-idioms/index.md): 2026 · NDSS 2026 · Conference paper · Idioms fine-tunes code language models to turn Hex-Rays output for one target function into predicted original C together with definitions of the user-defined structs, unions and typedefs it uses. Input can include neighboring decompiled functions in breadth-first call-graph order, so evidence about a type scattered across callers and callees reaches the model. The authors also build Realtype, 157,163 functions from compiled open-source C repositories with full type definitions. Their CodeGemma-7b-based model passes ExeBench unit tests for 54.4% of functions versus 46.3% for LLM4Decompile and 37.5% for Nova, and scores at least 95% higher on Realtype.
- [FidelityGPT: Correcting Decompilation Distortions with Retrieval Augmented Generation](https://awesomerea.org/papers/paper-fidelitygpt/index.md): 2026 · NDSS 2026 · Conference paper · FidelityGPT post-processes existing decompiler output: an LLM labels lines with six distortion types, such as non-conventional dereferencing, redundant variables and confusing control flow, and then rewrites the labeled lines. Its prompts define the distortion types and add retrieval-augmented context from a manually annotated database of distorted IDA Pro and Ghidra lines. A semantic-intensity algorithm chooses which lines to query, and a variable-dependency analysis carries redundant-variable context across 50-line chunks. On 620 function pairs, the authors report 89% detection accuracy and 83% precision, and correction fix rates of 94% (FR) and 64% (CFR) against 83% and 37% for their DeGPT runs.
- [CHISEL-ing Back Source Code with AI-enabled Iterative Recovery](https://awesomerea.org/papers/paper-chisel-iterative-recovery/index.md): 2026 · SURE @ ACM CCS 2026 · Conference accepted · CHISEL refines Ghidra pseudocode using compiler diagnostics and type-aware differential fuzzing against the original function. It retains counterexamples and candidate history; existing I/O pairs are held out for evaluation rather than supplied to the recovery loop.
- [REx86: A Local Large Language Model for Assisting in x86 Assembly Reverse Engineering](https://awesomerea.org/papers/paper-rex86/index.md): 2025 · 2025 IEEE Annual Computer Security Applications Conference (ACSAC) · Conference paper · The paper fine-tunes eight local models from CodeLlama, Qwen2.5-Coder, and CodeGemma on 5,981 x86 assembly examples and evaluates their help with binary reverse engineering.
- [Is This the Same Code? A Comprehensive Study of Decompilation Techniques for WebAssembly Binaries](https://awesomerea.org/papers/paper-wasm-decompiler-study/index.md): 2025 · SecureComm 2024 · Conference paper · Measures how well existing WebAssembly decompilers recover C, with native-binary decompilers as the baseline. The same C programs are compiled with Emscripten to WebAssembly and with clang to native code, then decompiled by wasm2c, w2c2 and wasm-decompile or by Ghidra and RetDec. Correctness reuses 1,000 Csmith programs from DecFuzzer, recompiling the output and comparing its execution with the original; code-complexity metrics and AST similarity to the original source are measured on PolyBenchC and CHStone at -O0 to -O2. wasm2c passed all 1,000 correctness programs, against 649 for wasm-decompile, 818 for Ghidra and 775 for RetDec.
- [BinMetric: A Comprehensive Binary Code Analysis Benchmark for Large Language Models](https://awesomerea.org/papers/paper-binmetric/index.md): 2025 · IJCAI 2025 · Conference paper · BinMetric poses 1,000 questions across six binary-analysis tasks: call-site reconstruction, decompilation, signature recovery, binary code summarization, algorithm classification and assembly instruction generation. The questions come from 20 open-source C projects compiled for x86-64, stripped and processed with IDA Pro, and aligned with source code through DWARF information. The authors evaluate 12 LLMs from five model families with one-shot prompts, alongside IDA Pro’s decompiler, LLM4Decompile, BinT5 and HexT5 where those apply.
- [Exploring the Potential of LLMs for Code Deobfuscation](https://awesomerea.org/papers/paper-llm-code-deobfuscation/index.md): 2025 · DIMVA 2025 · Conference paper · Studies LLMs as source-to-source deobfuscators for C functions protected with the Tigress obfuscator. Functions from ExeBench, with identifiers randomized, are obfuscated with five transformations: MBA arithmetic encoding, branch encoding, control-flow flattening, opaque predicates and argument randomization. Each model receives a whole obfuscated function and returns simplified C. DeepSeek Coder 6.7B and Code Llama 7B are fine-tuned on obfuscated–original pairs, GPT-4 is prompted, and Clang optimization at -O0 to -O3 serves as a compiler baseline. Simplification is scored with Halstead program length relative to the original and obfuscated code, syntactic correctness by compiling ExeBench wrappers and semantic correctness by ExeBench input/output samples. The fine-tuned models reduce complexity more than GPT-4 on every transformation and more than Clang except on arithmetic encoding and argument randomization, where Clang is on par. Trained on chains of up to five transformations, they keep stable scores on chains of six and seven, and the best model cuts Halstead program length by 89.21% on average in the hardest scenario. A test with randomized constants found one sample that reproduced memorized code.
- [DecompileBench: A Comprehensive Benchmark for Evaluating Decompilers in Real-World Scenarios](https://awesomerea.org/papers/paper-decompilebench/index.md): 2025 · Findings of ACL 2025 · Conference paper · Evaluates traditional and LLM-based decompilers using functions from real programs, runtime behavioral checks, and an LLM-assisted assessment of analyst-facing code understandability.
- [Decompiling Smart Contracts with a Large Language Model](https://awesomerea.org/papers/paper-llm-evm-decompiler/index.md): 2025 · arXiv · Preprint · Converts Ethereum Virtual Machine bytecode into Solidity in two stages. Static analysis first lifts the bytecode into three-address code with recovered control flow; a Llama-3.2-3B model fine-tuned with LoRA on 238,446 TAC-to-Solidity function pairs then writes each function. On 9,731 held-out functions from verified Ethereum contracts, the authors report average semantic similarity of 0.82 to the original source, with 78.3% of functions above 0.8. An ablation compares the untuned base model on 663 functions, and case studies decompile an unverified Dx Protocol contract and an exploited MEV bot.
- [DecLLM: LLM-Augmented Recompilable Decompilation for Enabling Programmatic Use of Decompiled Code](https://awesomerea.org/papers/paper-decllm/index.md): 2025 · Proceedings of the ACM on Software Engineering (ISSTA 2025) · Journal article · DecLLM repairs decompiler pseudocode that does not recompile into C that compiles and runs, so source-level tools such as CodeQL can be applied to binaries. An iterative loop feeds compiler errors to an off-the-shelf LLM, reverting illegal outputs and large deletions, then uses mismatched test outputs and AddressSanitizer reports from the rebuilt program to repair behavior, and finally fuzzes the original and rebuilt executables for divergences. With GPT-3.5 and GPT-4 the authors report 74% and 78.3% success on 300 Code Contest programs; on Coreutils and CGC binaries, 61.9–70.9% recompile and 48.1–59.0% are fully functional.
- [DiSCo: Towards Decompiling EVM Bytecode to Source Code using Large Language Models](https://awesomerea.org/papers/paper-disco/index.md): 2025 · Proceedings of the ACM on Software Engineering (FSE 2025) · Journal article · DiSCo lifts Ethereum contract creation bytecode to Solidity source by prompting a frozen LLM, instead of emitting decompiler pseudocode. It abstracts control-flow paths into logic-invariant semantic units, recovers constructor logic by simulating creation bytecode captured from block execution, and infers stripped names with signature databases and a type-aware graph model. These units become natural-language descriptions plus coding specifications in the prompt. GPT-4 is the primary model; Llama 3 is also tested.
- [D-LiFT: Improving LLM-based Decompiler Backend via Code Quality-driven Fine-tuning](https://awesomerea.org/papers/paper-d-lift/index.md): 2025 · arXiv · Preprint · D-LIFT uses D-Score to guide LLM fine-tuning and output selection, improving decompiled code while prioritizing accuracy. It evaluates Ghidra output from coreutils and util-linux.
- [ReF Decompile: Relabeling and Function Call Enhanced Decompile](https://awesomerea.org/papers/paper-ref-decompile/index.md): 2025 · arXiv · Preprint · ReF Decompile relabels jump targets and uses function calls to recover variable information when converting binary code to source code. It was evaluated on the HumanEval-Decompile Benchmark.
- [Unleashing the Power of Generative Model in Recovering Variable Names from Stripped Binary](https://awesomerea.org/papers/paper-gennm/index.md): 2025 · NDSS 2025 · Conference paper · GenNm suggests names for placeholder variables in decompiled code of stripped binaries by fine-tuning generative code models (CodeGemma-2B by default; CodeLlama-7B and a LoRA-tuned CodeLlama-34B are also tested). Queries add renamed caller code and callee signatures propagated along the call graph; a DPO-style symbol-preference optimization (SymPO) counters bias toward frequent training names, and a data-flow name-validation step chooses among candidates over iterative rounds. The authors report 5.6–11.4-point precision gains over VarBERT and ReSym on rebuilt DIRTY and VarCorpus datasets, and 22.8% precision on names unseen in training against 17.3% for the strongest baseline.
- [TypeForge: Synthesizing and Selecting Best-Fit Composite Data Types for Stripped Binaries](https://awesomerea.org/papers/paper-typeforge/index.md): 2025 · IEEE S&P 2025 · Conference paper · TypeForge recovers composite data types, including struct layouts, unions and pointer or nesting relationships, from stripped binaries. A whole-program Type Flow Graph over Ghidra’s decompiler-inferred variables propagates member offsets and sizes, cuts conflicting edges caused by casts and unions, and synthesizes candidate type declarations. An LLM only selects among these statically synthesized candidates: each is applied through the decompiler’s retype interface, and a double-elimination tournament compares the resulting pseudocode for readability. On OSPREY’s coreutils dataset the authors report F1 of 81.7% for composite-type identification, 88.2% for layout recovery and 72.1% for relationship recovery.
- [Nova: Generative Language Models for Assembly Code with Hierarchical Attention and Contrastive Learning](https://awesomerea.org/papers/paper-nova/index.md): 2025 · ICLR 2025 · Conference paper · Nova is a generative LLM for x86-64 assembly, trained from DeepSeek-Coder checkpoints on stripped, normalized gcc -O0 to -O3 assembly built from AnghaBench and The Stack. It adds hierarchical attention that builds per-instruction summaries, and contrastive objectives that keep a function's source and O0–O3 assembly close while ordering them by optimization level. Fine-tuned for decompilation, Nova-1.3B and Nova-6.7B reach 25.17% and 34.36% average Pass@1 on HumanEval-Decompile, 14.84 and 12.41 points above same-size LLM4Decompile; separately fine-tuned models report the highest average Recall@1 for O0-to-O3 binary code similarity on six real-world projects.
- [Malsight: Exploring Malicious Source Code and Benign Pseudocode for Iterative Binary Malware Summarization](https://awesomerea.org/papers/paper-malsight/index.md): 2025 · IEEE Transactions on Information Forensics and Security · Journal article · MALSIGHT writes natural-language summaries of stripped binary malware one function at a time. IDA Pro produces pseudocode and a call graph, and functions are summarized callees first, so each caller receives its callees' summaries as context; a sequence-labeling model also marks key API calls and strings, which drive code-search retrieval and LLM-written annotations. The summarizer, MalT5, is a 0.77B-parameter CodeT5+ model fine-tuned first on MalS, 89,609 malicious C source functions from GitHub with LLM-generated summaries refined by human reviewers, and then on annotated benign pseudocode from the Capybara dataset. The authors also introduce MalP, 500 pseudocode functions for testing, and BLEURT-sum, a fine-tuned BLEURT metric, and report that MalT5 performs comparably to much larger Code Llama models.
- [Lares: LLM-driven Code Slice Semantic Search for Patch Presence Testing](https://awesomerea.org/papers/paper-lares/index.md): 2025 · ASE 2025 · Conference paper · Lares tests whether a known 1-day vulnerability fix is present in a target binary function without recompiling the project. Its inputs are the target binary, the project source and the patch commit diff. A patch-enhancement step adds data- and control-flow context from the source (via Tree-sitter and Joern) to patches with few changed statements. An LLM then locates the pseudocode slice in the IDA Pro decompilation of the target function that corresponds to each patch slice. Finally, matched slices are normalized into equations and checked for equivalence with the Z3 SMT solver, and the LLM judges the cases Z3 cannot model, deciding whether the function matches the pre-patch or the patched version. On 4,480 test cases from 73 CVEs in OpenSSL, FreeType, tcpdump and libxml2, compiled with GCC 9.4.0 and Clang 6 at O0–O3 for x86, x64 and ARM, the authors report an average F1 of 0.77 on x86 with Claude 3.5 Sonnet, against 0.67 for Robin and 0.68 for PS3, and F1 from 0.71 to 0.77 across five compiler–architecture settings.
- [Decompile-Bench: Million-Scale Binary-Source Function Pairs for Real-World Binary Decompilation](https://awesomerea.org/papers/paper-decompile-bench/index.md): 2025 · NeurIPS 2025 Datasets and Benchmarks · Conference paper · Introduces two million C/C++ binary-source function pairs using a Compile-Trace-Filter pipeline, with an evaluation suite spanning translated HumanEval/MBPP tasks and recent GitHub functions.
- [Beyond Classification: Inferring Function Names in Stripped Binaries via Domain Adapted LLMs](https://awesomerea.org/papers/paper-symgen/index.md): 2025 · NDSS 2025 · Conference paper · SymGen infers function names for stripped binaries by generating them with a LoRA-fine-tuned Code Llama model instead of classifying over a fixed name vocabulary. Ghidra decompiles each stripped function, its own name is masked, and callee names are normalized for deduplication. Before fine-tuning, the model is domain-adapted on decompiled code paired with LLM-generated summaries of the matching source functions. On functions from 33 C projects built for x86-64, x86-32, ARM and MIPS at O0–O3, deduplicated from 2,237,915 to 495,494, the authors report average word-level F1 of 0.277 (0.380 on x86-64), plus case studies on obfuscated binaries and Linux malware.
- [ReSym: Harnessing LLMs to Recover Variable and Data Structure Symbols from Stripped Binaries](https://awesomerea.org/papers/paper-resym/index.md): 2024 · ACM CCS 2024 · Conference paper · Combines two fine-tuned language models with Prolog-based cross-function reasoning to infer local-variable symbols and user-defined data structures from stripped-binary decompilation.
- [Self-Constructed Context Decompilation with Fined-grained Alignment Enhancement](https://awesomerea.org/papers/paper-sc2dec/index.md): 2024 · Findings of EMNLP 2024 · Conference paper · Adds two techniques to LLM decompilation of function-level x86-64 GCC assembly into C. Self-Constructed Context Decompilation (sc²dec) recompiles a model’s first compilable output and uses the resulting assembly–source pair as an in-context example for a second attempt, without fine-tuning. Fine-grained Alignment Enhancement (FAE) fine-tunes llm4decompile-6.7b with LoRA on statement-level assembly–C alignments derived from DWARF debug information. Combining both, the authors report 52.41% average re-executability on Decompile-Eval, against 48.60% for the base model.
- [LLM4Decompile: Decompiling Binary Code with Large Language Models](https://awesomerea.org/papers/paper-llm4decompile/index.md): 2024 · EMNLP 2024 · Conference paper · Trains language models for assembly-to-C decompilation and for refining Ghidra pseudocode, evaluating whether recovered functions can be recompiled and executed correctly.
- [WaDec: Decompiling WebAssembly Using Large Language Model](https://awesomerea.org/papers/paper-wadec/index.md): 2024 · ASE 2024 · Conference paper · WaDec decompiles WebAssembly text (wat) into C by fine-tuning CodeLlama-7b with LoRA on loop-level wat–C snippet pairs. Functions are ordered by dependency and sliced so that each input holds at most one loop, with nested loops replaced by markers. Prompts add declarations of called functions, previously defined local variables and offset-to-string mappings; the outputs are then reassembled, with string constants restored and variables renamed. Training data come from 51,768 the-stack-dedup and 377 TheAlgorithms/C programs compiled with Emscripten. On 3,977 C files, the authors report 3.34% code inflation, 52.11% recompilability, 43.55% re-execution and 27.15% output consistency, compared with Wasm2c and Ghidra.
- [How Far Have We Gone in Binary Code Understanding Using Large Language Models](https://awesomerea.org/papers/paper-llm-binary-understanding/index.md): 2024 · ICSME 2024 · Conference paper · Benchmarks 16 code and general LLMs on function name recovery and summarization of stripped binaries. The benchmark takes 12 popular C projects built for x86-64, strips and decompiles 28 binaries with IDA Pro, aligns 81,185 functions with source through DWARF, and keeps 2,000 functions after expert review. Zero-shot LLMs are compared with SymLM, NER, BinT5 and HexT5. Code Llama 34B leads name recovery with token-level F1 of 27.59, and ChatGPT leads summarization with BLEU-4 7.37. The study also measures few-shot prompting, LoRA fine-tuning of two 7B models on GNU binaries, and a case study on a stripped open-source Linux remote-access trojan.
- [CLAP: Learning Transferable Binary Code Representations with Natural Language Supervision](https://awesomerea.org/papers/paper-clap/index.md): 2024 · ACM ISSTA 2024 · Conference paper · CLAP (Contrastive Language-Assembly Pre-training) learns assembly-function embeddings aligned with natural-language explanations. A dataset engine compiles Ubuntu C/C++ packages with GCC and Clang at O0–O3 and Os, has GPT-3.5 explain about 2.6 million matching source functions, and fine-tunes a Vicuna-13B “shadow model” on half of those explanations to label more code, yielding 195 million assembly–explanation pairs. A 110M-parameter assembly encoder, using address rebasing, a WordPiece tokenizer and jump-aware embeddings, is first pre-trained on assembly and then contrastively aligned with a text encoder. The embeddings support zero-shot classification by matching code against text prompts. On BinaryCorp-3M similarity search in pools of 10,000 functions, zero-shot CLAP reports 0.836 average recall@1 against 0.571 for fine-tuned jTrans.
- [TYGR: Type Inference on Stripped Binaries using Graph Neural Networks](https://awesomerea.org/papers/paper-tygr/index.md): 2024 · USENIX Security 2024 · Conference paper · TYGR infers the types of stack and heap variables in stripped binaries by running an architecture-agnostic, intra-procedural data-flow analysis on angr's VEX IR and classifying each variable's data-flow graph with a graph neural network. It predicts base types, pointers and struct member layouts, covering 97.1% of the types observed in its data. The authors also build TyDa, 163,643 binaries compiled with debug information from Gentoo and Debian C packages for x86, x64, AArch64, Arm32 and MIPS at O0–O3, and deduplicate functions in the evaluated subset before splitting it. On x64 across O0–O3 they report 76.6% overall and 45.2% struct accuracy, and say TYGR beats prior work by at least 26.1% overall and 10.2% on structs.
- [D-Helix: A Generic Decompiler Testing Framework Using Symbolic Differentiation](https://awesomerea.org/papers/paper-d-helix/index.md): 2024 · USENIX Security 2024 · Conference paper · Tests decompilers function by function on binaries without needing source code. RECOMPILER repairs decompiled C so individual functions recompile, SYMDIFF compares symbolic models of the original binary function and the recompiled decompiled function using patched angr and PROMPT symbolic executors, and TUNER toggles decompiler heuristic rules to locate, and sometimes work around, the rule behind an inaccuracy. On Ghidra 10.0 and angr 9.2.30, 2,004 binaries and object files from coreutils, util-linux and six popular GitHub C projects yield 93K decompiled functions; the authors report 4,515 incorrectly decompiled functions, 8 reproduced known bugs, 17 previously unknown bugs and 7 bugs fixed automatically.
- [Code is not Natural Language: Unlock the Power of Semantics-Oriented Graph Representation for Binary Code Similarity Detection](https://awesomerea.org/papers/paper-hermessim/index.md): 2024 · USENIX Security 2024 · Conference paper · HermesSim detects binary code similarity by lifting each function to Ghidra P-code and building a semantics-oriented graph that exposes operand structure inside instructions, def-use, control-flow and effect-order relations, while dropping semantics-independent details such as which register temporarily holds a value. A gated graph neural network with a multi-head softmax aggregator embeds the graph, and functions are compared by embedding similarity. On the Dataset-1 benchmark of Marcelli et al., the authors report 48.1% RECALL@1 for x64 cross-compiler retrieval in pools of 10,000 functions, against 31.4% for a fine-tuned jTrans, with a 388K-parameter model.
- [A Taxonomy of C Decompiler Fidelity Issues](https://awesomerea.org/papers/paper-decompiler-fidelity-taxonomy/index.md): 2024 · USENIX Security 2024 · Conference paper · Open-codes decompiled/original C function pairs to classify how decompiler output departs from the source beyond missing names and types. Using a statement-alignment abstraction and thematic analysis, the authors build a hierarchical codebook of 15 top-level categories and 52 codes, covering correctness issues such as nonequivalent expressions and incorrect return behavior and readability issues such as extraneous variables, non-idiomatic control flow and decompiler-specific macros. The codebook, developed on Hex-Rays output, is applied to Ghidra, retdec and angr, and the authors suggest type prediction, rule-based fixes and whole-program learned techniques to address classes of defects.
- [CodeArt: Better Code Models by Attention Regularization When Symbols Are Lacking](https://awesomerea.org/papers/paper-codeart/index.md): 2024 · Proceedings of the ACM on Software Engineering (FSE 2024) · Journal article · CodeArt pre-trains a BERT-sized encoder from scratch on 26 million stripped x86-64 functions built from jTrans's BinaryCorp. Instead of relying on symbols, it uses IDA Pro control-flow graphs and a binary data-flow analysis to compute control and data dependences, then restricts self-attention with masks so a token attends only to instructions it transitively depends on or that depend on it, to tokens in its own instruction, and to a global [CLS] token; pre-training masks tokens and perturbs the dependence graph. The authors fine-tune it for binary similarity, malware family classification and type inference. They report improvements over prior models from 53% to 64% recall@1 for similarity in pools of 500, from 49% to 60% LRAP for malware families, and from 74% to 94% average F1 for type inference.
- [StackSight: Unveiling WebAssembly through Large Language Models and Neurosymbolic Chain-of-Thought Decompilation](https://awesomerea.org/papers/paper-stacksight/index.md): 2024 · ICML 2024 · Conference paper · StackSight decompiles WebAssembly text-format functions into C++ with LLM prompting. A static analysis annotates each WAT instruction with the virtual-stack state, using symbolic notation where branches diverge; a one-shot chain-of-thought prompt then asks the model to recover variable meanings, summarize the function and write C++. With GPT-4 the share of outputs passing all benchmark tests rises from 19.7% to 36.5% on HumanEval-X and from 42.4% to 59.6% on MBXP relative to one-shot prompting; GPT-3.5 and Code Llama-7B-Instruct are also evaluated.
- [STRIDE: Simple Type Recognition In Decompiled Executables](https://awesomerea.org/papers/paper-stride/index.md): 2024 · arXiv · Preprint · STRIDE predicts the names and types of variables in decompiler output without a neural model. From training decompilation with known labels, it builds a database mapping the token sequences (N-grams, with N from 2 to 60) immediately left and right of each variable occurrence to the five most frequent names or types. Variable placeholders are canonicalized, and address-like tokens and large constants are bucketed so that N-grams can match. At prediction time it looks up the longest matching N-gram on each side of every occurrence, scores the returned labels by how specific the match is, and sums the scores across the function. The prototype is about 1,000 lines of Python and runs on a CPU. On DIRT functions not seen in training, the authors report 66.4% retyping accuracy, against 52.3% for DIRTY with beam search, and 56.2% renaming accuracy, against 51.3% reported for VarBERT. Across 16 VarCorpus splits, renaming accuracy is higher than VarBERT on 11 and 1.55 points higher on average. Prediction takes 8.2 ms per function on a CPU, against 43.7 ms for VarBERT on an NVIDIA L4 GPU.
- [Exploring the Efficacy of Large Language Models (GPT-4) in Binary Reverse Engineering](https://awesomerea.org/papers/paper-gpt4-binary-re/index.md): 2024 · arXiv · Preprint · The paper evaluates GPT-4 for binary reverse engineering through interpretation of human-written and decompiled code, from basic code explanation to malware analysis.
- [Assessing LLMs in Malicious Code Deobfuscation of Real-world Malware Campaigns](https://awesomerea.org/papers/paper-llm-malware-deobfuscation/index.md): 2024 · arXiv · Preprint · The paper evaluates four LLMs on deobfuscating real-world malicious scripts from the Emotet malware campaign and examines their use in reverse engineering.
- [Cross-Inlining Binary Function Similarity Detection](https://awesomerea.org/papers/paper-cross-inlining-bfsd/index.md): 2024 · ICSE 2024 · Conference paper · Studies binary function similarity when function inlining makes one binary function correspond to several source functions. From BinKit builds of 51 GNU projects with and without -fno-inline (9 GCC and Clang versions, O0–O3, six x86, ARM and MIPS targets; 216 combinations each), debug-line mappings label 5,621,140 cross-inlining pairs. The authors identify Leaf-, Root- and Internal-Inlining patterns, show that Gemini, SAFE and GMN lose accuracy on them, and propose CI-Detector, which trains one attributed-CFG graph neural network per pattern and aggregates their scores, reporting 81% precision and 97% recall.
- [BinaryAI: Binary Software Composition Analysis via Intelligent Binary Source Code Matching](https://awesomerea.org/papers/paper-binaryai/index.md): 2024 · ICSE 2024 · Conference paper · BinaryAI identifies which open-source C/C++ libraries a stripped binary reuses by matching its functions to source code. Ghidra decompiles each binary function to pseudo-C, and a Pythia-410M model, trained with a CLIP-style contrastive loss on about 10 million binary–source function pairs, embeds pseudo-code and source functions in one space. Candidates retrieved from a corpus of 56,342,179 source functions from 12,013 libraries are refined with link-time locality and the call graph, and a library is reported when the share of its matched functions exceeds a threshold. The authors report 22.54% recall@1 against 10.75% for CodeCMR, and library-detection precision and recall of 85.84% and 64.98% against 73.36% and 59.81% for an unnamed commercial tool.
- [FoC: Figure out the Cryptographic Functions in Stripped Binaries with LLMs](https://awesomerea.org/papers/paper-foc/index.md): 2024 · arXiv · Preprint · FoC uses FoC-BinLLM to summarize cryptographic functions in stripped binaries and FoC-Sim to retrieve similar implementations. It evaluates both models and applications to virus analysis and 1-day vulnerability detection.
- [SLaDe: A Portable Small Language Model Decompiler for Optimized Assembly](https://awesomerea.org/papers/paper-slade/index.md): 2024 · IEEE/ACM CGO 2024 · Conference paper · SLaDe translates function-level assembly into C with a 200M-parameter encoder–decoder model, code-specific tokenization and PsycheC type completion. It studies x86 and ARM at -O0 and -O3, combining generated candidates with input/output checks. The input is assembly text, not raw machine bytes; disassembly is outside the method.
- [CEBin: A Cost-Effective Framework for Large-Scale Binary Code Similarity Detection](https://awesomerea.org/papers/paper-cebin/index.md): 2024 · arXiv · Preprint · CEBin combines code embeddings to shortlist candidate functions with pairwise comparison to detect similar binary code, including vulnerable functions.
- [“Len or index or count, anything but v1”: Predicting Variable Names in Decompilation Output with Transfer Learning](https://awesomerea.org/papers/paper-varbert/index.md): 2024 · IEEE S&P 2024 · Conference paper · VarBERT suggests variable names for IDA Hex-Rays and Ghidra decompiler output with a BERT-style model pre-trained on 5.2M human-written C functions from Debian and fine-tuned on decompiled code; it also predicts whether each variable came from the developer or was introduced by the decompiler. The authors build VarCorpus from Gentoo C and C++ packages compiled for x86-64 at O0–O3, labeling decompiled variables from debug symbols. On per-function splits of O2 binaries, top-1 accuracy is 54.43% for IDA and 54.49% for Ghidra; on an IDA-O0 subset it reaches 50.70%, against 35.94% for DIRE and 38.00% for DIRTY.
- [DeGPT: Optimizing Decompiler Output with LLM](https://awesomerea.org/papers/paper-degpt/index.md): 2024 · NDSS 2024 · Conference paper · Refines existing C-like decompiler output through three coordinated roles that select, propose and check changes. It simplifies structures, adds comments and renames variables; Micro Snippet Semantic Calculation compares simulated symbol values and calls before accepting structural changes. The authors evaluate readability and naming on 620 functions from four codebases, with separate stripped and non-stripped variants.
- [Assemblage: Automatic Binary Dataset Construction for Machine Learning](https://awesomerea.org/papers/paper-assemblage/index.md): 2024 · NeurIPS 2024 Datasets and Benchmarks · Conference paper · Assemblage is a distributed system that crawls GitHub and vcpkg, builds C/C++ projects under many compiler configurations, and records source-to-binary mappings such as function addresses, source code, comments and PDB or DWARF debug information. Run on AWS for about a year, it produced 890k Windows PE binaries built with Visual Studio 2015–2022 across optimization levels, architectures and Debug/Release modes, plus 428k Linux ELF binaries from GCC and Clang, in 29 configurations. Case studies use the data for compiler provenance with PassTell, function similarity with a graph neural network and jTrans, and function-boundary identification comparing XDA with IDA.
- [Binary Code Summarization: Benchmarking ChatGPT/GPT-4 and Other Large Language Models](https://awesomerea.org/papers/paper-binsum/index.md): 2023 · arXiv · Preprint · BinSum benchmarks LLMs on summarizing binary functions in natural language. The authors compile 44 GNU projects with GCC 7.5 for x86, x64, ARM and MIPS at -O0 to -O3, match 557,664 binary functions to developer comments as reference summaries, and present each function as raw bytes, assembly, IDA microcode or decompiled code with and without symbols. GPT-4, ChatGPT, Llama 2 and Code Llama receive prompts selected from 320 GPT-4-generated candidates, with the fine-tuned BinT5 as a baseline; outputs are scored by embedding similarity alongside BLEU, METEOR and ROUGE-L. Decompiled code is the most useful representation, and stripping symbols lowers the average similarity score from 0.449 to 0.202.
- [Refining Decompiled C Code with Large Language Models](https://awesomerea.org/papers/paper-dec-gpt/index.md): 2023 · arXiv · Preprint · The paper proposes a two-step hybrid LLM approach to refine IDA-Pro decompiled C code for recompilation. On popular C test cases, it reports a recompilation success rate above 75% with moderate effort.
- [kTrans: Knowledge-Aware Transformer for Binary Code Embedding](https://awesomerea.org/papers/paper-ktrans/index.md): 2023 · arXiv · Preprint · kTrans uses a knowledge-aware Transformer to embed binary code. It evaluates the embeddings through outlier detection and visualization, and on binary code similarity, function type recovery, and indirect call recognition.
- [Decompiling x86 Deep Neural Network Executables](https://awesomerea.org/papers/paper-btd/index.md): 2023 · USENIX Security 2023 · Conference paper · BTD (Bin to DNN) decompiles stripped 64-bit x86 executables emitted by deep-learning compilers into model specifications: operator types, network topology, dimensions and parameters. A learned classifier labels disassembled functions as DNN operators, Intel Pin dynamic analysis chains them, and taint-reduced, trace-based symbolic execution with per-operator patterns recovers dimensions and parameter layouts. The authors rebuild recovered models in PyTorch and recompile them to compare behaviour with the original executable.
- [XFL: Naming Functions in Binaries with Extreme Multi-label Learning](https://awesomerea.org/papers/paper-xfl/index.md): 2023 · IEEE S&P 2023 · Conference paper · XFL treats function naming in stripped binaries as extreme multi-label classification: names are split into tokens, and PfastreXML ranks which tokens from a vocabulary of frequent labels fit each function. Its DEXTER embedding combines static-analysis features built on angr’s VEX IR with call-graph and whole-binary context, and a separate language model orders predicted tokens into a name string. On 741,724 functions from 10,047 x86-64 C binaries in Debian packages, with a 1,024-label vocabulary, the authors report precision 0.835, recall 0.575 and F1 0.681, ahead of Punstrip, Debin and Nero in precision and F1.
- [Revisiting Binary Code Similarity Analysis Using Interpretable Feature Engineering and Lessons Learned](https://awesomerea.org/papers/paper-binkit/index.md): 2023 · IEEE Transactions on Software Engineering · Journal article · Builds BinKit, a reproducible cross-compilation benchmark of 243,128 binaries and 36,256,322 functions from 51 GNU packages, covering 1,352 combinations of eight architectures, nine GCC and Clang versions, five optimization levels, and PIE, LTO, no-inline and Obfuscator-LLVM options. TikNib, an interpretable baseline over simple presemantic function features, measures how compilers, options and architectures change those features. The authors report that a few basic features approach a deep-learning tool’s accuracy, that type features push AUC above 0.99, and trace failures to IDA Pro analysis errors, compiler back-end differences and architecture-specific code.
- [Asteria-Pro: Enhancing Deep-Learning Based Binary Code Similarity Detection by Incorporating Domain Knowledge](https://awesomerea.org/papers/paper-asteria-pro/index.md): 2023 · arXiv · Preprint · Asteria-Pro adds domain-knowledge pre-filtration and re-ranking to Tree-LSTM-based binary code similarity detection. It evaluates firmware vulnerability search across diverse IoT hardware architectures.
- [SymLM: Predicting Function Names in Stripped Binaries via Context-Sensitive Execution-Aware Code Embeddings](https://awesomerea.org/papers/paper-symlm/index.md): 2022 · ACM CCS 2022 · Conference paper · SymLM predicts function names for stripped binaries as sets of name words. It encodes each function’s instructions with a Trex model pretrained on micro-execution traces, fuses them with embeddings of callers, internal callees and external library calls taken from Ghidra’s interprocedural CFG, and scores words from a fixed vocabulary with an MLP decoder; name preprocessing and a word-embedding module, CodeWordNet, handle abbreviations and synonyms. On 1,431,169 functions from 16,027 binaries of 27 projects across x86, x64, ARM and MIPS, O0–O3 and four Hikari obfuscations, the authors report weighted average precision 0.634, recall 0.677 and F1 0.655, plus a firmware case study.
- [How Machine Learning Is Solving the Binary Function Similarity Problem](https://awesomerea.org/papers/paper-binary-function-similarity/index.md): 2022 · USENIX Security 2022 · Conference paper · Measures binary function similarity research by re-implementing ten representative approaches from the security, programming-language and machine-learning communities in one IDA Pro-based framework, from fuzzy hashing (Catalog1, FunctionSimSearch) to graph neural network, NLP-encoder and transformer models. Two new datasets support six tasks that vary optimization, compiler, bitness and architecture, scored by AUC and ranking metrics, plus a firmware vulnerability-search case. The authors report that fuzzy hashing fails in harder cross-architecture settings, GNN-based models perform best in almost all tasks, and many recent models score similarly on common data.
- [DeepDi: Learning a Relational Graph Convolutional Network Model on Instructions for Fast and Accurate Disassembly](https://awesomerea.org/papers/paper-deepdi/index.md): 2022 · USENIX Security 2022 · Conference paper · DeepDi disassembles x86 and x64 binaries by decoding a superset of candidate instructions, linking them in an Instruction Flow Graph of forward, backward and overlap relations, and classifying true instructions with a Relational Graph Convolutional Network; heuristics and a small classifier then recover function entry points. On BAP corpora, LLVM 11 built with MSVC on Windows, and SPEC CPU2006 and CPU2017, the authors report accuracy comparable or superior to IDA Pro, Binary Ninja, Ghidra, Datalog Disassembly and XDA, robustness on Linn–Debray and Hikari obfuscated binaries, single-core CPU throughput of 146 KB/s (about twice IDA Pro) and GPU throughput of 24.5 MB/s (about 350 times IDA Pro).
- [Decomperson: How Humans Decompile and What We Can Learn From It](https://awesomerea.org/papers/paper-decomperson/index.md): 2022 · USENIX Security 2022 · Conference paper · Reframes manual reverse engineering as perfect decompilation: writing source that, compiled with the original toolchain and options, reproduces the target functions’ binary code exactly. The authors built Decomperson, a web editor that compiles, disassembles, tests and diffs each submission, and used it in Decompetition, a 24-hour Jeopardy-style competition in November 2020 with 23 unstripped challenge binaries written in C, C++, Go, Rust and Swift. Over 150 participants made more than 35,000 submissions, including over 300 perfect ones; all but one challenge was perfectly decompiled, and the recorded edit histories are analyzed to describe how humans decompile.
- [Augmenting Decompiler Output with Learned Variable Names and Types](https://awesomerea.org/papers/paper-dirty/index.md): 2022 · USENIX Security 2022 · Conference paper · Introduces DIRTY, a Transformer model that recommends variable names and types from decompiled code and layout information, together with the DIRT corpus for training and evaluation.
- [jTrans: Jump-Aware Transformer for Binary Code Similarity Detection](https://awesomerea.org/papers/paper-jtrans/index.md): 2022 · ACM ISSTA 2022 · Conference paper · jTrans embeds binary functions for similarity search with a BERT-style Transformer. Its jump-aware representation shares parameters between a direct jump’s operand token and the positional embedding of the jump target, so control flow enters the instruction sequence without a separate graph network. The model is pre-trained with masked language modeling and jump-target prediction, then fine-tuned with a cosine triplet objective on functions compiled from the same source at different optimization levels. The paper also introduces BinaryCorp, built by compiling C/C++ packages from Arch Linux’s official repositories and the AUR with gcc and g++.
- [ExeBench: an ML-scale dataset of executable C functions](https://awesomerea.org/papers/paper-exebench/index.md): 2022 · ACM SIGPLAN MAPS 2022 · Conference paper · ExeBench is a dataset, not a decompiler. It extracts C functions from GitHub and AnghaBench, makes them compilable by locating real headers and definitions or injecting synthetic ones, and generates input/output examples from function signatures with a C++ wrapper that runs each function. After exact deduplication the authors report 4,485,817 compilable and 687,843 executable functions, of which 124,612 have rich IO that a constant or identity implementation cannot pass; the paper also describes x86 and ARM assembly at O0, Os and Ofast for each row. Decompilation studies such as SLaDe and LLM4Decompile later used it to test whether decompiled functions re-execute correctly.
- [Elipmoc: Advanced Decompilation of Ethereum Smart Contracts](https://awesomerea.org/papers/paper-elipmoc/index.md): 2022 · Proceedings of the ACM on Programming Languages (OOPSLA 2022) · Journal article · Elipmoc decompiles Ethereum Virtual Machine bytecode into a structured three-address intermediate representation for security analyses and reverse engineering. Built as an evolution of the Datalog-based Gigahorse decompiler, it adds transactional context sensitivity, path-sensitive inference of function arguments and returns with path merging, and fully context-sensitive reconstruction of private functions. On a uniform random sample of 5,000 unique mainnet contracts first deployed between April and September 2021, the authors report fully resolved operands for 99.5% of contracts versus 62.8% for Gigahorse, 67% more unique external-call signatures than Etherscan’s Panoramix, and over 5x faster decompilation.
- [Pop Quiz! Can a Large Language Model Help With Reverse Engineering?](https://awesomerea.org/papers/paper-pop-quiz-llm-re/index.md): 2022 · arXiv · Preprint · Tests whether OpenAI’s Codex model code-davinci-001 can answer reverse-engineering questions about C code in a zero-shot question-and-answer prompt. Programs come from templates the authors wrote, covering cybersecurity snippets and industrial-control algorithms such as PID controllers and filters, plus five single-file Linux malware samples from vx-underground. Each is presented as original or name-randomized source, or as Ghidra decompilation of gcc -O1 builds with debug information, without it, or stripped. After exploratory open-ended questions, generated true/false and short-answer questions about purpose, capabilities and key variables are graded against an answer oracle; Codex answered 72,754 of 136,260 questions correctly.
- [Beyond the C: Retargetable Decompilation using Neural Machine Translation](https://awesomerea.org/papers/paper-beyond-the-c/index.md): 2022 · Workshop on Binary Analysis Research (BAR) 2022 · Conference paper · BTC (Beyond The C) treats decompilation as plain-text translation from compiler-emitted x86-64 assembly to source code. It uses byte-pair-encoding tokenizers trained separately on assembly and source, and a standard fairseq transformer. Function pairs are matched through the compiler's CFI and line directives rather than language-specific parsers, compiler plugins or lifters, so the same pipeline is retrained for Go, Fortran, OCaml and C. Training sets range from about 10,000 functions for small C, Go and Fortran corpora to 2 million C functions built from Debian packages. The best model, trained on the large C set, reaches a normalized average edit distance of 0.46 on held-out functions.
- [Asteria: Deep Learning-based AST-Encoding for Cross-platform Binary Code Similarity Detection](https://awesomerea.org/papers/paper-asteria/index.md): 2021 · 2021 51st Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN) · Conference paper · ASTERIA uses a Tree-LSTM to encode function ASTs and compare binary functions across platforms. It was evaluated on function pairs and used to search IoT firmware for vulnerabilities.
- [Trex: Learning Execution Semantics from Micro-Traces for Binary Similarity](https://awesomerea.org/papers/paper-trex/index.md): 2020 · arXiv · Preprint · Trex learns execution semantics from function micro-traces, then uses that knowledge to match semantically similar binary functions.
- [Neural reverse engineering of stripped binaries using augmented control flow graphs](https://awesomerea.org/papers/paper-nero/index.md): 2020 · Proceedings of the ACM on Programming Languages (OOPSLA 2020) · Journal article · Nero predicts names for procedures in stripped x86-64 Linux executables; it does not produce decompiled code. Static analysis reconstructs call sites, including imported API names, and augments their arguments with concrete and abstract values along control-flow paths. LSTM, Transformer and graph neural network encoders over the resulting augmented call-site graph feed a decoder that generates the name as subtokens. On a GNU-package test set the authors report 45.53 F1 for Nero-GNN, against 35.52 for an adapted DIRE and 33.66 for Debin.
- [How far we have come: testing decompilation correctness of C decompilers](https://awesomerea.org/papers/paper-decfuzzer/index.md): 2020 · ACM ISSTA 2020 · Conference paper · Tests whether C decompilers preserve program behavior. The authors' DecFuzzer compiles a Csmith-generated program, decompiles the executable, substitutes the decompiled function for the original in the source, recompiles, and compares the two programs' outputs; equivalence-modulo-inputs (EMI) mutation then derives further test programs from the seeds. Across four popular decompilers the authors report 1,423 inputs that trigger decompilation errors and, after manual analysis, 13 bugs in two open-source decompilers. They argue that modern decompilers are making real progress on functional correctness, while type recovery and optimization still hinder accurate output.
- [Binary Rewriting without Control Flow Recovery](https://awesomerea.org/papers/paper-e9patch/index.md): 2020 · PLDI 2020 · Conference paper · E9Patch statically rewrites x86-64 binaries by inserting jumps to trampolines without moving any other instruction, so the original set of jump targets is preserved and control-flow recovery, symbolization and debug information are not needed. Where a five-byte jump does not fit, instruction punning, padding and successor or neighbor eviction overlap the jump with existing bytes or relocate neighboring instructions into their own trampolines; physical page grouping reduces the memory and file-size cost of scattered trampolines. Instruction locations come from a separate frontend, a basic linear disassembler in the evaluation. The authors evaluate SPEC2006, Ubuntu 16.04 system binaries, and Chrome and Firefox builds over 100 MB, and demonstrate binary repair and heap-write hardening with low fat pointers.
- [RetroWrite: Statically Instrumenting COTS Binaries for Fuzzing and Sanitization](https://awesomerea.org/papers/paper-retrowrite/index.md): 2020 · IEEE S&P 2020 · Conference paper · RetroWrite statically rewrites 64-bit position-independent Linux binaries by generating reassembleable assembly, so instrumentation can be inserted as if at compile time. Instead of heuristics, it symbolizes references from the binary's own metadata: control-flow operands, PC-relative addressing that position-independent code must use, and data relocations become assembler labels, which separates references from scalars. On this base the authors build AFL coverage instrumentation and a binary-only AddressSanitizer. They report fuzzing throughput matching compiler instrumentation and 4.5x faster than AFL's QEMU mode, with more bugs found on LAVA-M, and binary ASan that runs 3x faster than Valgrind memcheck on SPEC CPU2006 and detects 80% more bugs in their evaluation, whose coverage tests use Juliet memory-corruption cases.
- [BinRec: Dynamic Binary Lifting and Recompilation](https://awesomerea.org/papers/paper-binrec/index.md): 2020 · EuroSys 2020 · Conference paper · BinRec lifts an executable to LLVM IR from dynamic traces instead of static disassembly, then lowers the IR back to a recovered binary, so compiler passes can optimize, harden or otherwise transform it. Tracing runs the binary under S²E, which translates the executed code through QEMU into LLVM IR; BinRec removes the emulation instrumentation, merges traces from several inputs into one program, and adds optimizations such as register de-aliasing and promotion of emulated state to locals. When the recovered binary reaches a path that was not traced, a configurable handler stops it, falls back to the original code, or lifts the new path incrementally. The authors report recovering all SPEC CINT2006 benchmarks, including C++ programs, and apply it to reoptimization, control-flow integrity, AddressSanitizer and SafeStack hardening, and partial deobfuscation of virtualization-obfuscated code.
- [Towards usable automated detection of CPU architecture and endianness for arbitrary binary files and object code sequences](https://awesomerea.org/papers/paper-isadetect/index.md): 2020 · Proceedings of the Tenth ACM Conference on Data and Application Security and Privacy · Conference paper · The paper builds open datasets and tools to identify CPU architecture and endianness in binary files and object code. It evaluates classifiers on executable code sections, reporting over 98% accuracy.
- [Egalito: Layout-Agnostic Binary Recompilation](https://awesomerea.org/papers/paper-egalito/index.md): 2020 · ASPLOS 2020 · Conference paper · Egalito statically recompiles stripped x86-64 and ARM64 binaries, using the metadata that position-independent executables and libraries carry to recover a complete disassembly in which every code and data cross-reference becomes an explicit link. Its layout-agnostic intermediate representation, EIR, stays close to machine code, so regenerated output is predictable, while a higher-level view supports analysis; data-flow analyses infer jump tables, which have no metadata. Because the original layout imposes no constraints, tools can move or rewrite code freely; the authors build nine, including continuous code randomization in which Egalito transforms itself, a retpoline defense, and software emulation of Intel CET. They report recovering the compiler's jump tables in 866 of 867 executables and libraries from 172 Debian packages, all tests passing in 90 of 149 transformed packages, and a 1.7% speedup on SPEC CPU 2006.
- [DIRE: A Neural Approach to Decompiled Identifier Naming](https://awesomerea.org/papers/paper-dire/index.md): 2019 · ASE 2019 · Conference paper · Combines lexical and structural information from decompiler output to predict meaningful variable names, with a training and evaluation corpus derived from compiled C projects.
- [Manticore: A User-Friendly Symbolic Execution Framework for Binaries and Smart Contracts](https://awesomerea.org/papers/paper-manticore/index.md): 2019 · arXiv · Preprint · Manticore uses dynamic symbolic execution to analyze binaries and Ethereum smart contracts. The paper presents its architecture and demonstrates bug finding and code verification used for commercial clients.
- [InternalBlue - Bluetooth Binary Patching and Experimentation Framework](https://awesomerea.org/papers/paper-internalblue/index.md): 2019 · Proceedings of the 17th Annual International Conference on Mobile Systems, Applications, and Services · Conference paper · The paper reverse engineers Broadcom Bluetooth controllers and presents InternalBlue for patching their firmware. It evaluates the framework through vulnerability tests, bug fixes, and added security features.
- [Towards Neural Decompilation](https://awesomerea.org/papers/paper-neural-decompilation/index.md): 2019 · arXiv · Preprint · The paper trains a neural machine translation decompiler using a compiler. It evaluates translation from LLVM IR and x86 assembly to C, successfully decompiling over 97% and 88% of its respective benchmarks.
- [ICSREF: A Framework for Automated Reverse Engineering of Industrial Control Systems Binaries](https://awesomerea.org/papers/paper-icsref/index.md): 2019 · Proceedings 2019 Network and Distributed System Security Symposium · Conference paper · ICSREF automates reverse engineering of PLC binaries compiled with CODESYS. It was evaluated on collected and in-house PLC binaries and used to generate an attack against a chemical process testbed.
- [Coda: An End-to-End Neural Program Decompiler](https://awesomerea.org/papers/paper-coda/index.md): 2019 · NeurIPS 2019 · Conference paper · Coda decompiles the assembly of short functions into C in two phases. An instruction-type-aware N-ary Tree-LSTM encoder and an attention-fed AST decoder first generate a code sketch; an ensemble of neural error predictors then proposes token corrections, each kept only if recompiling the candidate does not increase its edit distance to the input assembly. On synthetic benchmarks the authors report 82% average program accuracy after correction, against 12% for a sequence-to-sequence baseline with attention.
- [A Cross-Architecture Instruction Embedding Model for Natural Language Processing-Inspired Binary Code Analysis](https://awesomerea.org/papers/paper-cross-arch-instruction-embedding/index.md): 2018 · arXiv · Preprint · The paper learns instruction embeddings that capture semantic relationships within and across architectures. It evaluates them on semantic basic-block comparison, outperforming a code-statistics approach.
- [Debin: Predicting Debug Information in Stripped Binaries](https://awesomerea.org/papers/paper-debin/index.md): 2018 · ACM CCS 2018 · Conference paper · Debin predicts debug information for stripped ELF binaries on x86, x64 and ARM. After lifting code to BAP-IR, an Extremely randomized Trees classifier decides which registers and memory offsets hold source-level variables. A conditional random field, solved with Nice2Predict, then jointly predicts names and types for variables and functions, and the result is written back as DWARF sections. On 300 held-out binaries per architecture, the authors report 68.8% precision and 68.3% recall for x64 names and types.
- [rev.ng: A Unified Binary Analysis Framework to Recover CFGs and Function Boundaries](https://awesomerea.org/papers/paper-revng/index.md): 2017 · CC 2017 · Conference paper · rev.ng lifts binaries to LLVM IR through QEMU's tiny code generator, so one front end covers every architecture QEMU supports and the output is compilable IR. On that IR the authors build architecture-independent analyses that recover a program's control-flow graph and function boundaries without symbols or debugging information. A value-range analysis (OSRA) bounds indirect jump targets such as switch tables, and further analyses handle predicated instructions, noreturn functions, tail calls and context-dependent control flow. On coreutils built for MIPS, ARM and x86-64 with GCC and clang at -O2, -O3 and -Os, its function-boundary accuracy is close to IDA Pro and better than BAP/ByteWeight and angr.
- [Ramblr: Making Reassembly Great Again](https://awesomerea.org/papers/paper-ramblr/index.md): 2017 · NDSS 2017 · Conference paper · Ramblr produces reassembleable disassembly: assembly recovered from a stripped binary that can be edited and assembled again with an off-the-shelf assembler. Starting from angr's CFG recovery, it classifies the contents of data regions, then decides which immediates and data values are references to code or data that must become symbols. Base-pointer reattribution handles compiler-optimized references that point outside their target object, and sanity checks let Ramblr refuse to reassemble a binary it cannot handle safely, such as one that encrypts pointers. The authors evaluate 106 GNU Coreutils programs for x86 and x86-64 and 143 DARPA Cyber Grand Challenge binaries at six optimization levels. They report that Uroboros broke 22.64% of 32-bit Coreutils binaries at -O0 and 56.61% at -O1, while Ramblr broke none, and that Ramblr reassembled over 98% of CGC binaries at every level.
- [No More Gotos: Decompilation Using Pattern-Independent Control-Flow Structuring and Semantics-Preserving Transformations](https://awesomerea.org/papers/paper-dream/index.md): 2015 · NDSS 2015 · Conference paper · DREAM is a decompiler whose control-flow structuring recovers loops, conditionals and switch statements from a recovered control-flow graph without matching predefined region patterns. For acyclic regions it computes each node's reaching condition, then refines the resulting conditions into if-then-else and switch constructs; cyclic regions are structured as loops whose type and continuation condition are inferred. Semantics-preserving transformations first rewrite cyclic regions with multiple entries or successors into single-entry, single-successor regions, and a Boolean variable keeps a repeated test equivalent when its operands may change. On GNU coreutils the authors report no goto statements, against thousands from Hex-Rays and Phoenix, and more compact code than Hex-Rays for 72.7% of functions and than Phoenix for 98.8% in one-to-one comparisons.

## Website reconstruction (31)

- [PrismaCoder: Pushing the Boundaries of Open Multimodal Code Intelligence through Decomposed Rubric Synthesis](https://awesomerea.org/papers/paper-prismacoder/index.md): 2026 · arXiv · Preprint · Trains visual-code models using separate code and rendered-output rubrics for data filtering and reinforcement learning. Relevant evaluations include rebuilding webpages, charts and vector graphics from images.
- [State-Aware Generation of Deployable Websites from Visual Prototypes and Requirements](https://awesomerea.org/papers/paper-visstatecoder/index.md): 2026 · arXiv · Preprint · VisStateCoder links visual prototype elements, project files, interaction requirements and render evidence in a project state graph, then uses those links to generate websites and limit subsequent repairs to selected files.
- [TaoD2C-Bench: Benchmarking MLLMs for Industrial UI Code Generation Beyond Visual Fidelity](https://awesomerea.org/papers/paper-taod2c-bench/index.md): 2026 · arXiv · Preprint · TaoD2C-Bench reconstructs interfaces from design images, layer metadata and component-library documentation. It separates requirement inference from implementation, checking component choices and layout relations through source/runtime evidence alongside rendered appearance.
- [Vision2Web: A Hierarchical Benchmark for Visual Website Development with Agent Verification](https://awesomerea.org/papers/paper-vision2web/index.md): 2026 · ICML 2026 · Conference paper · Benchmarks website development from visual prototypes and written requirements across 100 static-page, 66 interactive-frontend and 27 full-stack tasks, combining workflow-based functional checks with model-judged visual comparison.
- [IChart2Code: Benchmarking Multimodal Large Language Models for Interactive Chart Code Generation](https://awesomerea.org/papers/paper-ichart2code/index.md): 2026 · arXiv · Preprint · Benchmarks reconstruction of interactive charts from a reference screenshot, local data and specified actions. Its TRAIL framework uses Developer and Inspector agents with browser interaction traces to diagnose errors and revise the HTML/JavaScript implementation.
- [Stage-Supervised Latent Reasoning for Single-Shot JavaScript Deobfuscation](https://awesomerea.org/papers/paper-stage-supervised-js-deobfuscation/index.md): 2026 · arXiv · Preprint · Uses intermediate Webcrack rewrites to supervise Coconut-style latent reasoning for JavaScript deobfuscation. Training exposes staged code transformations; inference receives obfuscated code and generates a cleaned program in one shot.
- [ProgramDistill: From Interactive Web Apps to Verifiable Reference-Guided SWE Tasks](https://awesomerea.org/papers/paper-programdistill/index.md): 2026 · arXiv · Preprint · Evaluates recovery of web-app behavior from a live reference with hidden source. It provides 4,063 feature-restoration tasks across 26 applications and a separate 12-application reconstruction setting, scored by replaying dependent browser workflows.
- [WebWorld: The Browser as a World Model for Self-Improving Web Code](https://awesomerea.org/papers/paper-webworld-browser-feedback/index.md): 2026 · arXiv · Preprint · Uses typed browser interaction contracts to check progress and preserve previously verified capabilities while improving generated web code. Only accepted transitions become training examples.
- [Does It Render Everywhere? A Study of Cross-Environment Compatibility in MLLM-Generated Webpages](https://awesomerea.org/papers/paper-webcompat/index.md): 2026 · arXiv · Preprint · WebCompat evaluates screenshot-reconstructed webpages across browsers and devices. Its XCompat detector combines rendered DOM geometry, viewport metadata and screenshots to identify layout and element failures, independently of similarity to the original design.
- [UI2App: Benchmarking Visual Interaction Inference in Executable Web Application Generation](https://awesomerea.org/papers/paper-ui2app/index.md): 2026 · arXiv · Preprint · UI2App evaluates runnable React/TypeScript applications generated from 600 screenshots across 95 web applications. It separates build executability, visual fidelity and screenshot-implied interaction behavior, including cross-route state, using a reference interaction taxonomy and public evaluation pipeline.
- [Dashboard2Code: Evaluating Multimodal Models on Reconstructing Interactive Dashboards](https://awesomerea.org/papers/paper-dashboard2code/index.md): 2026 · ACL 2026 · Conference paper · Evaluates agents that actively explore a running dashboard and reconstruct its appearance and interaction logic. DashboardMimic provides 180 Plotly+Dash examples, with code-semantic analysis and dynamic interaction tests for the generated implementations.
- [UniCoder: Unified Visual-to-Code Generation via Symbolic Rewards and Reference-Guided Code Optimization](https://awesomerea.org/papers/paper-unicoder/index.md): 2026 · arXiv · Preprint · UniCoder trains a visual-to-code model for charts, SVGs and webpages. Its reinforcement-learning objective combines rendering checks, image similarity and code-derived visual attributes; low-reward training groups receive reference-code trajectories to improve exploration.
- [CASCADE: LLM-powered JavaScript Deobfuscator at Google](https://awesomerea.org/papers/paper-cascade/index.md): 2026 · ICSE-SEIP 2026 · Conference paper · Uses Gemini to locate the prelude functions that Obfuscator.IO inserts for string obfuscation, then applies constant-propagation and inlining passes in the JSIR compiler IR to restore string literals and API names deterministically.
- [ScreenCoder: Advancing Visual-to-Code Generation for Front-End Automation via Modular Multimodal Agents](https://awesomerea.org/papers/paper-screencoder/index.md): 2026 · EMNLP 2026 · Conference accepted · Splits screenshot-to-code generation among grounding, planning and generation agents that label UI regions, build a hierarchical layout tree and write HTML/CSS. The pipeline also produces the Screen-10K training pairs used for supervised and reinforcement fine-tuning, and the paper introduces the 1,000-page ScreenBench.
- [IWR-Bench: Can LVLMs reconstruct interactive webpage from a user interaction video?](https://awesomerea.org/papers/paper-iwr-bench/index.md): 2026 · ICLR 2026 · Conference paper · Tests reconstruction of interactive webpages from user-interaction videos and supplied static assets. Its 113 tasks replay annotated action sequences to assess visual fidelity and functional behavior across observed page states.
- [From Obfuscated to Obvious: A Comprehensive JavaScript Deobfuscation Tool for Security Analysis](https://awesomerea.org/papers/paper-jsimplifier/index.md): 2026 · NDSS 2026 · Conference paper · JSimplifier recovers readable JavaScript from obfuscated scripts in three stages. A preprocessor normalizes malformed or mixed-encoding input; a deobfuscator combines AST-based static simplification with selective execution of obfuscated call sites in a Node.js vm context, feeding the results back into the AST; and an optional humanizer renames identifiers with an LLM, adapting HumanifyJS, then formats the output with Prettier. The authors catalog 20 obfuscation techniques in four categories and assemble MalJS (23,212 malicious scripts) and BenignJS (21,209 scripts). They report that JSimplifier processes all 44,421 samples and reduces Halstead length by 88.2% on 1,296 multi-technique JsDeObsBench samples.
- [JsDeObsBench: Measuring and Benchmarking LLMs for JavaScript Deobfuscation](https://awesomerea.org/papers/paper-jsdeobsbench/index.md): 2025 · ACM CCS 2025 · Conference paper · Builds an execution-verifiable JavaScript deobfuscation benchmark by applying seven JavaScript-Obfuscator transformations to Project CodeNet programs with test cases, then scores LLM and tool outputs for syntax, execution, code simplification and similarity to the original code.
- [Interaction2Code: Benchmarking MLLM-based Interactive Webpage Code Generation from Interactive Prototyping](https://awesomerea.org/papers/paper-interaction2code/index.md): 2025 · ASE 2025 · Conference paper · Benchmarks reconstruction of interactive webpages from screenshots before and after an interaction. The final study covers 127 webpages and 374 interactions, comparing rendered appearance, automated interaction checks, and human usability judgments.
- [LaTCoder: Converting Webpage Design to Code with Layout-as-Thought](https://awesomerea.org/papers/paper-latcoder/index.md): 2025 · KDD 2025 · Conference paper · LaTCoder converts webpage design images to HTML/CSS by making layout an explicit intermediate step. A rule-based divider recursively finds solid-colored horizontal or vertical lines that avoid OCR-detected text, then merges small regions into grid-aligned blocks. An MLLM writes code for each block with a chain-of-thought prompt. The blocks are then assembled by absolute positioning or by the MLLM, and a reference-free verifier combining MAE and CLIP picks the better result. The paper also introduces CC-HARD, 128 complex-layout pages manually sampled from Common Crawl.
- [WebUIBench: A Comprehensive Benchmark for Evaluating Multimodal Large Language Models in WebUI-to-Code](https://awesomerea.org/papers/paper-webuibench/index.md): 2025 · Findings of ACL 2025 · Conference paper · Diagnoses webpage-to-code capability through visual perception, HTML programming, image-to-HTML understanding, and screenshot reconstruction tasks. It separates underlying skills using question-answer pairs derived from real websites.
- [WAFFLE: Fine-tuning Multi-Modal Model for Automated Front-End Development](https://awesomerea.org/papers/paper-waffle/index.md): 2025 · ACL 2025 · Conference paper · WAFFLE fine-tunes multimodal LLMs to generate HTML/CSS from UI screenshots. A quarter of the decoder's attention heads use a structure-aware mask that limits each element's tokens to its parent, preceding siblings and its own earlier tokens. A contrastive objective aligns image and code embeddings over groups of four mutated WebSight-v0.1 pages. With VLM-WebSight and Moondream2 backbones, the authors report up to 9.00 pp higher HTML-Match and 0.0982 higher CW-SSIM than standard fine-tuning on WebSight-Test, plus gains on every Design2Code metric.
- [Divide-and-Conquer: Generating UI Code from Screenshots](https://awesomerea.org/papers/paper-dcgen/index.md): 2025 · Proceedings of the ACM on Software Engineering (FSE 2025) · Journal article · Recursively divides a webpage screenshot along visual separation lines, has a multimodal model generate HTML/CSS for each leaf segment, and assembles child code upward into the full page; evaluated with GPT-4o, Gemini and Claude models and a small developer study.
- [StructEval: Benchmarking LLMs' Capabilities to Generate Structural Outputs](https://awesomerea.org/papers/paper-structeval/index.md): 2025 · arXiv · Preprint · Evaluates generation and conversion of structured outputs, including HTML, React and SVG, with separate checks for format adherence and structural correctness.
- [WebCode2M: A Real-World Dataset for Code Generation from Webpage Designs](https://awesomerea.org/papers/paper-webcode2m/index.md): 2025 · WWW 2025 · Conference paper · WebCode2M pairs about 2.56 million real-world webpage screenshots with purified HTML/CSS code and element bounding-box layout trees. Pages sampled from a Common Crawl snapshot are cleaned (scripts, metadata and hidden elements removed, styles merged into one block), rendered with Playwright, and filtered by a neural scorer trained on 10,000 annotated samples. The paper fine-tunes Pix2Struct-1.3B as the WebCoder baseline, introduces TreeBLEU to measure DOM-structure recall, and benchmarks specialized, open and commercial multimodal models on short, medium and long test subsets of 256 pages each.
- [Sketch2Code: Evaluating Vision-Language Models for Interactive Web Design Prototyping](https://awesomerea.org/papers/paper-sketch2code/index.md): 2025 · NAACL 2025 · Conference paper · Sketch2Code benchmarks vision-language models on turning rough hand-drawn wireframe sketches into HTML webpage prototypes. Crowd annotators drew 731 sketches of 484 real-world webpages from the Design2Code test set. Ten models, eight commercial and two 8B open-source, generate pages directly and in two multi-turn settings with a GPT-4o simulated user: following its feedback, or asking it clarification questions. Outputs are scored by Design2Code visual similarity and a new IoU-based layout similarity over component types such as text blocks, images, navigation bars, forms and buttons. Claude 3.5 Sonnet and GPT-4o lead single-turn layout similarity, and feedback rounds help commercial models more than question asking does.
- [Design2Code: Benchmarking Multimodal Code Generation for Automated Front-End Engineering](https://awesomerea.org/papers/paper-design2code/index.md): 2025 · NAACL 2025 · Conference paper · Evaluates reconstruction of frontend code from webpage screenshots using real-world reference pages, visual-element and layout metrics, and human assessment.
- [Large Language Models for Code Analysis: Do LLMs Really Do Their Job?](https://awesomerea.org/papers/paper-llm-code-analysis/index.md): 2024 · USENIX Security 2024 · Conference paper · Evaluates GPT-3.5-turbo, GPT-4, LLaMA-2-13B, Code-LLaMA-2-13B-Instruct and StarChat-Beta on explaining what de-commented JavaScript, Python and C code does, then repeats the task on JavaScript obfuscated with JavaScript Obfuscator (identifier renaming, dead-code injection, control-flow flattening and string splitting) and with Wobfuscator’s WebAssembly transformation. GPT-3.5 and GPT-4 are also asked to rewrite 100 IOCCC winning programs as readable, compilable code. Case studies apply GPT models to a botnet and a benign browser-extension repository, an Android SMS stealer decompiled with JD-GUI, and WannaCry code decompiled with RetDec.
- [Unlocking the conversion of Web Screenshots into HTML Code with the WebSight Dataset](https://awesomerea.org/papers/paper-websight/index.md): 2024 · arXiv · Preprint · WebSight is a synthetic dataset of 2 million HTML documents paired with full-page screenshots for training screenshot-to-HTML models. Mistral-7B-Instruct generates website concepts, Deepseek-Coder-33B-Instruct writes each page in HTML with Tailwind CSS, images come from keyword-based stock-photo URLs, and Playwright renders the screenshots after filtering. This v0.2 release replaces the 823K-pair v0.1, which used traditional CSS and colored rectangles instead of images. The authors fine-tune an 8B vision-language model, Sightseer, on the data with DoRA and show qualitative conversions, including one from a hand-drawn sketch.
- [Web2Code: A Large-scale Webpage-to-Code Dataset and Evaluation Framework for Multimodal LLMs](https://awesomerea.org/papers/paper-web2code/index.md): 2024 · NeurIPS 2024 Datasets and Benchmarks · Conference paper · Studies screenshot-to-HTML reconstruction through instruction tuning and two evaluation benchmarks. Web2Code combines generated webpages, refined WebSight and pix2code image/code pairs, and WebSRC-derived question answering. Models produce HTML from a webpage image and instruction; rendered output is compared visually, while a separate benchmark measures screenshot understanding.
- [Understanding JavaScript Event-Based Interactions](https://awesomerea.org/papers/paper-clematis/index.md): 2014 · ICSE 2014 · Conference paper · Clematis helps developers understand a JavaScript web application's runtime behavior from a recorded user session. A proxy instruments JavaScript on the fly to log DOM events, timeouts, XMLHttpRequest phases, function calls and DOM mutations. The trace is grouped into episodes, each with its triggering event, executed functions and resulting DOM changes, linked by temporal and causal edges and shown in an interactive visualization. In an industrial study with 20 developers on the Phormer photo gallery, the authors report 61% higher task accuracy and 47% less completion time than developers using their preferred tools.
- [Crawling Ajax-Based Web Applications through Dynamic Analysis of User Interface State Changes](https://awesomerea.org/papers/paper-crawljax/index.md): 2012 · ACM Transactions on the Web · Journal article · Crawljax infers a state-flow graph of an Ajax web application by driving it in a real browser. It scans the DOM for candidate clickable elements, fires events on them, compares the resulting DOM against known states with configurable comparison and similarity thresholds, and records new states and the event transitions between them, backtracking by reloading and replaying paths. A concurrent variant partitions the crawl across browser instances. The Java tool uses Selenium WebDriver and plugins; one plugin writes a static mirror of the crawled states. The authors evaluate six open-source and industrial sites and measure how the number of concurrent browsers affects crawling runtime on Google AdSense.

## Game reconstruction and reverse engineering (15)

- [Schema: Discovering Unknown Environments via Agentic Program Induction](https://awesomerea.org/papers/paper-schema-program-induction/index.md): 2026 · arXiv · Preprint · Infers executable models of game state and transition rules from interaction. Agents revise these models against recorded history, search within them, and compare predicted observations with real outcomes while executing plans.
- [SWE-Game: Can Coding Agents Build the Games We Want?](https://awesomerea.org/papers/paper-swe-game/index.md): 2026 · arXiv · Preprint · Evaluates construction, completion, repair and Godot-to-Unity porting against executable reference games. Evaluator-owned probes and input replays check gameplay behavior, while visual rubrics assess presentation separately.
- [GameReplica: A Benchmark for Black-Box Visual Game Replication by Vision-Language Agents](https://awesomerea.org/papers/paper-gamereplica/index.md): 2026 · arXiv · Preprint · Evaluates whether vision-language agents can infer hidden game rules through screenshots and active interaction, then build runnable single-file HTML replicas across 125 tasks from 25 web games, each with five difficulty levels.
- [Tycho: Active Abstraction with Programmatic World Models for ARC-AGI-3](https://awesomerea.org/papers/paper-tycho/index.md): 2026 · arXiv · Preprint · Tycho constructs editable Python models of game state, transitions, rendering and outcomes from action/observation histories in unfamiliar ARC-AGI-3 games. It checks model predictions against recorded transitions and can use, repair or bypass these models during planning.
- [RevengeBench: Reverse Engineering Code-Space Policies from Behavioral Experiments](https://awesomerea.org/papers/paper-revengebench/index.md): 2026 · arXiv · Preprint · Tests whether agents can recover executable decision policies from behavioral traces and self-designed opponent probes, using 75 synthetic policies across five game arenas and measuring held-out action agreement and downstream competitive value.
- [SPRITE: From Static Mockups to Engine-Ready Game UI](https://awesomerea.org/papers/paper-sprite-game-ui/index.md): 2026 · CHI EA 2026 (poster/extended abstract) · Conference paper · Transforms game-interface screenshots into editable engine assets through hierarchical YAML, visual grounding, asset extraction, and Unity UXML/USS synthesis, with evaluation on a curated game-UI benchmark and review by three senior UI/UX designers.
- [PoE-World: Compositional World Modeling with Products of Programmatic Experts](https://awesomerea.org/papers/paper-poe-world/index.md): 2025 · NeurIPS 2025 · Conference paper · PoE-World represents an Atari world model as an exponentially weighted product of many small Python programs, or programmatic experts, each synthesized by an LLM to explain one aspect of the observed dynamics; learned weights and optional synthesized hard constraints combine them. From object lists that OCAtari parses out of a demonstration of fewer than 1,000 frames, the authors learn stochastic, partially observed models of Pong and Montezuma's Revenge and use them in a planning agent, including on rearranged Pong-Alt and Montezuma's Revenge-Alt variants that have no demonstrations.
- [Diffusion Models Are Real-Time Game Engines](https://awesomerea.org/papers/paper-gamengen/index.md): 2025 · ICLR 2025 · Conference paper · GameNGen learns to simulate DOOM interactively with a diffusion model instead of game code. A PPO agent first plays the game in ViZDoom, and its recorded trajectories, from random to trained play, become the training data. Stable Diffusion v1.4 is then fine-tuned to predict the next frame from the last 64 frames and actions, with noise added to context frames to keep long autoregressive rollouts stable and a fine-tuned latent decoder for detail. With 4 sampling steps it runs at 20 frames per second on one TPU-v5. The authors report next-frame PSNR of 29.43 and human raters picking the real game in 58–60% of short clips.
- [WorldCoder, a Model-Based LLM Agent: Building World Models by Writing Code and Interacting with the Environment](https://awesomerea.org/papers/paper-worldcoder/index.md): 2024 · NeurIPS 2024 · Conference paper · WorldCoder learns executable Python transition and reward models from environment interactions and natural-language goals. It refines code against recorded experiences and an optimistic planning constraint, studying transfer and task solving in Sokoban, MiniGrid and ALFWorld.
- [Generating Code World Models with Large Language Models Guided by Monte Carlo Tree Search](https://awesomerea.org/papers/paper-code-world-models/index.md): 2024 · NeurIPS 2024 · Conference paper · GIF-MCTS generates executable Python transition and reward models from natural-language environment descriptions and offline state-transition trajectories, using prediction feedback to generate, improve and repair code. CWMB evaluates 18 reinforcement-learning environments and downstream planning; a separate experiment uses a simplified Read to Fight Monsters grid world.
- [Combining Functional and Automata Synthesis to Discover Causal Reactive Programs](https://awesomerea.org/papers/paper-autumnsynth/index.md): 2023 · Proceedings of the ACM on Programming Languages (POPL 2023) · Journal article · AutumnSynth synthesizes a program in Autumn, a functional reactive language for Atari-style grid worlds, from a trace of observed frames and user actions such as clicks and arrow keys. Heuristic perception parses each frame into typed objects and tracking links them across time steps. The synthesizer then finds an update function for each observed change and searches for the event that triggers it. When no event over the observed state explains an update, automata synthesis invents latent state, such as counters or modes, using a SAT-based Sketch encoding or a faster heuristic. The authors introduce the 30-program Causal Inductive Synthesis Corpus (CISC), on which the heuristic variant synthesizes 27 programs. A slightly modified version synthesizes 21 of 27 games from the third-party EMPA grid-world corpus.
- [MappyLand: Fast, Accurate Mapping for Console Games](https://awesomerea.org/papers/paper-mappyland/index.md): 2021 · AIIDE 2021 · Conference paper · MappyLand, a Rust rewrite of the earlier Mappy system, instruments the FCEUMM NES emulator core to map action/adventure games as they are played from controller inputs. It hooks accesses to the picture-processing unit's scrolling registers and reads emulator memory to register scrolling, separate the playfield from menus, detect and track sprites, build grid-based tile maps and recognize room transitions. An online merging step combines observed rooms into a consistent room graph across backtracking and multiple play sessions. In a 34,514-frame test the authors report about 1.5 ms of mapping overhead per frame, against about 0.2 ms for emulation alone.
- [Learning to Simulate Dynamic Environments with GameGAN](https://awesomerea.org/papers/paper-gamegan/index.md): 2020 · CVPR 2020 · Conference paper · GameGAN learns an action-conditioned neural simulator of a game from recorded frames and the actions taken, without access to the game’s logic or engine. An action-conditioned LSTM dynamics engine with a stochastic latent variable predicts the next state, an optional external memory module builds an internal map so that revisited locations stay consistent, and a rendering engine decodes frames while separating static from dynamic components. Training is end-to-end with adversarial losses, including an action-conditioned discriminator, and a temporal cycle loss for memory consistency. The authors evaluate on a modified Pac-Man, a ghost-free Pac-Man-Maze and VizDoom “take cover”, training RL agents inside the learned simulators and testing them in the real games, and measure long-term consistency with a come-back-home task; a human-playable model of the official Pac-Man is shown qualitatively.
- [Mechanics Automatically Recognized via Interactive Observation: Jumping](https://awesomerea.org/papers/paper-nes-jump-mechanics/index.md): 2017 · FDG 2017 · Conference paper · Infers platform-game jump mechanics by running controlled experiments in a modified FCEUX NES emulator. A person first plays each game to a safe state; the system then repeatedly holds the jump button for 1 to 120 frames, waits 120 frames and resets, recording every sprite from the PPU sprite table. Sprites that usually touch one another are merged into characters and tracked. A hand-designed four-state jump automaton (ground, rising with and without the button, falling) is then fitted with linear support vector regression, giving per-state velocity and gravity parameters plus minimum and maximum button-hold durations. Across 48 games (about 30% of NES platformers) and 52 characters, the authors cluster the learned jumps into three styles.
- [Game Engine Learning from Video](https://awesomerea.org/papers/paper-game-engine-learning/index.md): 2017 · IJCAI 2017 · Conference paper · Learns a rule-based forward simulator of a 2D game from gameplay video. Using a supplied sprite palette, OpenCV locates sprites in each frame; matched sprites are converted into hand-designed fact types for animation, position, relative distance, x and y velocity and camera offset. Game Engine Search then scans the frames, and whenever the current engine’s predicted next frame differs from the real one by more than a threshold, it runs a greedy search over engines that add or modify condition–effect rules or mark them as player-controlled. Engines are ranked by pixel error and rule count. Trained on one Super Mario Bros. Level 1-1 video, the learned engine predicts frames of a different player’s video more accurately than a CNN frame predictor and a previous-frame baseline, and a value-iteration agent planning with it shows no significant difference from one using the Infinite Mario engine’s native forward simulation.

## App reconstruction and analysis (16)

- [From Dead Code and Static Requirements to Working Engines: Software Revival with Coding Agents](https://awesomerea.org/papers/paper-revivebench/index.md): 2026 · arXiv · Preprint · ReviveBench evaluates repair of nonrunning software and source-unavailable implementation of bounded computational and transactional engines from open specifications, using hidden reference-based checks. It also audits grading defects that can wrongly accept or reject reconstructions.
- [From Code to Requirements: Agentic Reverse Engineering of Business Rules at Enterprise Scale](https://awesomerea.org/papers/paper-agentic-business-rule-recovery/index.md): 2026 · arXiv · Preprint · Uses seven agents and human review to recover business requirements from source, tests, configuration and documentation. A reported enterprise migration checks extracted rules against production-defect records.
- [On the Viability of Requirements Generation from Code: An Experience Report](https://awesomerea.org/papers/paper-requirements-generation-viability/index.md): 2026 · IEEE REW 2026 / AIRE · Conference paper · Studies a RAG-based, human-supervised pipeline for recovering requirements and code traces from two projects. It also tests deliberate generation of unimplemented requirements and requirements smells (potential quality issues), exposing verification and labeling difficulties.
- [From Visual Widgets to UI Code: Efficient Tool-Grounded Generation](https://awesomerea.org/papers/paper-widgetgen/index.md): 2026 · MUCG @ ECCV 2026 · Conference accepted · WidgetGen reconstructs widget screenshots as React JSX. OCR text boxes and color palettes guide whole-widget layout reasoning and optional chart generation before one terminal render; generated render/code pairs also support model fine-tuning.
- [Agentic Reverse Engineering: From I/O to Code with Discovery Agent](https://awesomerea.org/papers/paper-dio-agent/index.md): 2026 · NeurIPS 2026 · Conference accepted · Synthesizes executable programs from input/output observations using LLM-guided evolutionary search, progressively revealed examples, simple-to-complex mutations and execution-error feedback. An active variant chooses inputs and queries a hidden reference program.
- [UIOrchestra: Generating High-Fidelity Code from UI Designs with a Multi-agent System](https://awesomerea.org/papers/paper-uiorchestra/index.md): 2025 · Findings of EMNLP 2025 · Conference paper · UIOrchestra converts static mobile UI designs into React/CSS through layout-description, code-generation and rendered-image comparison agents. Its APPUI benchmark contains 1,101 human-refined code/rendering pairs based on screenshots from 165 apps across 12 categories. The reference code is reconstructed for evaluation, rather than recovered original application source.
- [DeclarUI: Bridging Design and Development with Automated Declarative UI Code Generation](https://awesomerea.org/papers/paper-declarui/index.md): 2025 · Proceedings of the ACM on Software Engineering (FSE 2025) · Journal article · Combines visual component extraction, multimodal models, page-transition graphs and iterative checks to reconstruct multi-page mobile UI code from designs or screenshots, evaluated with React Native, Flutter and ArkUI.
- [On Benchmarking Code LLMs for Android Malware Analysis](https://awesomerea.org/papers/paper-cama/index.md): 2025 · ISSTA Companion 2025 (LLMSC Workshop) · Conference paper · CAMA is a framework for benchmarking how code LLMs read decompiled Android malware. Androguard decompiles each APK into Java functions, and each model returns a structured output per function: a summary, a refined function name and a 0–10 maliciousness score. Two analysis tasks build on these outputs. Malicious-function identification is scored by consistency (whether scores and names stay stable when the model is re-prompted with its own summaries) and by fidelity (how much a LightGBM malware-category classifier loses confidence when the top-scored function descriptors are removed). Malware-purpose summarization is scored by semantic relevance (BLEU, METEOR and ROUGE-L against reference app descriptions). The benchmark holds 118 APKs from 6 categories and 13 families, with 7,542,799 decompiled functions. Of the four models evaluated, StarChat-Beta has the highest maliciousness consistency (0.813, against 0.381 for CodeLlama) and narrowly the highest semantic-relevance scores, while fidelity varies widely across models and removal sizes. Renaming functions with model-suggested names raises fidelity for CodeLlama and StarChat but lowers METEOR by about 10%.
- [Machine Learning-Based Prototyping of Graphical User Interfaces for Mobile Apps](https://awesomerea.org/papers/paper-redraw/index.md): 2020 · IEEE Transactions on Software Engineering · Journal article · ReDraw turns screenshots or design mock-ups into native Android GUI prototypes by detecting components, classifying widget types with a CNN, and assembling a plausible view hierarchy with a data-driven nearest-neighbor method.
- [pix2code: Generating Code from a Graphical User Interface Screenshot](https://awesomerea.org/papers/paper-pix2code/index.md): 2018 · EICS 2018 · Conference paper · Learns screenshot-to-DSL generation for native Android XML, iOS Storyboards and web HTML/CSS interfaces, then compiles the DSL into platform UI code.
- [From UI Design Image to GUI Skeleton: A Neural Machine Translator to Bootstrap Mobile GUI Implementation](https://awesomerea.org/papers/paper-ui2code/index.md): 2018 · ICSE 2018 · Conference paper · UI2code translates a mobile UI image into an Android component hierarchy and layout skeleton using a neural encoder-decoder. The paper evaluates structural prediction and a small developer study of implementing layouts from generated skeletons.
- [Rico: A Mobile App Dataset for Building Data-Driven Design Applications](https://awesomerea.org/papers/paper-rico/index.md): 2017 · UIST 2017 · Conference paper · Rico is a dataset of Android app designs and a runtime mining system that needs no access to or modification of app source code. Crowd workers used free Google Play apps through a web interface to a device farm, recording interaction traces. An automated crawler then replayed each trace and kept exploring, using a screenshot-and-resource-id similarity heuristic to identify new UI states. The paper reports 10,811 traces and 72,219 unique UIs from 9,772 apps in 27 categories. Each UI has a screenshot, augmented view hierarchy, explored interactions, transition animations and a 64-dimensional autoencoder layout vector.
- [Statistical Deobfuscation of Android Applications](https://awesomerea.org/papers/paper-deguard/index.md): 2016 · ACM CCS 2016 · Conference paper · DeGuard reverses layout obfuscation in Android APKs, predicting original names for the fields, methods, classes and packages that ProGuard renames. Built on Soot, it represents an app as a dependency graph over program elements and keeps Android API and other unobfuscated names fixed. It then runs MAP inference with Nice2Predict on a conditional random field learned from 1,684 F-Droid apps, under constraints that keep the renamed APK semantically equivalent. On 100 held-out F-Droid apps obfuscated with ProGuard, names identical to the originals rise from 13.3% to 79.1%, and third-party library prediction reaches 91.3% precision and 91.0% recall.
- [Reverse Engineering Mobile Application User Interfaces with REMAUI (T)](https://awesomerea.org/papers/paper-remaui/index.md): 2015 · ASE 2015 · Conference paper · Reconstructs native Android UI code from screenshots or design bitmaps using OCR, computer vision, and layout heuristics; evaluates visual similarity and view hierarchies on 488 screenshots from over 100 Android and iOS applications.
- [Guided GUI Testing of Android Apps with Minimal Restart and Approximate Learning](https://awesomerea.org/papers/paper-swifthand/index.md): 2013 · OOPSLA 2013 · Conference paper · SwiftHand generates test inputs for Android apps while learning an approximate GUI model during testing. It instruments Dalvik bytecode to read the GUI component tree and derive each screen's enabled touch, scroll, text, Back and Menu inputs; screens with the same enabled inputs are treated as equivalent states of an extended deterministic labeled transition system. The learned model steers execution toward unexplored frontier states and avoids restarts, since reinstalling an app took about 30 seconds. On 10 F-Droid apps, the authors report higher branch coverage than random and L*-based testing within the time budget, reached faster.
- [GUI ripping: reverse engineering of graphical user interfaces for testing](https://awesomerea.org/papers/paper-gui-ripping/index.md): 2003 · WCRE 2003 · Conference paper · GUI ripping reverse engineers a test model from a running desktop application rather than from its source code or specifications. Starting from the top-level windows, a ripper opens each child window by programmatically clicking executable widgets, records every window’s widgets, properties and values, and builds a GUI forest of windows. From that forest it derives event-flow graphs, which record which events can follow one another within a component, and an integration tree of component invocations. The paper describes rippers for Microsoft Windows applications, using window handles and the Windows API, and for Java Swing applications, using Java’s AWT and Swing APIs. It applies them to WordPad, Notepad, Yahoo Messenger and four applications of the TerpOffice student office suite, with the models feeding automated test generation in the authors’ GUITAR and DART systems.

## Firmware analysis and rehosting (27)

- [SoK: A Large-Scale Empirical Study of Emulation-Based Dynamic Analysis Research for ARM Cortex-M Firmware (Extended Version)](https://awesomerea.org/papers/paper-cortexm-emulation-sok/index.md): 2026 · arXiv (extended version) · Preprint · Organizes 24 MCU analysis tools into configuration recovery, emulation, fuzzing and diagnosis stages, then evaluates the runnable, pipeline-compatible subset on 4,571 filtered Cortex-M firmware images. Studies where recovered configurations and emulation artifacts fail to support later analysis.
- [POZZER: A Power Side Channel-guided Fuzzer for Black-Box Embedded Systems](https://awesomerea.org/papers/paper-pozzer/index.md): 2026 · arXiv · Preprint · Builds a noise-tolerant pseudo execution-flow graph from one power trace per test input, using newly observed behavior as LibAFL feedback. It explores embedded firmware without access to its binary, source or instrumentation.
- [Reactive Peripheral Modeling for Faithful Firmware Rehosting](https://awesomerea.org/papers/paper-bluezz-rpm/index.md): 2026 · arXiv · Preprint · Bluezz models peripherals as stateful event-condition-action systems, coordinating interrupts, MMIO and DMA rather than treating accesses independently. It uses these models to rehost BLE firmware and reach connected protocol states for analysis and fuzzing.
- [Khost: KVM-based Near Native MCU Firmware Rehosting](https://awesomerea.org/papers/paper-khost/index.md): 2026 · USENIX Security '26 · Conference paper · Extends KVM with MCU instruction handling, memory mapping and interrupt modeling to rehost firmware on ARMv8-A hosts. An MMIO monitor and firmware wrapper support peripheral interaction and coverage-guided testing.
- [FirmPilot: Evidence-Guided Multi-Agent Environment Recovery for IoT Firmware Rehosting](https://awesomerea.org/papers/paper-firmpilot/index.md): 2026 · arXiv · Preprint · FirmPilot reconstructs QEMU execution environments through coordinated retrieval, planning, filesystem, persistent-state and network recovery. Proposed changes are applied as constrained artifact deltas, then checked by rerunning the firmware and fixed probes.
- [FirmCure:Towards Autonomous and Adaptive Rehosting of Linux-Based Firmware](https://awesomerea.org/papers/paper-firmcure/index.md): 2026 · arXiv · Preprint · FirmCure combines static dependency analysis, iterative boot-configuration repair and runtime fault diagnosis to rehost Linux firmware in QEMU. Specialized agents apply targeted repairs and use execution feedback to recover service behavior.
- [SatBleed: Security of Commoditized Communication Modules in Satellites](https://awesomerea.org/papers/paper-satbleed/index.md): 2026 · IEEE S&P 2026 · Conference paper · Studies satellite communication modules through hardware inspection, firmware reverse engineering, protocol analysis, partial rehosting and targeted testing. A component-level threat model connects recovered data flows to security boundaries.
- [User-Space Dependency-Aware Rehosting for Linux-Based Firmware Binaries](https://awesomerea.org/papers/paper-firmwell/index.md): 2026 · NDSS 2026 · Conference paper · FIRMWELL reconstructs the execution environment of Linux firmware services by running their initialization processes, locating blocking dependencies and repairing missing system-level behavior. It combines containerized QEMU-user emulation with a QEMU-system fallback, using process traces and binary analysis to recover resources needed by the target service.
- [Target-Centric Firmware Rehosting with Penguin](https://awesomerea.org/papers/paper-penguin/index.md): 2025 · Workshop on Binary Analysis Research (BAR) 2025 · Conference paper · Penguin rehosts embedded Linux firmware from an extracted filesystem by deriving an editable configuration of emulation transformations, such as file changes, pseudofiles, NVRAM values and network interfaces, from static analysis. Dynamic-analysis plugins expose failures so the configuration can be refined for each target, and a minimizer identifies which transformations a working rehosting needs.
- [What Your Firmware Tells You Is Not How You Should Emulate It: A Specification-Guided Approach for Firmware Emulation](https://awesomerea.org/papers/paper-semu/index.md): 2022 · ACM CCS 2022 · Conference paper · SEmu builds microcontroller peripheral models from vendor reference manuals rather than from the firmware itself. An NLP pipeline built on the Stanford tagger and parser turns register descriptions, interrupt tables and DMA channel tables taken from the manuals into structured condition-action rules, which the emulator checks, executes and chains at run time to answer MMIO accesses and raise interrupts or DMA requests. A symbolic-execution diagnostic tool built on S2E and µEmu traces invalid states back to the rules likely responsible, so that a person can correct them. The authors also use the models for fuzzing and to check driver code against specification rules.
- [Fuzzware: Using Precise MMIO Modeling for Effective Firmware Fuzzing](https://awesomerea.org/papers/paper-fuzzware/index.md): 2022 · USENIX Security 2022 · Conference paper · Rehosts monolithic ARM Cortex-M firmware for fuzzing, using locally scoped symbolic execution to model memory-mapped I/O accesses and focus input mutations on values relevant to firmware logic.
- [ECMO: Peripheral Transplantation to Rehost Embedded Linux Kernels](https://awesomerea.org/papers/paper-ecmo/index.md): 2021 · Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security · Conference paper · ECMO transplants peripheral drivers into embedded Linux kernels to boot firmware in QEMU. It evaluated 815 firmware images across 20 kernel versions, 37 device models, and 24 vendors; 710 reached a user-space shell.
- [Jetset: Targeted Firmware Rehosting for Embedded Systems](https://awesomerea.org/papers/paper-jetset/index.md): 2021 · USENIX Security 2021 · Conference paper · Jetset rehosts firmware only as far as an analyst-chosen goal address, such as the point where a fuzzer can inject input. Given the architecture, the MMIO address range, an entry point and the goal, it symbolically executes the firmware with angr against a modified QEMU, treating peripheral reads as symbolic, cycling interrupts, and steering toward the goal with CFG distances and Tabu search. Solved constraints become C peripheral models for QEMU that replay the inferred values and interrupts so the firmware boots concretely to the goal. The authors evaluate 13 targets across x86, ARM and Motorola ColdFire, including Linux on a Raspberry Pi 2, a BeagleBoard-xM bootloader, a SEL-751 relay, a Boeing 737 CMU-900 and nine P²IM firmware, and use the CMU model with AFL to find a privilege escalation in its VRTX kernel.
- [Automatic Firmware Emulation through Invalidity-guided Knowledge Inference](https://awesomerea.org/papers/paper-uemu/index.md): 2021 · USENIX Security 2021 · Conference paper · µEmu emulates ARM Cortex-M microcontroller firmware without real hardware or hand-written peripheral models by symbolically executing the image with unknown peripheral registers as symbols. Invalidity-guided exploration detects invalid states such as unexpected infinite loops and steers execution toward valid paths, caching the chosen responses at individual peripheral access points in a tiered knowledge base whose rules range from simple storage to PC- and calling-context-based matching. During dynamic analysis the knowledge base answers peripheral reads while an integrated, modified AFL fuzzer supplies data-register input. The prototype extends S2E 2.0 with Cortex-M support.
- [SoK: Enabling Security Analyses of Embedded Systems via Rehosting](https://awesomerea.org/papers/paper-rehosting-sok/index.md): 2021 · ACM ASIA CCS 2021 · Conference paper · Systematizes rehosting: moving embedded firmware from its physical hardware into a virtual environment that models enough hardware behavior for dynamic analysis such as fuzzing and symbolic execution. The authors measure why whole-system emulation does not scale using 2,574 hardware configurations, 1,956 device tree blobs from Linux 5.11.4 and 618 vendor ARM Cortex SVD files. They compare corpus CPU models with QEMU support, count unique peripherals, use driver source lines as a complexity proxy, and run a Monte Carlo simulation of adding peripheral models SoC by SoC. Supporting a random 10% of the SoCs would need about 3,947 peripherals for the Linux corpus and 1,730 for the ARM Cortex corpus, against 1,083 implemented in QEMU 5.2. The paper then classifies prior systems by how they emulate, replace, symbolically model, pass through to hardware or leave each layer unmodified, describes an iterative rehosting process with fidelity evaluation, and sets out open problems.
- [Conware: Automated Modeling of Hardware Peripherals](https://awesomerea.org/papers/paper-conware/index.md): 2021 · ACM ASIA CCS 2021 · Conference paper · Conware builds reusable software models of hardware peripherals from recordings of real firmware–peripheral interactions. An LLVM pass instruments Arduino source code to log MMIO reads, writes and interrupts on the real board, with existing hardware-in-the-loop recording as an alternative. Each recording becomes a per-peripheral graph whose read values are summarized as simple sub-models such as patterns; graphs are merged and optimized into automata that can be combined across peripherals and run in an Avatar²-based emulator. The authors model ten peripherals on an Arduino Due (SAM3X Cortex-M3) and emulate an uninstrumented smart-door-lock firmware from models trained only on vendor example code.
- [Snipuzz: Black-box Fuzzing of IoT Firmware via Message Snippet Inference](https://awesomerea.org/papers/paper-snipuzz/index.md): 2021 · ACM CCS 2021 · Conference accepted · Snipuzz fuzzes IoT firmware as a client, using device responses to infer message snippets that guide mutations. It was evaluated on 20 real-world IoT devices and compared with four IoT fuzzing approaches.
- [DICE: Automatic Emulation of DMA Input Channels for Dynamic Firmware Analysis](https://awesomerea.org/papers/paper-dice/index.md): 2021 · IEEE S&P 2021 · Conference paper · DICE adds DMA input emulation to microcontroller firmware emulators that model neither peripherals nor DMA controllers. It watches firmware writes to the memory-mapped DMA controller region for pairs of source and destination transfer pointers, and infers the transfer direction from later firmware accesses. When firmware reads a peripheral-to-RAM destination buffer, DICE answers with analyzer-supplied input such as fuzzer data, growing buffer bounds conservatively. Prototypes patch the QEMU forks of P2IM (ARM Cortex-M) and a PIC32 emulator (MIPS M4K/M-Class). On 83 sample firmware covering 9 DMA controllers from 5 vendors, the authors report 33 of 37 input channels detected with no false positives, correct input for 21 of 22 buffers and 3.4% average overhead. Fuzzing 7 real firmware for 48 hours found 5 previously unknown bugs.
- [From Library Portability to Para-rehosting: Natively Executing Microcontroller Software on Commodity Hardware](https://awesomerea.org/papers/paper-para-rehosting/index.md): 2021 · Proceedings 2021 Network and Distributed System Security Symposium · Conference paper · The paper uses a POSIX-based portable MCU and replaceable peripheral drivers to rehost MCU software for native execution and security testing on commodity hardware.
- [FirmAE: Towards Large-Scale Emulation of IoT Firmware for Dynamic Analysis](https://awesomerea.org/papers/paper-firmae/index.md): 2020 · ACSAC 2020 · Conference paper · Extends Firmadyne with empirically derived interventions for boot, networking, NVRAM, kernel behavior, and other runtime failures, enabling Linux router and IP-camera firmware web services to run for dynamic analysis.
- [HALucinator: Firmware Re-hosting Through Abstraction Layer Emulation](https://awesomerea.org/papers/paper-halucinator/index.md): 2020 · USENIX Security 2020 · Conference paper · HALucinator rehosts monolithic ARM Cortex-M firmware by identifying hardware-abstraction-library functions and replacing them with authored Python handlers and peripheral models. LibMatch locates library interfaces; the QEMU/Avatar2 implementation supports interactive I/O, while the paper-associated HAL-fuzz variant uses AFL-Unicorn for fuzzing.
- [On Manually Reverse Engineering Communication Protocols of Linux Based IoT Systems](https://awesomerea.org/papers/paper-manually-re-iot-protocols/index.md): 2020 · arXiv · Preprint · Presents a manual framework for reverse engineering communication protocols in embedded Linux IoT systems. It applies the framework to several systems and details a WeMo smart plug case study.
- [BaseSAFE: Baseband SAnitized Fuzzing through Emulation](https://awesomerea.org/papers/paper-basesafe/index.md): 2020 · Proceedings of the 13th ACM Conference on Security and Privacy in Wireless and Mobile Networks · Conference paper · BaseSAFE partially rehosts closed-source cellular baseband firmware for instrumented fuzzing and uses a sanitizing allocator to detect heap buffer overflows.
- [Frankenstein: Advanced Wireless Fuzzing to Exploit New Bluetooth Escalation Targets](https://awesomerea.org/papers/paper-frankenstein/index.md): 2020 · USENIX Security 2020 · Conference accepted · Frankenstein emulates Bluetooth firmware dumps and fuzzes a virtual modem. It evaluates Broadcom and Cypress stacks, finding three zero-click vulnerabilities, host escalation issues, and BlueFrag on Android.
- [Towards Automated Dynamic Analysis for Linux-based Embedded Firmware](https://awesomerea.org/papers/paper-firmadyne/index.md): 2016 · NDSS 2016 · Conference paper · Firmadyne crawls, extracts and emulates Linux-based firmware for network-connected commercial devices such as routers and IP cameras. It replaces the vendor kernel with pre-built, instrumented kernels for little-endian ARM and little- and big-endian MIPS, boots the extracted filesystem under QEMU full-system emulation with a userspace NVRAM library, infers the network configuration, then runs automated analyses including 60 known and 14 newly found exploits. From 23,035 images across 42 vendors, the authors extracted 9,486 and report 887 of the 1,971 network-reachable images vulnerable to at least one sampled exploit.
- [Automated Dynamic Firmware Analysis at Scale: A Case Study on Embedded Web Interfaces](https://awesomerea.org/papers/paper-dynamic-firmware-analysis-at-scale/index.md): 2015 · arXiv · Preprint · The paper emulates firmware images and uses static and dynamic tools to find vulnerabilities in embedded web interfaces. It evaluated 1,925 images from 54 vendors and found vulnerabilities in 185 images.
- [Avatar: A Framework to Support Dynamic Security Analysis of Embedded Systems’ Firmwares](https://awesomerea.org/papers/paper-avatar/index.md): 2014 · NDSS 2014 · Conference paper · Avatar runs embedded firmware in an instrumented emulator, S²E on QEMU, while forwarding memory-mapped I/O to the real device and injecting the device's interrupts back into the emulator, so firmware that depends on undocumented peripherals can still be analyzed dynamically. The device is reached through JTAG via OpenOCD or through a small debugging stub over a serial line. Because forwarding every access over a 38400-baud serial link is very slow, about five instructions per second in one of the authors' measurements, Avatar also keeps memory that never behaves like I/O local to the emulator, migrates selected code to run natively on the device, and switches state between the two. With S²E's selective symbolic execution, the authors probe a hard-disk mask-ROM bootloader for hidden commands, an IEEE 802.15.4 sensor node for an injected overflow, and the SMS decoding routines of a GSM feature phone.

## Protocol inference and analysis (22)

- [Protocol Reverse Engineering via Deep Transfer Learning](https://awesomerea.org/papers/paper-transre/index.md): 2026 · Proceedings of the ACM on Software Engineering / FSE 2026 · Journal article · Transfers field-boundary patterns from standardized protocol traces labeled by Tshark to poorly documented target protocols. A source-selection stage chooses related protocols, and a neural domain-adaptation model infers message syntax from their shared patterns.
- [RFCLLM: Evaluating LLMs' Reasoning Ability of Network Protocol State Machines](https://awesomerea.org/papers/paper-rfcllm/index.md): 2026 · Findings of EMNLP 2026 · Conference accepted · Tests reasoning over protocol state machines using 1,482 questions across 16 protocols. Four context settings distinguish RFC retrieval from reasoning over supplied transitions; tasks cover next states, conditions, predecessor states and paths.
- [Recovering Process Variables from Industrial Network Traffic via Search-Based Optimization](https://awesomerea.org/papers/paper-pvparser/index.md): 2026 · CCS 2026 · Conference accepted · PVParser recovers process-variable layouts from industrial traffic and historian records. Periodic-pattern detection locates relevant payloads; a modified Monte Carlo tree search proposes field boundaries, types and endianness, then aligns decoded sequences with observed process variables.
- [ICEPRE: ICS Protocol Reverse Engineering via Data-Driven Concolic Execution](https://awesomerea.org/papers/paper-icepre/index.md): 2025 · Proceedings of the ACM on Software Engineering (ISSTA 2025) · Journal article · Infers message-field boundaries by following concrete message-guided paths through binary protocol parsers, then symbolically replaying them to extract byte-level data flow. It merges bytes using value-preserving operations and similar processing traces. For the 1,000-message datasets of four public ICS protocols, the authors report average boundary F1 of 0.76 and field perfection of 0.67.
- [Unleashing the Power of LLM to Infer State Machine From the Protocol Implementation](https://awesomerea.org/papers/paper-protocolgpt/index.md): 2025 · IWQoS 2025 · Conference paper · ProtocolGPT infers protocol state machines from implementation source code with a retrieval-augmented LLM. It extracts state-machine-related code with regular expressions and a code filter, splits it into syntax-aware chunks stored in a FAISS vector store with OpenAI embeddings, and prompts GPT-4 step by step to recover states and message-triggered transitions. On six protocols in five open-source code bases (IKEv2, TLS 1.3, TLS 1.2, BGP, RTSP and L2TP), the authors report transition precision above 90%, more than 30% higher precision and 55% higher recall than baselines. Seeding AFLNet with the inferred machines raised coverage by more than 20% and found two previously unknown crash bugs in an RTSP server.
- [BinPRE: Enhancing Field Inference in Binary Analysis Based Protocol Reverse Engineering](https://awesomerea.org/papers/paper-binpre/index.md): 2024 · ACM CCS 2024 · Conference paper · Infers protocol-message field boundaries and semantics from instrumented server binaries and input messages. BinPRE groups bytes by the instruction operators that process them, applies detectors for field types and functions, then refines results across similar messages. On eight protocols with 50 messages each, the authors report average field perfection of 0.73 and type/function F1 scores of 0.74/0.81.
- [DynPRE: Protocol Reverse Engineering via Dynamic Inference](https://awesomerea.org/papers/paper-dynpre/index.md): 2024 · NDSS 2024 · Conference paper · DynPRE starts from captured client–server traces and then interacts with a live protocol server to infer message formats and types. It detects session-specific identifiers such as cookies and rewrites them on the fly so that replayed requests stay valid. It then sends byte-level probe requests whose responses serve as semantic feedback for field identification, aligns the responses, and applies a request–response mapping refinement that also recognizes message types. On 12 protocols with 10-, 100- and 1,000-message datasets, the authors report average field perfection of 0.50 and message-type V-measure of 0.94, against 0.15–0.31 perfection for Netzob, NetPlier, FieldHunter, BinaryInferno and NEMESYS.
- [Lifting Network Protocol Implementation to Precise Format Specification with Security Applications](https://awesomerea.org/papers/paper-netlifter/index.md): 2023 · ACM CCS 2023 · Conference paper · NetLifter statically lifts source-available C protocol parsers into BNF-style message grammars and first-order constraints between packet fields. It analyzes annotated LLVM bitcode using abstract format graphs, localized path-sensitive analysis, unfolding and reordering. The resulting field boundaries, constraints and names can support packet generation and parser construction.
- [Extracting Protocol Format as State Machine via Controlled Static Loop Analysis](https://awesomerea.org/papers/paper-protocol-format-state-machine/index.md): 2023 · arXiv · Preprint · The paper extracts protocol message formats from parser code by analyzing parsing loops as state machines. It evaluates format inference and the use of the extracted machines in protocol fuzzers.
- [BinaryInferno: A Semantic-Driven Approach to Field Inference for Binary Message Formats](https://awesomerea.org/papers/paper-binaryinferno/index.md): 2023 · NDSS 2023 · Conference paper · Infers partial binary-message formats from static message samples without instrumenting an executable. Specialized detectors recognize floats, timestamps, lengths, entropy boundaries and serialization patterns; a graph-based integration step reconciles their descriptions. Across samples from ten protocols, the authors report top-level field-boundary precision of 0.69, recall of 0.73 and false-positive rate of 0.04 for the 1,000-message setting without analyst priors.
- [The Closer You Look, The More You Learn: A Grey-box Approach to Protocol State Machine Learning](https://awesomerea.org/papers/paper-stateinspector/index.md): 2022 · ACM CCS 2022 · Conference paper · StateInspector learns protocol Mealy machines by combining active message queries with snapshots of runtime memory, without requiring the target’s source code. It identifies candidate state-defining heap locations and uses taint and concolic analysis to merge states, evaluated by the authors on TLS 1.2 and WPA/2 implementations.
- [Fingerprinting and analysis of Bluetooth devices with automata learning](https://awesomerea.org/papers/paper-ble-automata-learning/index.md): 2022 · Formal Methods in System Design · Journal article · Learns Mealy-machine models of Bluetooth Low Energy implementations on physical peripherals by active automata learning. An nRF52840 central running SweynTooth-derived firmware sends abstract BLE inputs, with error handling, repeated queries and caching for lost packets and non-deterministic replies. The authors learn connection-procedure models of six devices and legacy-pairing models of three, and use model differences to fingerprint their SoCs.
- [Automated Attack Synthesis by Extracting Finite State Machines from Protocol Specification Documents](https://awesomerea.org/papers/paper-attack-synthesis-fsm/index.md): 2022 · IEEE Symposium on Security and Privacy 2022 · Conference accepted · Extracts protocol FSMs from RFC prose using technical word representations, zero-shot text mapping, and rules, then uses the extracted FSMs to synthesize attacks.
- [Noncompliance as Deviant Behavior: An Automated Black-box Noncompliance Checker for 4G LTE Cellular Devices](https://awesomerea.org/papers/paper-dikeue/index.md): 2021 · ACM CCS 2021 · Conference paper · DIKEUE checks 4G LTE control-plane (NAS and RRC) implementations in commercial phones and modems for noncompliance through differential testing rather than predefined security properties. Its FSM inference module runs TTT active automata learning in LearnLib through an LTE-specific adapter on a modified srsLTE network with a USRP B210 radio, adding a context checker, query cache, inconsistency resolver and reset without rebooting. An equivalence checker then encodes pairs of learned input-output finite state machines for the nuXmv model checker and enumerates diverse deviation-inducing input sequences, which the authors analyze manually.
- [NetPlier: Probabilistic Network Protocol Reverse Engineering from Message Traces](https://awesomerea.org/papers/paper-netplier/index.md): 2021 · NDSS 2021 · Conference paper · Uses multiple sequence alignment and probabilistic keyword-field inference to cluster network messages by type, evaluated across ten protocols with downstream format and state-machine analysis.
- [LibreCAN: Automated CAN Message Translator](https://awesomerea.org/papers/paper-librecan/index.md): 2019 · ACM CCS 2019 · Conference paper · LibreCAN reverse-engineers proprietary CAN message formats from traffic recorded at a vehicle's OBD-II port, without the OEM's DBC translation files. Phase 0 extracts candidate signal boundaries from bit-flip behaviour, extending the earlier READ algorithm; Phase 1 correlates extracted signals with standard OBD-II PIDs and smartphone IMU data to identify kinematic signals and estimate their scale and offset; Phase 2 filters the CAN IDs recorded while a driver performs 53 scripted body-related events to shortlist candidate IDs for each event.
- [Automatic Wireless Protocol Reverse Engineering](https://awesomerea.org/papers/paper-wireless-protocol-re/index.md): 2019 · 13th USENIX Workshop on Offensive Technologies (WOOT 19) · Conference paper · Infers message formats of proprietary wireless protocols from demodulated physical-layer captures: it aligns messages by preamble and sync word, then uses RSSI and dedicated engines to label length, address, sequence-number and checksum fields, optionally using known addresses or field positions.
- [NEMESYS: Network Message Syntax Reverse Engineering by Analysis of the Intrinsic Structure of Individual Messages](https://awesomerea.org/papers/paper-nemesys/index.md): 2018 · 12th USENIX Workshop on Offensive Technologies (WOOT 18) · Conference paper · Infers approximate field boundaries within individual binary-protocol messages from changes in bit congruence, and introduces Format Match Score to compare inferred segmentation with known protocol dissectors.
- [Towards Automated Protocol Reverse Engineering Using Semantic Information](https://awesomerea.org/papers/paper-netzob/index.md): 2014 · ACM ASIA CCS 2014 · Conference paper · Infers the vocabulary of an undocumented protocol, its message types and formats, from communication traces. The approach uses contextual information embedded in the messages to improve message clustering and the identification of field boundaries; the HAL record lists contextual clustering and semantic sequence alignment as keywords. The authors motivate the work with parsers and traffic generators for network security products, and compare it with their own reimplementations of ASAP, Discoverer and ScriptGen. The first two authors are the authors of Netzob, the open-source protocol reverse-engineering framework.
- [Prospex: Protocol Specification Extraction](https://awesomerea.org/papers/paper-prospex/index.md): 2009 · IEEE S&P 2009 · Conference paper · Prospex infers message formats and a protocol state machine from execution traces of a Linux server handling client sessions. Dynamic taint analysis splits each session into messages and recovers their formats; messages are then clustered into types by input-format, execution and server-impact similarity, such as the system calls, outputs and file paths a message triggers. The observed type sequences form an augmented prefix tree acceptor, which prerequisite and end-state heuristics label before Exbar computes a minimal consistent automaton. The resulting specifications are translated for the Peach fuzzer to reach later protocol states. The evaluation covers the Agobot command-and-control protocol, SMTP on Sendmail, SMB on Samba and SIP on Asterisk.
- [Tupni: Automatic Reverse Engineering of Input Formats](https://awesomerea.org/papers/paper-tupni/index.md): 2008 · ACM CCS 2008 · Conference paper · Tupni infers an input format from an execution trace of an x86 program parsing one input, using byte-level dynamic taint tracking. It segments the input into fields from the instructions that operate on tainted bytes, finds record sequences from parsing loops, groups records into types by the code that handles them, and emits an enhanced BNF grammar with length, value and some inter-message constraints. Grammars from several inputs can be merged into a more complete specification. The evaluation covers five file formats (WMF, BMP, JPG, PNG, TIF) and five network protocols (DNS, RPC, TFTP, HTTP, FTP), and the output is used for zero-day vulnerability signature generation with ShieldGen.
- [Polyglot: Automatic Extraction of Protocol Message Format using Dynamic Binary Analysis](https://awesomerea.org/papers/paper-polyglot/index.md): 2007 · ACM CCS 2007 · Conference paper · Polyglot infers the format of a message that a program receives by monitoring how the program binary processes it, an approach the authors call shadowing. An execution monitor taints network input and records an instruction trace; offline analyses then find direction fields, such as length and pointer fields, from tainted memory accesses and loop conditions, separators from comparisons between tainted bytes and constants, multi-byte fixed-length fields from how instructions group input bytes, and protocol keywords from successful comparisons. It works on stripped IA-32 binaries without source code or debugging information.