A C decompiler converts an executable into source code. The recovered C source code, once re-compiled, is expected to produce an executable with the same functionality as the original executable. With over twenty years of development, C decompilers have been widely used in production to support reverse engineering applications. Despite the prosperous development of C decompilers, it is widely acknowledged that decompiler outputs are mainly used for human consumption, and are not suitable for automatic recompilation. Often, a substantial amount of manual effort is required to fix the decompiler outputs before they can be recompiled and executed properly. This paper is motived by the recent success of large language models (LLMs) in comprehending dense corpus of natural language. To alleviate the tedious, costly and often error-prone manual effort in fixing decompiler outputs, we investigate the feasibility of using LLMs to augment decompiler outputs, thus delivering recompilable decompilation. Note that different from previous efforts that focus on augmenting decompiler outputs with higher readability (e.g., recovering type/variable names), we focus on augmenting decompiler outputs with recompilability, meaning to generate code that can be recompiled into an executable with the same functionality as the original executable. We conduct a pilot study to characterize the obstacles in recompiling the outputs of the de facto commercial C decompiler -- IDA-Pro. We then propose a two-step, hybrid approach to augmenting decompiler outputs with LLMs. We evaluate our approach on a set of popular C test cases, and show that our approach can deliver a high recompilation success rate to over 75% with moderate effort, whereas none of the IDA-Pro's original outputs can be recompiled. We conclude with a discussion on the limitations of our approach and promising future research directions.
翻译:C语言反编译器可将可执行程序转换为源代码。恢复后的C源代码在重新编译后,应生成与原可执行程序功能相同的可执行文件。经过二十余年的发展,C语言反编译器已广泛应用于生产环境以支持逆向工程任务。尽管C语言反编译器发展蓬勃,但业界普遍认为反编译器输出主要用于人工阅读,不适合自动重新编译。通常需要投入大量人工修复工作,才能使反编译输出能够正确重新编译和执行。本文受近期大语言模型在自然语言密集语料理解方面取得成功的启发,为减轻修复反编译器输出时繁琐、昂贵且易出错的人工劳动,我们研究了利用大语言模型增强反编译器输出的可行性,从而生成可重新编译的反编译结果。需注意的是,与以往侧重提升反编译器输出可读性(如恢复类型/变量名)的研究不同,我们聚焦于增强反编译输出的可重新编译性,即生成可重新编译为与原可执行程序功能相同的可执行文件的代码。我们通过预研实验,系统分析了实际商业C语言反编译器IDA-Pro输出无法重新编译的障碍。进而提出了一种结合大语言模型的两阶段混合增强方法。我们在多组主流C语言测试用例上评估了该方法,结果表明,在适度投入下,该方法可实现超过75%的高重新编译成功率,而IDA-Pro的原始输出完全无法重新编译。最后,我们讨论了当前方法的局限性及未来有价值的研究方向。