Pith. sign in

REVIEW 3 major objections 6 minor 2 cited by

D-LiFT: Improving LLM-based Decompiler Backend via Code Quality-driven Fine-tuning

T0 review · 3 major / 6 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read The paper claims that an LLM backend fine-tuned with a code-quality reward that gates readability on syntactic and semantic accuracy improves decompiled code, yielding 55.3% more improved functions than untrained baselines and improving…

desk verdict Useful idea and careful implementation, but headline gains are measured with the same ruler used for training, and that ruler misses external-call argument changes. read the letter →

arxiv 2506.10125 v3 pith:JZ6RX6W7 submitted 2025-06-11 cs.CR cs.SE

Muqi Zou , Hongyu Cai , Hongwei Wu , Zion Leonahenahe Basque , Arslan Khan , Berkay Celik , Dave (Jing) Tian , Antonio Bianchi
show 2 more authors
Ruoyu (Fish) Wang Dongyan Xu
This is my paper
classification cs.CRcs.SE
keywords decompilationlargelanguagemodelsreinforcementlearningGRPOcodequalityassessmentreadabilitysemanticequivalencesymbolicexecution
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

D-LIFT claims that the right way to improve decompiler output with an LLM is to train the LLM with a reward that refuses to reward readability unless the code is first shown to be accurate. The paper builds D-Score, a three-stage score that checks syntax, then compares semantics against the original binary via symbolic execution, and only then scores readability; this reward drives GRPO fine-tuning of small LLMs and also selects the best output at inference. On accurately decompiled functions from coreutils and util-linux, the fine-tuned models improve 55.3% more functions than untrained baselines, and the complete D-LIFT pipeline improves 68.2% of the functions, with most gains coming from the fine-tuned model rather than the baseline. The paper also finds that originally inaccurate decompiler output is nearly unfixable by the LLM backend, an asymmetry that locates where future effort should go.

What carries the argument

The central object is D-Score, a deterministic, multi-aspect scoring function used both as the RL reward and as the inference-time selection metric. It first attempts to recompile the candidate code and assigns a syntax penalty on failure; if that passes, it uses symbolic execution plus an SMT solver to compare two behavioral models against the original binary, one encoding return values over symbolic inputs and one encoding the number of external function calls along each path; only if both pass does it compute a readability score as a weighted combination of the B&W and R2I feature sets. The score is engineered so that any syntax penalty is worse than any semantic penalty, which is worse than the best readability reward, encoding the paper's principle of preserving accuracy while improving readability. Training uses GRPO with rewards normalized within each candidate group and with the KL-reference weight set to zero, which removes dependence on a single ground-truth source and accommodates the fact that one binary can have many valid source representations.

What would settle it

On the functions D-LIFT reports as improved, rerun D-Score's semantic check with external function call return values varied across 0, 1, and -1 instead of the fixed default, and count how many flagged accurate improvements fail under at least one constant; a large failure share would show the accuracy gate is too permissive. A blinded human study of readability and equivalence on the same function pairs would independently check whether the D-Score gains are real.

Watch

Extended reading notes

Core claim

On its own terms, the paper's discovery is that code-quality-aware reinforcement learning can make an LLM a reliable readability-improving backend for a decompiler without sacrificing accuracy, and that the same quality metric can be reused as an inference-time selector. Trained models improve 84.9% of originally accurate functions on average (D-Score +0.517) versus 70.2% for the best baseline, and the overall pipeline improves 68.2% of such functions, with 47.3% attributable to the fine-tuned model and 20.9% to the baseline. The paper further shows a sharp improve-ability gap: LLMs improve only 8.02% of originally inaccurate functions, which it explains as a limit of working from decompiler output that is already missing types, instructions, or initialization. This asymmetry supports its principle that LLM post-processing should be aimed at preserving accuracy while improving readability, not at repairing decompiler failures.

Load-bearing premise

The whole pipeline rests on D-Score being a true measure of decompiled-code quality: if its readability features do not track human preferences, or its semantic check lets inaccurate code pass because external calls are assumed to return a constant, then the fine-tuned model is optimizing the metric rather than the code.

Editorial extensions

If this is right

  • Any LLM-based decompiler backend should train and select outputs only with rewards that gate readability on passing syntax and semantic checks, rather than optimizing readability alone.
  • Because D-Score is used both as the training reward and as the inference selector, the model is optimized for the same signal that picks the final output, reducing train-versus-serve mismatch.
  • With only 8.02% improvement on originally inaccurate functions, gains from LLM post-processing are capped by the quality of the initial decompilation, so improving the decompiler front-end is a necessary complement.
  • Across three small LLMs, the fine-tuned model is the best output for about 43% to 49.8% of functions, indicating that the training step, not merely the inference-time selection, produces most of the improvement.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Because D-Score assumes every external function call returns a constant (0), functions whose behavior changes when a callee returns nonzero may pass the accuracy gate while actually diverging; rerunning the semantic check with multiple constant return values would likely reassign some reported improvements to the inaccurate class.
  • The paper accepts B&W and R2I as valid readability metrics rather than re-validating them on decompiled output; a small human study comparing blinded D-LIFT and native-decompiler outputs would test whether D-Score gains correspond to human-perceived readability.
  • The evaluation uses GCC -O2 on x86 binaries from coreutils and util-linux; the improve-ability numbers could shift for other compilers, optimization levels, or architectures where decompiler artifacts differ.
  • The improve-ability gap points to a design opportunity: an LLM backend that can repair structural defects such as undefined types or missing initializations, rather than only polish readable output, might extend benefits to the functions D-LIFT currently cannot fix.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 6 minor

Summary. The paper proposes D-LIFT, a pipeline that fine-tunes a small LLM with GRPO using a novel code-quality metric called D-SCORE, and at inference selects the best output among the native decompiler, the baseline LLM, and the fine-tuned LLM. D-SCORE combines a syntax recompilation check, a symbolic-execution-based semantic check (comparing return values and external-call counts), and a readability score aggregating B&W and R2I. The evaluation on coreutils/util-linux functions reports that fine-tuned LLMs improve 55.3% more functions than baselines and that the selection system improves 68.2% of originally accurate decompiled functions according to D-SCORE. The paper also documents a sharp 'improve-ability gap': LLMs rarely improve originally inaccurate decompiled functions.

Significance. If the results hold, D-LIFT would be a useful step toward making LLM-based decompiler backends accuracy-aware, and D-SCORE could serve as a reward signal for training and a selection metric for inference. The paper is clearly written, the pipeline is reproducible (the authors release training scripts and evaluation results), and the finding that LLMs struggle with originally inaccurate decompiled output is an honest and potentially influential empirical result. However, the central quantitative claims rest entirely on D-SCORE, which is both the training reward and the evaluation metric, and D-SCORE's semantic check has a significant blind spot with respect to external-call arguments. Until that measurement foundation is strengthened, the headline improvements cannot be taken as evidence of genuine code-quality gains.

major comments (3)
  1. [IV-A1 and VI-B] D-SCORE is used as the GRPO reward in training (Section IV-A1) and as the evaluation metric for the reported improvements (Section VI-B). The headline results — 55.3% more improved functions and 68.2% improved overall — therefore measure improvement in the training objective itself. The paper's validation of D-SCORE (Section VI-A1, Table II) is a 100-function human spot-check of the accuracy check only, and the readability component is accepted without validation ('we accept its validity'). Because the central claim is that D-LIFT improves decompiled code quality, the authors should add an independent evaluation: for example, comparing against the original source code, a human readability study on decompiled output, or at least a held-out metric that was not used as a reward. Without such validation, the reported gains may reflect overfitting to the reward rather than genuine quality improvement.
  2. [IV-B2, Eq. (6)] The semantic check in D-SCORE compares only return values (Symbolic-Model-Ret) and the number of external function calls per execution path (Symbolic-Model-Call); it never compares the arguments passed to external functions. Under the constant-return assumption described in Section VI-A1 and Section VII, an LLM output that changes a call's arguments (e.g., swapping fd and buffer in write, changing an ioctl request constant, or altering a strcmp length) will preserve both the call count and the modeled return values and will receive full readability credit. Since D-SCORE is both the training reward and the inference-time selection metric, the fine-tuned model can be rewarded for semantically changing code. The manual review in Table V does not report checking external-call arguments, and the precision study in Table II uses the same constant-return model. To support the 'preserving accuracy' principle, the authors should extend Symbolic-Model-Call to compare call arguments, or provide a mutation study showing that such errors are caught, or explicitly narrow the accuracy guarantee to exclude external-call argument fidelity.
  3. [Abstract and VI-C] The abstract and conclusion state that D-LIFT improves '68.2% of all the functions produced by the native decompiler,' but this figure is computed in Section VI-B on the 725 originally accurate (OA) functions only. For the 548 originally inaccurate (OIA) functions, Section VI-C reports an improvement rate of only 8.02% (44 of 548), and across the full 1,273-function evaluation set the combined improvement rate is 52.6% (669 functions). The '68.2%' claim averages the three models' selection-system results on the OA subset (70.9%, 67.7%, 65.8%). The abstract and conclusion should be rephrased to state the OA-only scope, e.g., 'for functions that are accurately decompiled by the native decompiler.'
minor comments (6)
  1. [II-D] The sentence 'As shown in Table III, an average 44.2% of functions that were originally accurate become inaccurate after LLM processing' does not match the table: the average of the three newer LLMs is 44.4%, and including LLM4Decompile gives 56.6%. Please correct the sentence or clarify the subset being averaged.
  2. [IV-B3, Eq. (8)] Equation (8) states that the B&W relative score is passed 'through a sigmoid function to map it into the range [-1,1]', but a standard logistic sigmoid maps to (0,1). If a scaled sigmoid or tanh is intended, please define it. Also, the parameter r in Equation (9) is never defined.
  3. [V-C] The weights gamma=0.25 and delta=0.75 in Equation (7) are fixed without sensitivity analysis. Since the readability score is a weighted sum, a brief discussion of how these weights affect the reported improvements would strengthen the paper.
  4. [Table IV] The 'improved'/'regressed' counts in Table IV treat any nonzero D-SCORE difference as a change. Reporting the distribution of score differences (e.g., how many functions improve by less than 0.05) would help readers assess whether the gains are practically meaningful or merely statistical.
  5. [Title and text] The manuscript uses 'D-LiFT' in the title but 'D-LIFT' throughout the body; please unify the notation.
  6. [VI-B1] The sentence 'by taking the best output among all six LLMs and the original decompiled code' describes an oracle selection that is not the actual pipeline; the real pipeline selects among three outputs per model (decompiler, baseline, fine-tuned) as shown in Figure 7. Clarify this distinction.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: held-out D-Score evaluation and manual review provide independent support; the shared reward/metric is a validity concern, not a derivation loop.

full rationale

The paper's claimed derivation chain is not circular. D-Score is defined in Section IV-B as a three-stage scorer (syntax, semantic, readability). The GRPO training objective (Eq. 1-2) uses D-Score as reward, and the evaluation in Section VI-B reports D-Score changes. This is a shared evaluation metric, but the reported improvements are on held-out functions (725 OA) not used in training, so the result is not forced by construction. The paper also provides independent evidence: manual review of 100 functions (Table V) and a precision evaluation of the accuracy check (Table II). The constant-return modeling of external calls is an explicitly stated limitation (Section VII), not a circular reduction. The D-helix component is a published, peer-reviewed tool with its own evaluation, so citing it is not a self-citation chain. No equation in the paper reduces to its own inputs; the D-Score definition and the training objective are distinct quantities, and the evaluation is out-of-sample. Therefore, no significant circularity is present.

Assumptions & free parameters 7 free parameters · 4 assumptions · 0 invented entities

The central claim relies on D-SCORE being a faithful proxy for decompiled-code quality. That proxy is assembled from hand-tuned penalties, a semantic check inherited from the authors' prior D-helix work, an assumed readability validity, and an exclusion of 19.3% of functions that D-SCORE cannot analyze. These choices, rather than the RL method alone, determine the reported improvement numbers.

free parameters (7)
  • syntax penalty syn_pen = -3
    Hand-chosen in Section V.C to keep syntax failures below semantic penalties; directly determines the reward and hence the trained model.
  • return-value penalty ret_pen = -2
    Hand-chosen in Section V.C as part of the semantic penalty scale.
  • call-count penalty call_pen = -1.5
    Hand-chosen in Section V.C as the smallest accuracy penalty, still below readability score range.
  • readability weight gamma = 0.25
    Weight for the B&W readability component in Equation (7), chosen from 'experimental observations' in Section V.C; shapes both reward and evaluation.
  • readability weight delta = 0.75
    Weight for the R2I readability component in Equation (7), hand-tuned in Section V.C.
  • external call return value = 0
    Assumed constant return value for all external function calls in the semantic check (Section VII); acknowledged to cause false negatives.
  • function complexity thresholds = at least 20 lines and cyclomatic complexity > 3
    Data selection filter in Section VI-A1 that defines which decompiled functions enter the training and evaluation sets.
assumptions (4)
  • domain assumption D-Score's symbolic-execution semantic check correctly approximates semantic equivalence between candidate code and the original binary.
    Adopted from D-helix (self-citation [75]) in Section IV-B2; the paper reports a precision of 0.91 on 100 samples but also documents false negatives from assuming external calls return a constant.
  • domain assumption The weighted aggregation of R2I and B&W readability metrics measures readability of LLM-generated decompiled code.
    Explicitly asserted without evaluation in Section VI-A1: 'Because our readability metric is an aggregation of two established metrics [10], [17], we accept its validity.'
  • domain assumption GRPO with beta=0 (no KL reference) is a valid training objective for this task.
    Stated in Section IV-A1 citing recent results; the paper does not compare against GRPO with a nonzero KL term.
  • domain assumption D-Score applicability to 80.7% of functions and non-applicability to the remaining 19.3% does not bias the reported improvements.
    Section VI-A1 excludes 375 of 1,948 functions (timeouts, tool errors, unsupported instructions) from all reported results; the effect of this exclusion on headline numbers is not analyzed.

how reviews work

0 comments
Cite this review

Pith. "Pith review of D-LiFT: Improving LLM-based Decompiler Backend via Code Quality-driven Fine-tuning." pith.science (2026). https://pith.science/paper/JZ6RX6W7

@misc{pith2026250610125,
  author       = {Pith},
  title        = {Pith review of: D-LiFT: Improving LLM-based Decompiler Backend via Code Quality-driven Fine-tuning},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/JZ6RX6W7}},
  note         = {Machine review of arXiv:2506.10125}
}
read the original abstract

As one of the key tools in many security tasks, decompilers reconstruct human-readable source code from binaries. Yet, despite recent advances, their outputs often suffer from syntactic and semantic errors and remain difficult to read. Recently, with the advent of large language models (LLMs), researchers began to explore the potential of LLMs to refine decompiler output. Nevertheless, our study of these approaches reveals their problems, such as introducing new errors and relying on unreliable accuracy validation. In this paper, we present D-LIFT, an enhanced decompiler-LLM pipeline with a fine-tuned LLM using code quality-aware reinforcement learning. Unlike prior work that overlooks preserving accuracy, D-LIFT adheres to a key principle for enhancing the quality of decompiled code: preserving accuracy while improving readability. Central to D-LIFT, we propose D-Score, an integrated code quality assessment system to score the decompiled source code from multiple aspects, and use it to guide reinforcement learning fine-tuning and to select the best output during inference. In line with our principle, D-Score assigns low scores to any inaccurate output and only awards higher scores for readability to code that passes the accuracy check. Our implementation, based on Ghidra and a range of LLMs, demonstrates significant improvements for the accurate decompiled code from the coreutils and util-linux projects. Compared to baseline LLMs without D-Score-driven fine-tuning, our trained LLMs produce 55.3% more improved decompiled functions, as measured by D-Score. Overall, D-LIFT improves the quality of 68.2% of all the functions produced by the native decompiler.

Figures

Figures reproduced from arXiv: 2506.10125 by the authors.

Figure 1
Figure 1. The code snippet shows the original decompiled code, its corresponding source code, and the version improved by the GPT-o4-mini, where the line 17 [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. Two code snippets generate the same binary code. Notably, differences [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 3
Figure 3. This figure shows how D-LIFT fine-tunes the baseline model and selects the output. It applies GRPO to overcome "single decompiled code segments can correspond to multiple semantically equivalent source representations" in training and uses D-SCORE to select the best quality code among inference. to fine-tune the LLM, ultimately producing a model with improved decompilation capabilities. Then in the inference phase, … view at source ↗
Figures from the paper (7 more)
Figure 4
Figure 4. Figure 4: D-SCORE, following our principle of preserving accuracy while improving readability. It performs three sequential checks on each candidate code: syntax/semantic verification, and readability assessment. If any of the accuracy checks fail, D-SCORE halts immediately and …
Figure 5
Figure 5. Figure 5: The workflow of semantic check in D-SCORE. The left side shows how the function return value is checked, and the right side shows how the external function call is examined. For both scenarios, D-SCORE runs symbolic execution with symbolic inputs. After that, it constr…
Figure 6
Figure 6. Figure 6: The performance of Different models on the [PITH_FULL_IMAGE:figures/full_fig_p009_6.png]
Figure 7
Figure 7. Figure 7: Overall performance of the selection system within [PITH_FULL_IMAGE:figures/full_fig_p010_7.png]
Figure 8
Figure 8. Figure 8: This code snippet shows how D-LIFT helps Qwen2.5-Coder-3B enhance its ability to generate more readable code while correcting the syntax error “error: subscripted value is neither array nor pointer nor vector” that appears at line 7 of the baseline output. Source: 1 if…
Figure 9
Figure 9. Figure 9: This code snippet shows how D-LIFT helps Qwen2.5-Coder-1.5B enhance its ability to generate more readable code while correcting the syntax error “error: lvalue required as left operand of assignment.” that appears at line 5 of the baseline output. improvement for those…
Figure 10
Figure 10. Figure 10: This code snippet shows how D-LIFT helps Qwen2.5-Coder-3B enhance its ability to generate more readable code while correcting the semantic error. Specifically, the return value -65538 at line 8 and line 11 of the baseline output is not the same as 0xffffffea. cannot r…

Discussion (0). Sign in to comment.

Forward citations

Cited by 2 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. NotDec: WebAssembly Decompilation With Inter-Procedural Type Recovery

    cs.SE 2026-08 conditional novelty 6.0 of 10

    NotDec decompiles WebAssembly to readable C with 100% recompilability and 85.33% struct access recovery, far exceeding Ghidra, by combining Retypd type recovery with a new pointer/numeric differentiation graph.

  2. CoDe-R: Refining Decompiler Output with LLMs via Rationale Guidance and Adaptive Inference

    cs.SE 2026-04 unverdicted novelty 6.0 of 10

    Rationale-guided fine-tuning plus dual-path adaptive inference lifts a 1.3B decompiler refiner to 50% average re-executability, a new lightweight SOTA on HumanEval-Decompile.

Reference graph

Works this paper leans on

77 extracted references · 63 canonical work pages · cited by 2 Pith papers

  1. [1]

    Free Software Foundation. Gcc. https://gcc.gnu.org/

    work page

  2. [2]

    Hex rays decompiler

    Hex-Rays SA. Hex rays decompiler. https://hex-rays.com/decompiler/

    work page

  3. [3]

    National Security Agency. Ghidra. https://ghidra-sre.org/

    work page

  4. [4]

    Claude AI (Claude 3, May 2025 version)

    Anthropic. Claude AI (Claude 3, May 2025 version). https://claude.ai,

    work page 2025

  5. [5]

    RetDec: A retargetable machine-code decompiler

    Avast Software. RetDec: A retargetable machine-code decompiler. https: //retdec.com/

    work page

  6. [6]

    Jinze Bai, Shuai Bai, Yunfei Chu, Zeyu Cui, Kai Dang, Xiaodong Deng, Yang Fan, Wenhang Ge, Yu Han, Fei Huang, Binyuan Hui, Luo Ji, Mei Li, Junyang Lin, Runji Lin, Dayiheng Liu, Gao Liu, Chengqiang Lu, K. Lu, Jianxin Ma, Rui Men, Xingzhang Ren, Xuancheng Ren, Chuanqi Tan, Sinan Tan, Jianhong Tu, Peng Wang, Shijie Wang, Wei Wang, Shengguang Wu, Benfeng Xu, ...

    arXiv 2023

  7. [7]

    Ahoy SAILR! there is no need to DREAM of c: A Compiler- Aware structuring algorithm for binary decompilation

    Zion Leonahenahe Basque, Ati Priya Bajaj, Wil Gibbs, Jude O’Kain, Derron Miao, Tiffany Bao, Adam Doupé, Yan Shoshitaishvili, and Ruoyu Wang. Ahoy SAILR! there is no need to DREAM of c: A Compiler- Aware structuring algorithm for binary decompilation. In33rd USENIX Security Symposium (USENIX Security 24), pages 361–378, Philadelphia, PA, August 2024. USENI...

    work page 2024

  8. [8]

    Native x86 decompilation using{Semantics-Preserving} structural analysis and iterative {Control-Flow} structuring

    David Brumley, JongHyup Lee, Edward J Schwartz, and Maverick Woo. Native x86 decompilation using{Semantics-Preserving} structural analysis and iterative {Control-Flow} structuring. In22nd USENIX Security Symposium (USENIX Security 13), pages 353–368, 2013

    work page 2013

Show all 77 references
  1. [9]

    Decomperson: How humans decompile and what we can learn from it

    Kevin Burk, Fabio Pagani, Christopher Kruegel, and Giovanni Vigna. Decomperson: How humans decompile and what we can learn from it. In31st USENIX Security Symposium (USENIX Security 22), pages 2765–2782, Boston, MA, August 2022. USENIX Association

    2022

  2. [10]

    Buse and Westley R

    Raymond P.L. Buse and Westley R. Weimer. Learning a metric for code readability.IEEE Transactions on Software Engineering, 36(4):546–558, 2010

    2010

  3. [11]

    Evaluating the effectiveness of decompilers

    Ying Cao, Runze Zhang, Ruigang Liang, and Kai Chen. Evaluating the effectiveness of decompilers. InProceedings of the 33rd ACM SIGSOFT International Symposium on Software Testing and Analysis, ISSTA 2024, page 491–502, New York, NY, USA, 2024. Association for Computing Machinery

    2024

  4. [12]

    Schwartz, Claire Le Goues, Graham Neubig, and Bogdan Vasilescu

    Qibin Chen, Jeremy Lacomis, Edward J. Schwartz, Claire Le Goues, Graham Neubig, and Bogdan Vasilescu. Augmenting decompiler output with learned variable names and types. In31st USENIX Security Symposium (USENIX Security 22),pages 4327–4343,Boston,MA,August

  5. [13]

    coreutils

    coreutils. coreutils. http://git.savannah.gnu.org/gitweb/?p=coreutils.git

  6. [14]

    Z3: An efficient smt solver

    Leonardo De Moura and Nikolaj Bjørner. Z3: An efficient smt solver. In Proceedings of the Theory and Practice of Software, 14th International Conference on Tools and Algorithms for the Construction and Analysis of Systems, TACAS’08/ETAPS’08, page 337–340, Berlin, Heidelberg,

  7. [15]

    Stepcoder: Improve code generation with reinforcement learning from compiler feedback.arXiv preprint arXiv:2402.01391, 2024

    Shihan Dou, Yan Liu, Haoxiang Jia, Limao Xiong, Enyu Zhou, Wei Shen, Junjie Shan, Caishuang Huang, Xiao Wang, Xiaoran Fan, et al. Stepcoder: Improve code generation with reinforcement learning from compiler feedback.arXiv preprint arXiv:2402.01391, 2024

    2024 arXiv

  8. [16]

    Schwartz, Bogdan Vasilescu, and Claire Le Goues

    Luke Dramko, Jeremy Lacomis, Edward J. Schwartz, Bogdan Vasilescu, and Claire Le Goues. A taxonomy of c decompiler fidelity issues. In 33rd USENIX Security Symposium (USENIX Security 24), pages 379–396, Philadelphia, PA, August 2024. USENIX Association

    2024

  9. [17]

    R2i: A relative readability metric for decompiled code.Proc

    Haeun Eom, Dohee Kim, Sori Lim, Hyungjoon Koo, and Sungjae Hwang. R2i: A relative readability metric for decompiled code.Proc. ACM Softw. Eng., 1(FSE), July 2024

    2024

  10. [18]

    Curran Associates Inc., Red Hook, NY, USA, 2019

    Cheng Fu,Huili Chen,Haolan Liu,Xinyun Chen,Yuandong Tian,Farinaz Koushanfar, and Jishen Zhao.Coda: an end-to-end neural program decompiler. Curran Associates Inc., Red Hook, NY, USA, 2019

    2019

  11. [19]

    Github copilot

    GitHub and OpenAI. Github copilot. https://github.com/features/copilot,

  12. [20]

    Gemini Code Assist

    Google. Gemini Code Assist. https://developers.google.com/gemini- code-assist, 2025. Accessed: 2025-06-04

    2025

  13. [21]

    The llama 3 herd of models, 2024

    Aaron Grattafiori, Abhimanyu Dubey, Abhinav Jauhri, Abhinav Pandey, and Abhishek Kadian et al. The llama 3 herd of models, 2024

    2024

  14. [22]

    Queryx: Symbolic query on decompiled code for finding bugs in cots binaries

    HyungSeok Han, JeongOh Kyea, Yonghwi Jin, Jinoh Kang, Brian Pak, and Insu Yun. Queryx: Symbolic query on decompiled code for finding bugs in cots binaries. In2023 IEEE Symposium on Security and Privacy (SP), pages 3279–3295, 2023

    2023

  15. [23]

    On the importance and shortcomings of code readability metrics: A case study on reactive programming, 2021

    Gustaf Holst and Felix Dobslaw. On the importance and shortcomings of code readability metrics: A case study on reactive programming, 2021

    2021

  16. [24]

    Open-reasoner-zero: An open source approach to scaling up reinforcement learning on the base model, 2025

    Jingcheng Hu, Yinmin Zhang, Qi Han, Daxin Jiang, Xiangyu Zhang, and Heung-Yeung Shum. Open-reasoner-zero: An open source approach to scaling up reinforcement learning on the base model, 2025

    2025

  17. [25]

    Degpt: Optimizing decompiler output with llm.Proceedings 2024 Network and Distributed System Security Symposium, 2024

    Peiwei Hu, Ruigang Liang, and Kai Chen. Degpt: Optimizing decompiler output with llm.Proceedings 2024 Network and Distributed System Security Symposium, 2024

    2024

  18. [26]

    Qwen2.5-coder technical report.ArXiv, abs/2409.12186, 2024

    Binyuan Hui, Jian Yang, Zeyu Cui, Jiaxi Yang, Dayiheng Liu, Lei Zhang, Tianyu Liu, Jiajun Zhang, Bowen Yu, Kai Dang, An Yang, Rui Men, Fei Huang, Shanghaoran Quan, Xingzhang Ren, Xuancheng Ren, Jingren Zhou, and Junyang Lin. Qwen2.5-coder technical report.ArXiv, abs/2409.12186, 2024

    2024 arXiv

  19. [27]

    A survey on large language models for code generation, 2024

    Juyong Jiang, Fan Wang, Jiasi Shen, Sungju Kim, and Sunghun Kim. A survey on large language models for code generation, 2024

    2024

  20. [28]

    Linxi Jiang, Xin Jin, and Zhiqiang Lin. Beyond classification: Inferring function names in stripped binaries via domain adapted llms.Pro- ceedings of the 2025 on ACM SIGSAC Conference on Computer and Communications Security, 2025

    2025

  21. [29]

    Towards neural decompilation.ArXiv, abs/1905.08325, 2019

    Omer Katz, Yuval Olshaker, Yoav Goldberg, and Eran Yahav. Towards neural decompilation.ArXiv, abs/1905.08325, 2019

    1905 arXiv

  22. [30]

    Gonzalez, Hao Zhang, and Ion Stoica

    Woosuk Kwon, Zhuohan Li, Siyuan Zhuang, Ying Sheng, Lianmin Zheng, Cody Hao Yu, Joseph E. Gonzalez, Hao Zhang, and Ion Stoica. Efficient memory management for large language model serving with pagedattention, 2023

    2023

  23. [31]

    Ghidramcp: Mcp server for ghidra

    LaurieWired. Ghidramcp: Mcp server for ghidra. https://github.com/ LaurieWired/GhidraMCP, 2025. Accessed: 2025-06-04

    2025

  24. [32]

    Coderl: Mastering code generation through pretrained models and deep reinforcement learning.Advances in Neural Information Processing Systems, 35:21314–21328, 2022

    Hung Le, Yue Wang, Akhilesh Deepak Gotmare, Silvio Savarese, and Steven Chu Hong Hoi. Coderl: Mastering code generation through pretrained models and deep reinforcement learning.Advances in Neural Information Processing Systems, 35:21314–21328, 2022

    2022

  25. [33]

    TIE: principled reverse engineering of types in binary programs

    JongHyup Lee, Thanassis Avgerinos, and David Brumley. TIE: principled reverse engineering of types in binary programs. InProceedings of the Network and Distributed System Security Symposium, NDSS 2011, San Diego, California, USA, 6th February - 9th February 2011. The Internet ...

    2011

  26. [34]

    When function signature recovery meets compiler optimization

    Yan Lin and Debin Gao. When function signature recovery meets compiler optimization. In2021 IEEE Symposium on Security and Privacy (SP), pages 36–52, 2021

    2021

  27. [35]

    Zhang,and Dongyan Xu

    Zhiqiang Lin,X. Zhang,and Dongyan Xu. Automatic reverse engineering of data structures from binary execution. InNetwork and Distributed System Security Symposium, 2010

    2010

  28. [36]

    Understanding llms: A comprehensive overview from training to inference, 2024

    Yiheng Liu, Hao He, Tianle Han, Xu Zhang, Mengyuan Liu, Jiaming Tian, Yutong Zhang, Jiaqi Wang, Xiaohui Gao, Tianyang Zhong, Yi Pan, Shaochen Xu, Zihao Wu, Zhengliang Liu, Xin Zhang, Shu Zhang, Xintao Hu, Tuo Zhang, Ning Qiang, Tianming Liu, and Bao Ge. Understanding llms: A c...

    2024

  29. [37]

    How farwe have come: testing decompilation correctness of c decompilers

    Zhibo Liu and Shuai Wang. How farwe have come: testing decompilation correctness of c decompilers. InProceedings of the 29th ACM SIGSOFT International Symposium on Software Testing and Analysis, ISSTA 2020, page 475–487, New York, NY, USA, 2020. Association for Computing Machinery

    2020

  30. [38]

    Understanding r1-zero-like training: A critical perspective, 2025

    Zichen Liu, Changyu Chen, Wenjun Li, Penghui Qi, Tianyu Pang, Chao Du, Wee Sun Lee, and Min Lin. Understanding r1-zero-like training: A critical perspective, 2025

    2025

  31. [39]

    Lopes, Juneyoung Lee, Chung-Kil Hur, Zhengyang Liu, and John Regehr

    Nuno P. Lopes, Juneyoung Lee, Chung-Kil Hur, Zhengyang Liu, and John Regehr. Alive2: bounded translation validation for llvm. InProceedings of the 42nd ACM SIGPLAN International Conference on Programming Language Design and Implementation, PLDI 2021, page 65–79, New York, NY, ...

    2021

  32. [40]

    The convergence of source code and binary vulnerability discovery – a case study

    Alessandro Mantovani, Luca Compagna, Yan Shoshitaishvili, and Davide Balzarotti. The convergence of source code and binary vulnerability discovery – a case study. InProceedings of the 2022 ACM on Asia Conference on Computer and Communications Security, ASIA CCS ’22, page 602–6...

    2022

  33. [41]

    Thomas J. McCabe. A complexity measure.IEEE Transactions on Software Engineering, SE-2(4):308–320, 1976

    1976

  34. [42]

    An empirical validation ofcognitive complexityas a measure ofsource code understand- ability

    Marvin Muñoz Barón, Marvin Wyrich, and Stefan Wagner. An empirical validation ofcognitive complexityas a measure ofsource code understand- ability. InProceedings of the 14th ACM / IEEE International Symposium on Empirical Software Engineering and Measurement (ESEM), ESEM ’20, ...

    2020

  35. [43]

    NVIDIA Data Center Deep Learning Product Performance AI Inference.NVIDIA Developer

    NVIDIA. NVIDIA Data Center Deep Learning Product Performance AI Inference.NVIDIA Developer

  36. [44]

    Goucher, Adam Perelman, and Aditya Ramesh et al

    OpenAI, :, Aaron Hurst, Adam Lerer, Adam P. Goucher, Adam Perelman, and Aditya Ramesh et al. Gpt-4o system card, 2024

    2024

  37. [45]

    ChatGPT (May 2025 version)

    OpenAI. ChatGPT (May 2025 version). https://chat.openai.com, 2025. Large language model. Accessed: 2025-06-04

    2025

  38. [46]

    Generating refactored code accurately using reinforcement learning.arXiv preprint arXiv:2412.18035, 2024

    Indranil Palit and Tushar Sharma. Generating refactored code accurately using reinforcement learning.arXiv preprint arXiv:2412.18035, 2024

    2024 arXiv

  39. [47]

    Lost in translation: A study of bugs introduced by large language models while translating code

    Rangeet Pan, Ali Reza Ibrahimzada, Rahul Krishna, Divya Sankar, Lambert Pouguem Wassi, Michele Merler, Boris Sobolev, Raju Pavuluri, Saurabh Sinha, and Reyhaneh Jabbarvand. Lost in translation: A study of bugs introduced by large language models while translating code. In Proc...

    2024

  40. [48]

    A simpler model of software readability

    Daryl Posnett, Abram Hindle, and Premkumar Devanbu. A simpler model of software readability. InProceedings of the 8th Working Conference on Mining Software Repositories, MSR ’11, page 73–82, New York, NY, USA, 2011. Association for Computing Machinery

    2011

  41. [49]

    Automatically mitigating vulnerabilities in binary programs via partially recompilable decompilation.IEEE Transactions on Dependable and Secure Computing, 22:2270–2282, 2022

    Pemma Reiter,Hui Jun Tay, Westley Weimer,Adam Doupé,Ruoyu Wang, and Stephanie Forrest. Automatically mitigating vulnerabilities in binary programs via partially recompilable decompilation.IEEE Transactions on Dependable and Secure Computing, 22:2270–2282, 2022

    2022

  42. [50]

    Learning by playing solving sparse reward tasks from scratch

    Martin Riedmiller, Roland Hafner, Thomas Lampe, Michael Neunert, Jonas Degrave, Tom Wiele, Vlad Mnih, Nicolas Heess, and Jost Tobias Springenberg. Learning by playing solving sparse reward tasks from scratch. InInternational conference on machine learning, pages 4344–

  43. [51]

    Code llama: Open foundation models for code, 2023

    Baptiste Rozière, Jonas Gehring, Fabian Gloeckle, Sten Sootla, Itai Gat, Xiaoqing Ellen Tan, Yossi Adi, Jingyu Liu, Romain Sauvestre, Tal Remez,Jérémy Rapin,Artyom Kozhevnikov,Ivan Evtimov,Joanna Bitton, Manish Bhatt, Cristian Canton Ferrer, Aaron Grattafiori, Wenhan Xiong, Al...

    2023

  44. [52]

    A comprehensive model for code readability.J

    Simone Scalabrino, Mario Linares-Vásquez, Rocco Oliveto, and Denys Poshyvanyk. A comprehensive model for code readability.J. Softw. Evol. Process, 30(6), June 2018

    2018

  45. [53]

    Proximal policy optimization algorithms, 2017

    John Schulman, Filip Wolski, Prafulla Dhariwal, Alec Radford, and Oleg Klimov. Proximal policy optimization algorithms, 2017

    2017

  46. [54]

    Zhihong Shao, Peiyi Wang, Qihao Zhu, Runxin Xu, Junxiao Song, Xiao Bi, Haowei Zhang, Mingchuan Zhang, Y. K. Li, Y. Wu, and Daya Guo. Deepseekmath: Pushing the limits of mathematical reasoning in open language models, 2024

    2024

  47. [55]

    Execution-basedcodegeneration usingdeepreinforcementlearning.arXiv preprint arXiv:2301.13816, 2023

    Parshin Shojaee, Aneesh Jain, Sindhu Tipirneni, and Chandan K Reddy. Execution-basedcodegeneration usingdeepreinforcementlearning.arXiv preprint arXiv:2301.13816, 2023

    2023 arXiv

  48. [56]

    Llm4decompile: Decompiling binary code with large language models

    Hanzhuo Tan, Qi Luo, Jing Li, and Yuqun Zhang. Llm4decompile: Decompiling binary code with large language models. InConference on Empirical Methods in Natural Language Processing, 2024

    2024

  49. [57]

    Llm-vectorizer: Llm-based verified loop vectorizer.arXiv preprint arXiv:2406.04693, 2024

    Jubi Taneja, Avery Laird, Cong Yan, Madan Musuvathi, and Shuvendu K Lahiri. Llm-vectorizer: Llm-based verified loop vectorizer.arXiv preprint arXiv:2406.04693, 2024

    2024 arXiv

  50. [58]

    automatically assessing code understand- ability

    Asher Trockman, Keenen Cates, Mark Mozina, Tuan Nguyen, Christian Kästner,and Bogdan Vasilescu. "automatically assessing code understand- ability" reanalyzed: combined metrics matter. InProceedings of the 15th International Conference on Mining Software Repositories, MSR ’18, ...

    2018

  51. [59]

    util-linux

    util-linux. util-linux. https://github.com/util-linux/util-linux

  52. [60]

    TRL: Transformer Reinforcement Learning

    Leandro von Werra, Younes Belkada, Lewis Tunstall, Edward Beeching, Tristan Thrush, Nathan Lambert, Shengyi Huang, Kashif Rasul, and Quentin Gallouédec. TRL: Transformer Reinforcement Learning

  53. [61]

    Foster, and Michelle L

    Daniel Votipka, Seth Rabin, Kristopher Micinski, Jeffrey S. Foster, and Michelle L. Mazurek. An observationalinvestigation ofreverse Engineers’ processes. In29th USENIX Security Symposium (USENIX Security 20), pages 1875–1892. USENIX Association, August 2020

    2020

  54. [62]

    Angr - the next generation of binary analysis

    Fish Wang and Yan Shoshitaishvili. Angr - the next generation of binary analysis. In2017 IEEE Cybersecurity Development (SecDev), pages 8–9, 2017

    2017

  55. [63]

    Enhancing translation validation of compiler transformations with large language models, 2024

    Yanzhao Wang and Fei Xie. Enhancing translation validation of compiler transformations with large language models, 2024

    2024

  56. [64]

    Refining decompiled c code with large language models.ArXiv, abs/2310.06530, 2023

    Wai Kin Wong, Huaijin Wang, Zongjie Li, Zhibo Liu, Shuai Wang, Qiyi Tang, Sen Nie, and Shi Wu. Refining decompiled c code with large language models.ArXiv, abs/2310.06530, 2023

    2023 arXiv

  57. [65]

    DEEPTYPE: Refining indirect calltargets withstrong multi-layertype analysis

    Tianrou Xia, Hong Hu, and Dinghao Wu. DEEPTYPE: Refining indirect calltargets withstrong multi-layertype analysis. In33rdUSENIX Security Symposium (USENIX Security 24), pages 5877–5894, Philadelphia, PA, August 2024. USENIX Association

    2024

  58. [66]

    Resym: Harnessing llms to recover variable and data structure symbols from stripped binaries

    Danning Xie,Zhuo Zhang,Nan Jiang,Xiangzhe Xu,Lin Tan,andXiangyu Zhang. Resym: Harnessing llms to recover variable and data structure symbols from stripped binaries. InProceedings of the 2024 on ACM SIGSAC Conference on ComputerandCommunications Security,CCS ’24, page 4554–4568...

    2024

  59. [67]

    Unleashing the power of generative model in recovering variable names from stripped binary

    Xiangzhe Xu, Zhuo Zhang, Zian Su, Ziyang Huang, Shiwei Feng, Yapeng Ye, Nan Jiang, Danning Xie, Siyuan Cheng, Lin Tan, and Xiangyu Zhang. Unleashing the power of generative model in recovering variable names from stripped binary. 01 2025

    2025

  60. [68]

    Helping johnny to analyze malware: A usability-optimized decompiler and malware analysis user study

    Khaled Yakdan, Sergej Dechand, Elmar Gerhards-Padilla, and Matthew Smith. Helping johnny to analyze malware: A usability-optimized decompiler and malware analysis user study. InIEEE Symposium on Security and Privacy, SP 2016, San Jose, CA, USA, May 22-26, 2016, pages 158–177. ...

    2016

  61. [69]

    No more gotos: Decompilation using pattern-independent control-flow structuring and semantic-preserving transformations

    Khaled Yakdan, Sebastian Eschweiler, Elmar Gerhards-Padilla, and MatthewSmith. No more gotos: Decompilation using pattern-independent control-flow structuring and semantic-preserving transformations. In22nd Annual Network and Distributed System Security Symposium, NDSS 2015, S...

    2015

  62. [70]

    Bin2wrong: a unified fuzzing framework for uncovering semantic errors in binary-to-c decompilers

    Zao Yang and Stefan Nagy. Bin2wrong: a unified fuzzing framework for uncovering semantic errors in binary-to-c decompilers. August 2025

    2025

  63. [71]

    Analyzing system software components using api model guided symbolic execution.Journal of Automated Software Engineering, 2020

    Tuba Yavuz and Ken (Yihang) Bai. Analyzing system software components using api model guided symbolic execution.Journal of Automated Software Engineering, 2020

    2020

  64. [72]

    Osprey: Recovery of variable and data structure via probabilistic analysis for stripped binary

    Zhuo Zhang, Yapeng Ye, Wei You, Guanhong Tao, Wen-chuan Lee, Yonghwi Kwon, Yousra Aafer, and Xiangyu Zhang. Osprey: Recovery of variable and data structure via probabilistic analysis for stripped binary. In2021 IEEE Symposium on Security and Privacy (SP), pages 813–832, 2021

    2021

  65. [73]

    Llm hallucinations in practical code generation: Phenomena, mechanism, and mitigation

    Ziyao Zhang,Chong Wang,Yanlin Wang,Ensheng Shi,Yuchi Ma,Wanjun Zhong, Jiachi Chen, Mingzhi Mao, and Zibin Zheng. Llm hallucinations in practical code generation: Phenomena, mechanism, and mitigation. Proc. ACM Softw. Eng., 2(ISSTA), June 2025

    2025

  66. [74]

    TYGR: Type inference on stripped binaries using graph neural networks

    Chang Zhu, Ziyang Li, Anton Xue, Ati Priya Bajaj, Wil Gibbs, Yibo Liu, Rajeev Alur, Tiffany Bao, Hanjun Dai, Adam Doupé, Mayur Naik, Yan Shoshitaishvili, Ruoyu Wang, and Aravind Machiry. TYGR: Type inference on stripped binaries using graph neural networks. In33rd USENIX Secur...

    2024

  67. [75]

    D-Helix: A generic decompiler testing framework using symbolic differentiation

    Muqi Zou, Arslan Khan, Ruoyu Wu, Han Gao, Antonio Bianchi, and Dave (Jing) Tian. D-Helix: A generic decompiler testing framework using symbolic differentiation. In33rd USENIX Security Symposium (USENIX Security 24), pages 397–414, Philadelphia, PA, August 2024. USENIX Association

    2024

  68. [2021]

    Available at https://github.com/features/copilot

  69. [2025]

    Accessed: 2025-06-04

    Large language model. Accessed: 2025-06-04

    2025

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.