DIRECT : A Transformer-based Model for Decompiled Identifier Renaming

Abstract

Decompiling binary executables to high-level code is an important step in reverse engineering scenarios, such as malware analysis and legacy code maintenance. However, the generated high-level code is difficult to understand since the original variable names are lost. In this paper, we leverage transformer models to reconstruct the original variable names from decompiled code. Inherent differences between code and natural language present certain challenges in applying conventional transformer-based architectures to variable name recovery. We propose DIRECT, a novel transformer-based architecture customized specifically for the task at hand. We evaluate our model on a dataset of decompiled functions and find that DIRECT outperforms the previous state-of-the-art model by up to 20%. We also present ablation studies evaluating the impact of each of our modifications. We make the source code of DIRECT available to encourage reproducible research.

School of Mechanical Engineering, Shanghai Jiao Tong University, 200240, Shanghai, China

“…Code-to-Code Deobfuscation DeGuard (Bichsel et al, 2016), Autonym (Vasilescu et al, 2017), Debin , JS-Neat DIRE (Lacomis et al, 2019), Artuso et al (2021) VarBERT (Banerjee et al, 2021), DIRECT (Nitin et al, 2021), SLaDe (Armengol-Estapé et al, 2023), LmPa (Xu et al, 2023b) Figure 5: Evaluation tasks for code processing: models and methods for code-to-code tasks, part 2. For each task the first column is non-neural methods (mostly n-gram or TF-IDF based methods, but also including other heuristics based methods); the second column is non-Transformer neural methods; the third column is Transformer based methods.…”