Neutron: an attention-based neural decompiler

Abstract

Decompilation aims to analyze and transform low-level program language (PL) codes such as binary code or assembly code to obtain an equivalent high-level PL. Decompilation plays a vital role in the cyberspace security fields such as software vulnerability discovery and analysis, malicious code detection and analysis, and software engineering fields such as source code analysis, optimization, and cross-language cross-operating system migration. Unfortunately, the existing decompilers mainly rely on experts to write rules, which leads to bottlenecks such as low scalability, development difficulties, and long cycles. The generated high-level PL codes often violate the code writing specifications. Further, their readability is still relatively low. The problems mentioned above hinder the efficiency of advanced applications (e.g., vulnerability discovery) based on decompiled high-level PL codes.In this paper, we propose a decompilation approach based on the attention-based neural machine translation (NMT) mechanism, which converts low-level PL into high-level PL while acquiring legibility and keeping functionally similar. To compensate for the information asymmetry between the low-level and high-level PL, a translation method based on basic operations of low-level PL is designed. This method improves the generalization of the NMT model and captures the translation rules between PLs more accurately and efficiently. Besides, we implement a neural decompilation framework called Neutron. The evaluation of two practical applications shows that Neutron’s average program accuracy is 96.96%, which is better than the traditional NMT model.

Code Translation with Compiler Representations

“…RetDec, an open source decompiler created by Avast Křoustek et al [2017], can decompile an executable to C and a Pythonlike language via LLVM IR, and took seven years to be completed by a team of 24 developers 6 . Other tools exist, such as the Hex-Rays Decompiler 7 and Brumley et al [2013], and a thorough review of rule-based methods can be found in papers such as Liang et al [2021a] and Katz et al [2019]. With these methods, decompilation can fail if the code is too convoluted, or if it contains language features that were not explicitly translated.…”

dewolf: Improving Decompilation by leveraging User Surveys

“…In the past few years, several decompilation approaches based on (recurrent) neural networks (NN) or neural machine translation have been proposed [23], [24], [28]. Although these approaches are allegedly language-independent, they are typically limited to short code snippets due to network design and memory requirement restrictions.…”

“…Most authors argue that writing and maintaining conventional or traditional decompilers is slow, costly, unscalable, or requires a high level of expert knowledge. However, neural approaches often rely on sophisticated pre-and post-processing to add language domain knowledge to the model [23], [24] or even use traditional control-and data-flow recovery to improve the output [28].…”

Semantics-Recovering Decompilation through Neural Machine Translation

“…Decompilation research can be broadly categorized as either (1) rule-based approaches [1], [2], [3], [13] or (2) more recent NMT-based approaches [5], [8], [9], [14]. Rule-based approaches for decompilation started to gain popularity with the advent of Hex-Rays [1], a commercial native processor code to C-like code decompiler.…”

“…Neural networks for program decompilation. Nowadays, Artificial intelligence technologies such as deep learning are widely used in NMT, image recognition, and other fields, relying on its powerful learning and expression capabilities to build deep learning-based decompilation methods is a popular research direction [5], [8], [9], [14]. Katz et al [9] first proposed RNN-based method for decompiling binary code snippets, which demonstrated the feasibility of using neural machine translation for decompilation.…”