LLM-Assisted Binary Code Understanding & Reverse Engineering

Benchmarking and developing RAG pipelines for automated binary analysis and assembly-to-C translation using LLMs.

Research & Project Background

Understanding compiled binary code is one of the most challenging bottlenecks in cybersecurity and reverse engineering. The compilation process strips away vital high-level semantics such as function names, variable indicators, and developer comments, leaving analysts with low-level instructions or incomplete pseudo-code.

This project explores the modern paradigm of AI-Augmented Binary Analysis, leveraging Large Language Models (LLMs) to automatically bridge the semantic gap. By evaluating foundational code models against standard decompiled architectures, this research sets the stage for building intelligent Retrieval-Augmented Generation (RAG) pipelines optimized for custom firmware translation.

LLM Evaluation RAG Pipelines Binary Semantics
Figure 1: The technical pipeline of reverse engineering from raw stripped binary files to AI-augmented pseudo-code summarization.

Code Representation Levels

A key focus of this research is analyzing how information degrades across compilation layers. LLMs are evaluated based on their capacity to process distinct structural levels:

  • Source Code (Baseline): Clean, human-readable logic rich in developer context.
  • Assembly Code Sequence: Low-level hardware instructions captured via disassembly.
  • Stripped Pseudo-Code: Approximated high-level logic generated by advanced decompilers (e.g., IDA Pro, Ghidra) where local structures are intact but all semantic tokens are missing.
Figure 2: Comparative representation of functional abstraction layers, demonstrating how a stripped decompiler placeholder obscures code intent.

Benchmark Architecture & Dataset Alignment

To rigorously test LLMs in downstream reverse engineering tasks, an automated data-alignment framework was established. The data pipeline is divided into two primary operations:

1. Dataset Alignment Flow

Using production-grade C repositories across diverse domains (including Cryptography, Databases, Compression, and Networks), binaries are generated, stripped, and decompiled. DWARF debugging symbols map specific pseudo-code blocks back to their original ground-truth implementation.

2. Correctness & Leakage Enforcement

To secure high-quality ground truths, automated descriptive comments are vetted by domain experts. trict cross-referencing against clear-text internet indexes via search engines prevents the baseline model from benefiting from data leakage.

Figure 3: Algorithmic overview of the benchmark dataset construction, enforcing strict alignment and leakage guards.

Prompt Engineering & Task Evaluation

The framework evaluates models through custom zero-shot and few-shot role-play prompts. The automation core handles two foundational reverse engineering objectives:

  • Function Name Recovery: Token-level precision models designed to reconstruct descriptive identifiers from raw instructions.
  • Binary Code Summarization: High-context logical extraction to describe code intent in structured natural language.
Figure 4: Interface orchestration for querying models and executing functional validation metrics.