ALT4Decompile: Inferring C-aligned Abstract Loop Tree for LLM-Based Binary Decompilation

Abstract

Decompilation refers to the process of recovering high-level (C) language code from low-level (assembly) code. Recent Large Language Model (LLM)-based methods can generate re-executable code but struggle with the enormous syntax gap between assembly and C languages. Loop structures in C are fragmented into complex jumps within assembly languages, which poses a challenge to LLMs decompiling assembly language, which is mainly pre-trained on C. To bridge this gap, we propose ALT4Decompile, which refactors assembly to closely resemble C language structure, thereby preventing hallucinations in LLMs caused by complex jumps. Specifically, we construct a C-aligned \underline{\textbf{A}}bstract \underline{\textbf{L}}oop \underline{\textbf{T}}ree (ALT) based on specific jump patterns of Assembly that explicitly aggregates fragmented Assembly blocks into corresponding high-level loop structures (e.g., nested loops). Finally, we fine-tune an LLM adapted to ALT to generate decompiled code and then improve its output by fixing specific errors and restoring symbols. Evaluated against 12 baselines (including rule-based SAILR and LLM-based LLM4Decompile) on Decompile-Eval, MBPP, and ExeBench, ALT4Decompile achieves state-of-the-art correct re-executable results (even under four commonly used obfuscation techniques): i.e., a 70.4\% test case pass rate on Decompile-Eval, a 10.6\% improvement over prior best work. Furthermore, analyses on real-world software and a user study further show its practicability in understanding binary functions. The datasets and source code used in this paper are available at https://github.com/wang-yongpan/ALT4Decompile.

13 pages, 6 figures