binary lifting

Traditional static binary translation struggles to reliably translate complete x86-64 programs to AArch64 in the absence of debugging information, source code, or assumptions about code layout. This work proposes a deterministic whole-program static translation approach that enumerates all possible instruction and data interpretations at the byte level, generating a complete set of candidate interpretations for each byte. By integrating these interpretations with code “tiles” automatically derived from high-level ISA semantics, the method synthesizes a fully functional target binary without relying on heuristic rules or runtime fallback mechanisms. For the first time, this enables static translation outputs that can be verified, tested, and signed ahead of execution. Experimental results demonstrate that the approach achieves performance on par with QEMU’s user-mode JIT on real-world benchmarks such as SPECint 2006, albeit at the cost of significantly larger output binary size.

Binary program symbolic execution suffers from semantic distortion and implementation errors introduced during intermediate representation (IR) translation. Method: This paper proposes the first instruction-level symbolic execution framework directly grounded in formal ISA semantics (Rock/Sail), bypassing conventional IR abstractions by compiling machine-readable ISA specifications into SMT-solvable symbolic semantic models and integrating them into a binary analysis platform. Contributions/Results: (1) The first end-to-end automated pipeline from formal ISA semantics to symbolic execution; (2) Demonstrated scalability on RISC-V—modeling new instructions requires only a few hours; (3) Discovered five previously unknown ISA semantic implementation bugs in angr; (4) Achieved high-fidelity branch modeling and solving capability. The framework significantly improves the accuracy, trustworthiness, and development efficiency of binary symbolic execution.

This paper addresses engineering challenges in migrating large-scale cloud warehouse workloads from x86 to Arm instruction set architectures (ISAs), proposing a source-code recompilation–centric paradigm—distinct from binary translation. Drawing on nearly 40,000 real-world code commits at Google, we establish the first systematic task taxonomy for large-scale ISA migration. Our approach integrates static analysis, automated code refactoring, machine learning–assisted modifications, and CI pipeline monitoring to drive open-source ecosystem–based, full-stack software reconstruction. The methodology has been deployed internally at Google to automate x86-to-Arm migration across production systems, significantly improving efficiency while surfacing critical legacy bottlenecks. Key contributions include: (1) formalizing a recompilation-first framework for ISA migration; (2) introducing a principled, empirically grounded task classification system; and (3) empirically validating AI’s pivotal role in migration automation—providing an industry-reusable blueprint and opening new research directions in ISA migration for academia.

Existing binary analysis tools suffer from limited generality and reliability, while custom development incurs prohibitively high engineering costs. This paper introduces the first modular machine-code analysis framework deeply integrated with a statically typed functional programming language (Haskell). It enforces architectural invariants at the type level, employs a functional optimization pipeline to improve maintainability, and incorporates an SMT-driven symbolic execution engine to enhance semantic correctness. The framework unifies support for program slicing, dynamic instrumentation, binary rewriting, and formal verification—natively interoperating with LLVM IR, x86 binary lifting, and mixed C/assembly verification. Validated over a decade of industrial deployment, it significantly improves toolchain interoperability, developer productivity, and semantic reliability. It has been successfully applied to security auditing, vulnerability discovery, and trustworthy compiler verification.

This study addresses the open challenge in reverse engineering of decompiling x86-64 assembly into idiomatic modern high-level code, specifically Dart. The work proposes the first approach leveraging specialized small-scale large language models (4B/8B parameters), augmented with synthetically generated data and cross-lingual transfer from Swift to Dart, to recover high-quality Dart source code. Evaluated on a benchmark of 73 functions, the method achieves a CODEBLEU score of 71.3—approaching the performance of a 480B general-purpose model—and attains a compile@k5 rate of 79.4% on 34 real-world Dart functions, substantially outperforming baseline techniques. The results demonstrate that domain-specialized small models can produce semantically clear and idiomatic code, and reveal the existence of a model capacity threshold for effective cross-lingual transfer.

This work addresses the unreliability of disassembly caused by the absence of compiler-intended semantic information in stripped binary executables. To overcome this limitation, the authors propose a novel lightweight metadata embedding mechanism that explicitly encodes critical semantics—such as code regions and memory boundaries—directly into the binary. This approach yields a decidable intermediate representation situated between raw binaries and source code. For the first time, it enables disassembly that is both decidable and recompilable, facilitating precise lifting to high-level intermediate representations. Experimental evaluation demonstrates that the embedded metadata incurs only 17% of the size overhead of DWARF debug information, introduces no runtime performance penalty, and successfully supports behavior-preserving binary lifting, instrumentation, and recompilation across a wide range of real-world C/C++ programs.

This work addresses the interoperability challenge between GCC and LLVM compiler intermediate representations (IRs), which stems from their semantic and structural differences. To bridge this gap, the authors propose IRIS-14B, the first large language model specifically designed for IR-to-IR translation. Built upon a 14-billion-parameter Transformer architecture, IRIS-14B leverages supervised fine-tuning to learn the mapping between GIMPLE and LLVM IR derived from the same C source code, enabling high-fidelity automatic translation. Experimental results demonstrate that IRIS-14B substantially outperforms existing open-source large models on real-world C programs and competitive programming tasks, achieving up to a 44-percentage-point improvement in accuracy. This study provides the first empirical validation of large language models as effective and feasible interoperability layers within neuro-symbolic hybrid compilation frameworks.

This work addresses the challenge of reliable source-level binary patching in the absence of original source code and toolchains, where existing decompilers often produce outputs riddled with syntactic and semantic errors. To overcome this limitation, the authors propose a static patching framework that integrates decompilation with binary-aware recompilation. By leveraging information extracted directly from the original binary, the framework corrects semantic distortions in decompiled code and enables automated patch generation. The approach substantially improves recompilation correctness, fixing approximately 81% of erroneous functions produced by Hex-Rays, successfully patching 13 out of 14 real-world CVEs, and increasing user experiment success rates from 3.7% to 100%. Furthermore, it supports large-model-driven fully automated patching, demonstrating robust practical applicability.

This work addresses the challenging problem of recovering original source code from stripped binary functions, a task where traditional decompilation typically yields only approximate pseudocode. The paper proposes a novel paradigm that replaces pseudocode generation with direct source code retrieval. By extracting anchors such as strings and constants from binaries, the method retrieves candidate functions from a source code corpus and constructs a multimodal representation incorporating assembly instructions, decompiled code, and metadata. A large language model (LLM) is then employed for semantic re-ranking of candidates. The approach integrates Ghidra-based static analysis with an inverted index system and introduces an iterative anchor refinement strategy. Evaluated on a high-quality tcpdump dataset, it achieves 95.2% instruction coverage, and attains 35.5% coverage on general-purpose GitHub repositories, demonstrating effectiveness in both ideal and noisy real-world scenarios.