disassembly parsing

Traditional static binary translation struggles to reliably translate complete x86-64 programs to AArch64 in the absence of debugging information, source code, or assumptions about code layout. This work proposes a deterministic whole-program static translation approach that enumerates all possible instruction and data interpretations at the byte level, generating a complete set of candidate interpretations for each byte. By integrating these interpretations with code “tiles” automatically derived from high-level ISA semantics, the method synthesizes a fully functional target binary without relying on heuristic rules or runtime fallback mechanisms. For the first time, this enables static translation outputs that can be verified, tested, and signed ahead of execution. Experimental results demonstrate that the approach achieves performance on par with QEMU’s user-mode JIT on real-world benchmarks such as SPECint 2006, albeit at the cost of significantly larger output binary size.

Binary program symbolic execution suffers from semantic distortion and implementation errors introduced during intermediate representation (IR) translation. Method: This paper proposes the first instruction-level symbolic execution framework directly grounded in formal ISA semantics (Rock/Sail), bypassing conventional IR abstractions by compiling machine-readable ISA specifications into SMT-solvable symbolic semantic models and integrating them into a binary analysis platform. Contributions/Results: (1) The first end-to-end automated pipeline from formal ISA semantics to symbolic execution; (2) Demonstrated scalability on RISC-V—modeling new instructions requires only a few hours; (3) Discovered five previously unknown ISA semantic implementation bugs in angr; (4) Achieved high-fidelity branch modeling and solving capability. The framework significantly improves the accuracy, trustworthiness, and development efficiency of binary symbolic execution.

This work addresses the challenging problem of recovering original source code from stripped binary functions, a task where traditional decompilation typically yields only approximate pseudocode. The paper proposes a novel paradigm that replaces pseudocode generation with direct source code retrieval. By extracting anchors such as strings and constants from binaries, the method retrieves candidate functions from a source code corpus and constructs a multimodal representation incorporating assembly instructions, decompiled code, and metadata. A large language model (LLM) is then employed for semantic re-ranking of candidates. The approach integrates Ghidra-based static analysis with an inverted index system and introduces an iterative anchor refinement strategy. Evaluated on a high-quality tcpdump dataset, it achieves 95.2% instruction coverage, and attains 35.5% coverage on general-purpose GitHub repositories, demonstrating effectiveness in both ideal and noisy real-world scenarios.

This work addresses the challenge of reliable source-level binary patching in the absence of original source code and toolchains, where existing decompilers often produce outputs riddled with syntactic and semantic errors. To overcome this limitation, the authors propose a static patching framework that integrates decompilation with binary-aware recompilation. By leveraging information extracted directly from the original binary, the framework corrects semantic distortions in decompiled code and enables automated patch generation. The approach substantially improves recompilation correctness, fixing approximately 81% of erroneous functions produced by Hex-Rays, successfully patching 13 out of 14 real-world CVEs, and increasing user experiment success rates from 3.7% to 100%. Furthermore, it supports large-model-driven fully automated patching, demonstrating robust practical applicability.

This work addresses the unreliability of disassembly caused by the absence of compiler-intended semantic information in stripped binary executables. To overcome this limitation, the authors propose a novel lightweight metadata embedding mechanism that explicitly encodes critical semantics—such as code regions and memory boundaries—directly into the binary. This approach yields a decidable intermediate representation situated between raw binaries and source code. For the first time, it enables disassembly that is both decidable and recompilable, facilitating precise lifting to high-level intermediate representations. Experimental evaluation demonstrates that the embedded metadata incurs only 17% of the size overhead of DWARF debug information, introduces no runtime performance penalty, and successfully supports behavior-preserving binary lifting, instrumentation, and recompilation across a wide range of real-world C/C++ programs.

Automatically migrating C systems software to Rust faces significant challenges at the interface level, where satisfying Rust’s ownership and borrowing rules is difficult due to the lack of correct and precise translation methods. This work proposes the first constraint-solving–based approach that jointly models semantic equivalence and type correctness—including Rust’s borrow checker constraints—to establish a precise mapping between C and Rust type systems. The method generates minimal-overhead foreign function interface declarations that are directly usable by safe Rust code. Supporting modular and incremental migration, it produces state-of-the-art Rust interfaces for real-world C programs, substantially improving translation quality. However, support for certain C language features and scalability to very large codebases remains an area for future improvement.

This study addresses the open challenge in reverse engineering of decompiling x86-64 assembly into idiomatic modern high-level code, specifically Dart. The work proposes the first approach leveraging specialized small-scale large language models (4B/8B parameters), augmented with synthetically generated data and cross-lingual transfer from Swift to Dart, to recover high-quality Dart source code. Evaluated on a benchmark of 73 functions, the method achieves a CODEBLEU score of 71.3—approaching the performance of a 480B general-purpose model—and attains a compile@k5 rate of 79.4% on 34 real-world Dart functions, substantially outperforming baseline techniques. The results demonstrate that domain-specialized small models can produce semantically clear and idiomatic code, and reveal the existence of a model capacity threshold for effective cross-lingual transfer.

Virtualization-obfuscated binary code is typically large and structurally complex, exceeding the input length limits of large language models (LLMs) and lacking annotated data, which hinders direct application in code analysis. To address this challenge, this work proposes a structure-role-oriented decomposition and automatic labeling paradigm: it employs static analysis to partition obfuscated code into maximally sized, semantically coherent units that conform to LLM input constraints, and automatically annotates each unit based on its structural role within the control flow graph. This approach enables the construction of a scalable dataset for both training and inference. Evaluation on real-world virtualization-obfuscated binaries demonstrates that the prototype system achieves efficient and accurate analysis, effectively overcoming the dual bottlenecks of input length limitations and data scarcity that currently impede LLM-based approaches in this domain.

This work addresses the limitations of existing hardware parser designs, which suffer from excessive complexity, poor reusability, and inadequate support for sophisticated matching and diverse deployment scenarios. To overcome these challenges, the authors propose an open-source tool that enhances pattern-matching capabilities through customizable symbolic tokens—enabling range validation, negation, and comparisons with external ports—and introduces a Parser Intermediate Representation (PIR) to decouple frontend protocol specification from backend implementation. The frontend allows flexible protocol description, while the backend automatically generates FPGA-optimized SystemVerilog code supporting arbitrary bit-width state machines, byte alignment, and cross-cycle field stitching. Experimental results on an Ethernet parser demonstrate up to a 226% increase in operating frequency and a 97% reduction in logic resource usage; furthermore, the hierarchical design achieves up to 8× greater resource efficiency compared to monolithic architectures.