Boosting Neural Networks to Decompile Optimized Binaries

TL;DR

This paper introduces NeurDP, a neural decompiler that effectively handles compiler-optimized binaries by using a graph neural network and an intermediate representation, significantly improving decompilation accuracy.

Contribution

NeurDP is the first neural decompiler designed specifically for compiler-optimized binaries, utilizing GNNs and an OTU to enhance translation accuracy.

Findings

NeurDP achieves 45.21% higher accuracy than existing frameworks.

The use of GNNs and OTU improves decompilation of optimized binaries.

Evaluation on diverse datasets confirms its effectiveness.

Abstract

Decompilation aims to transform a low-level program language (LPL) (eg., binary file) into its functionally-equivalent high-level program language (HPL) (e.g., C/C++). It is a core technology in software security, especially in vulnerability discovery and malware analysis. In recent years, with the successful application of neural machine translation (NMT) models in natural language processing (NLP), researchers have tried to build neural decompilers by borrowing the idea of NMT. They formulate the decompilation process as a translation problem between LPL and HPL, aiming to reduce the human cost required to develop decompilation tools and improve their generalizability. However, state-of-the-art learning-based decompilers do not cope well with compiler-optimized binaries. Since real-world binaries are mostly compiler-optimized, decompilers that do not consider optimized binaries have limited practical significance. In this paper, we propose a novel learning-based approach named NeurDP, that targets compiler-optimized binaries. NeurDP uses a graph neural network (GNN) model to convert LPL to an intermediate representation (IR), which bridges the gap between source code and optimized binary. We also design an Optimized Translation Unit (OTU) to split functions into smaller code fragments for better translation performance. Evaluation results on datasets containing various types of statements show that NeurDP can decompile optimized binaries with 45.21% higher accuracy than state-of-the-art neural decompilation frameworks.