LLM4CodeRE: Generative AI for Code Decompilation Analysis and Reverse Engineering

TL;DR

LLM4CodeRE is a domain-adaptive large language model framework designed for bidirectional code decompilation and translation, specifically targeting malware reverse engineering with improved accuracy over existing tools.

Contribution

It introduces two novel fine-tuning strategies for domain adaptation, enabling effective assembly-source code translation within a unified model.

Findings

Outperforms existing decompilation tools and general-purpose models.

Achieves robust bidirectional generalization.

Supports both assembly-to-source and source-to-assembly translation.

Abstract

Code decompilation analysis is a fundamental yet challenging task in malware reverse engineering, particularly due to the pervasive use of sophisticated obfuscation techniques. Although recent large language models (LLMs) have shown promise in translating low-level representations into high-level source code, most existing approaches rely on generic code pretraining and lack adaptation to malicious software. We propose LLM4CodeRE, a domain-adaptive LLM framework for bidirectional code reverse engineering that supports both assembly-to-source decompilation and source-to-assembly translation within a unified model. To enable effective task adaptation, we introduce two complementary fine-tuning strategies: (i) a Multi-Adapter approach for task-specific syntactic and semantic alignment, and (ii) a Seq2Seq Unified approach using task-conditioned prefixes to enforce end-to-end generation constraints. Experimental results demonstrate that LLM4CodeRE outperforms existing decompilation tools and general-purpose code models, achieving robust bidirectional generalization.