When LLM Decompilers Recompile More and Preserve Less

Imagine you're a security engineer trying to analyze software for vulnerabilities. You rely on decompilers to convert compiled code back into a high-level language, but traditional tools often leave you with incomplete or non-executable pseudocode. This can lead to situations where a decompiled function appears to work perfectly in tests but fails under real-world conditions, missing critical vulnerabilities or behaving unexpectedly. This is what's called 'divergence' — where the decompiled output doesn't match the original code's behavior despite passing all tests. To tackle this issue, a new approach called Decompile-Diverge was developed. Instead of relying on fixed tests, it creates dynamic drivers that generate a fuzzing corpus based on the original function. This allows for a more thorough examination of the decompiled code's behavior across various inputs, revealing discrepancies that traditional methods might miss. The results show that even when decompilers achieve high recompilability rates, they can still diverge significantly in behavior, highlighting the importance of this new method. For builders, this means that relying solely on recompilability metrics can be misleading. Decompile-Diverge provides a more reliable way to ensure that decompiled code behaves as expected, which is crucial for security applications where undetected vulnerabilities can have serious consequences.

Introduces a new behavioral comparison method for decompilation.

Demonstrates effectiveness across multiple systems and real-world functions.