Practical Source Code Recovery from Binary Functions Using Anchor-Based Retrieval and LLM Reasoning

2026-07-10 · Source: Artificial Intelligence · Field: Technology & Digital — Software Development & Engineering, Artificial Intelligence & Machine Learning, Cybersecurity & Data Privacy · Depth: Expert, quick

Summary

A new practical pipeline has been developed for recovering source code from stripped binary functions, integrating reverse engineering, anchor-based source code retrieval, and large language model (LLM) reasoning. This method identifies source functions from a database rather than generating pseudocode. It operates by extracting anchors like strings, constants, and external calls using Ghidra, then retrieves candidate files via an inverted-index search. These candidates are narrowed to likely function snippets and re-ranked by an LLM using disassembly, decompiled code, and source metadata. Confident matches can further serve as anchors. Evaluated on a stripped, optimized tcpdump binary with a high-fidelity source code database, the pipeline achieved 95.2% assembly instruction coverage. Performance dropped to 35.5% instruction coverage on a GitHub-based retrieval database, primarily due to retrieval misses, indicating the importance of database quality.

Key takeaway

For Software Engineers or Reverse Engineers analyzing stripped binaries, this pipeline offers a robust approach to source code recovery. You should consider integrating anchor-based retrieval with LLM re-ranking, especially when a high-fidelity source code database is available, as it significantly boosts recovery accuracy. This method provides a practical alternative to traditional decompilation, improving understanding of complex binary functions.

Key insights

Combining anchor-based retrieval with LLM reasoning enables practical source code recovery from stripped binaries, excelling with high-quality databases.

Principles

• Source code recovery benefits from high-quality databases.
• Confident matches can iteratively improve retrieval.
• LLMs enhance re-ranking of code candidates.

Method

Extract anchors (strings, constants, calls) with Ghidra, retrieve candidates via inverted-index, narrow snippets, then re-rank using an LLM based on disassembly, decompiled code, and source metadata.

In practice

• Use Ghidra for initial anchor extraction.
• Implement inverted-index for candidate retrieval.
• Employ LLMs for re-ranking code snippets.

Topics

• Source Code Recovery
• Binary Analysis
• LLM Reasoning
• Reverse Engineering
• Ghidra
• Anchor-Based Retrieval

Best for: Research Scientist, AI Scientist, Machine Learning Engineer, Software Engineer

Related on AIssential

• Practical Source Code Recovery from Binary Functions Using Anchor-Based Retrieval and LLM Reasoning — Combining anchor-based retrieval with LLM reasoning significantly enhances source code recovery from stripped binaries, especially with high-quality databases.
• REFORGE: A Method for Benchmarking LLMs' Reverse Engineering Capabilities in Decompiled Binary Function Naming — Benchmarking LLMs for reverse engineering requires uncertainty-aware evaluation due to compiler optimization's impact on ground truth alignment.
• Multi-View Decompilation for LLM-Based Malware Classification — Using multiple decompiler views improves LLM-based malware classification by providing complementary evidence.
• Using LLMs to Secure Source Code — LLMs streamline vulnerability discovery, shifting the security bottleneck to verification, triage, and patching.
• Reverse engineering Claude's CVE-2026-2796 exploit — Claude Opus 4.6 demonstrated autonomous browser exploit generation, signaling advancing LLM cyber capabilities.
• Building the Production LLM Pipeline RAG, Fine-Tuning, and Evaluation as Code Part-3 — 80% of RAG failures originate in the ingestion and chunking layer, not the LLM, necessitating robust pipeline design.

See Counsel's argued verdicts on the open AI decisions leaders are weighing →

Open in AIssential →

Editorial summary, takeaway, and curation by AIssential. Original article published by Artificial Intelligence.