Practical Source Code Recovery from Binary Functions Using Anchor-Based Retrieval and LLM Reasoning

2025-02-28 · Source: cs.SE updates on arXiv.org · Field: Technology & Digital — Artificial Intelligence & Machine Learning, Cybersecurity & Data Privacy, Software Development & Engineering · Depth: Expert, extended

Summary

A practical pipeline for recovering source code from stripped binary functions combines reverse engineering, anchor-based source code retrieval, and large language model (LLM) reasoning. The method extracts anchors like strings, constants, external calls, and function names using Ghidra, retrieves candidate files via an inverted-index search, narrows candidates to function snippets, and re-ranks them with an LLM based on disassembly, decompiled code, and source metadata. In a controlled evaluation on an optimized tcpdump binary with a curated database of 8,061 open-source projects, the method achieved 95.2% assembly instruction coverage using GPT-5.5 (estimated 9.7T parameters). However, experiments using the GitHub API as a retrieval database showed lower performance, with an average of 35.5% instruction coverage across BusyBox, curl, sqlite3, and dropbear binaries, compiled for Linux x86_64 with O2 optimization. This reduction was primarily due to database retrieval misses, with an average of 53.1% of functions classified as misses. The LLM re-ranker, even with GPT 5 mini (estimated 410B parameters), improved Hits @ 1 from 0.182 to 0.283 but could not compensate for missing candidates.

Key takeaway

For AI Security Engineers analyzing unknown executables, this method offers a structured approach to source code recovery. You should prioritize high-quality, curated source code databases for optimal performance, as retrieval quality is a major bottleneck in noisy environments like public GitHub. Consider implementing iterative passes where confidently matched functions serve as new anchors to propagate information through the call graph, enhancing recovery for functions with few intrinsic anchors.

Key insights

Combining anchor-based retrieval with LLM reasoning significantly enhances source code recovery from stripped binaries, especially with high-quality databases.

Principles

• Source recovery excels with high-quality databases.
• LLM re-ranking improves candidate selection.
• Confident matches can propagate as new anchors.

Method

The pipeline extracts anchors via Ghidra, retrieves candidates using an inverted-index, localizes snippets, and re-ranks them with an LLM based on dense features like disassembly and decompiled code.

In practice

• Use Ghidra for anchor and dense feature extraction.
• Implement an inverted-index for scalable retrieval.
• Apply LLMs for fine-grained candidate verification.

Topics

• Binary Reverse Engineering
• Source Code Recovery
• Large Language Models
• Ghidra
• Anchor-Based Retrieval
• Cybersecurity Analysis

Code references

• NationalSecurityAgency/ghidra

Best for: Research Scientist, AI Security Engineer, AI Scientist, Machine Learning Engineer

Related on AIssential

• Practical Source Code Recovery from Binary Functions Using Anchor-Based Retrieval and LLM Reasoning — Combining anchor-based retrieval with LLM reasoning enables practical source code recovery from stripped binaries, excelling with high-quality databases.
• REFORGE: A Method for Benchmarking LLMs' Reverse Engineering Capabilities in Decompiled Binary Function Naming — Benchmarking LLMs for reverse engineering requires uncertainty-aware evaluation due to compiler optimization's impact on ground truth alignment.
• Tool-Guided Retrieval-Augmented Repair for Securing LLM-Generated C Code — Integrating multi-tool feedback and retrieval of repair patterns significantly improves LLM-generated C code security and reliability.
• Königsberg at SemEval-2026 Task 13: Beyond Language Models: A Low-Resource Feature-Driven and Data-Flow Embedding Approach for Machine-Generated Code Detection — A hybrid framework efficiently detects machine-generated code using software metrics and frozen GraphCodeBERT embeddings, avoiding LLM fine-tuning overhead.
• The Secret Behind Claude Code’s Retrieval: Why Live Search Fits Better than RAG — Claude Code's retrieval uses live search with `ripgrep` and LSP, not persistent RAG, to explore dynamic codebases like an engineer.
• Yet another experiment proves it's too damn simple to poison large language models — LLMs with web search are vulnerable to simple, low-cost data poisoning via fabricated online sources.

See Counsel's argued verdicts on the open AI decisions leaders are weighing →

Open in AIssential →

Editorial summary, takeaway, and curation by AIssential. Original article published by cs.SE updates on arXiv.org.