Decompilation is foundational to binary analysis, yet conventional tools prioritize human readability over strict recompilability and verifiable runtime correctness. While recent LLM-based approaches attempt to refine decompiled pseudocode, they typically either optimize solely for readability or rely on static analysis for evaluation. This makes them prone to "semantic hallucinations" that compromise accuracy and fail to resolve actual runtime failures. For critical tasks like software modernization and vulnerability remediation, recovered code must not only compile but replicate the original binary's behavior. We present PCodeTrans, a feedback-driven framework that bridges the gap between decompilation, recompilation, and rigorous function-level dynamic validation. After extracting a minimal yet coherent context to guarantee recompilability, PCodeTrans employs an in situ substitutable engine to hot-swap the compiled function directly into the unmodified binary, natively preserving its authentic execution context and global dependencies. Guided by fine-grained differential tracing, PCodeTrans generates precise runtime feedback to iteratively guide an LLM in repairing semantic discrepancies. Evaluated on Coreutils and Binutils, PCodeTrans achieves unprecedented recovery performance when rectifying raw Hex-Rays outputs, attaining 100% function-level compilability on unstripped binaries alongside 99.55% and 99.89% test-validated behavioral consistency, respectively. In doing so, it resolves 76.56% and 79.74% of logic errors exposed by official test suites. Exhibiting exceptional resilience, PCodeTrans maintains over 96% behavioral consistency even on fully stripped binaries. By significantly outperforming all existing baselines, PCodeTrans paves a practical path to reliably translate decompiled pseudocode into compilable and executable equivalents.
Figures & tables
Fig. 1: Overview of the PCodeTrans workflow. (1) Compile functions with sufficient context : extract dependencies from the original binary and decompiled pseudocode, applying compiler-guided LLM repair to build compilable functions as dynamic libraries. (2) In-situ substitutable execution : seamlessly execute substitute functions inside the original binary using hook patches for function redirection and patched GOT entries for external symbol relocation. (3) Runtime feedback-guided repair : evaluate the substituted binary with official test suites. Failures trigger sanitizer diagnostics or breakpoint-matched differential tracing , providing fine-grained feedback for the LLM to iteratively repair the function.
Fig. 2: Construction of the address mapping table. PCodeTrans aligns symbols from the original binary with those in the compiled dynamic module to enable bidirectional runtime relocation.
Fig. 3: Workflow of breakpoint-matched differential tracing.
Fig. 4: Runtime bidirectional relocation by the relocation engine.
Benchmark
Granularity
HexRays
Ghidra
DeGPT
SK2Decompile
DeCLLM
FidelityGPT
pcodetrans
CS
BE
CS
BE
CS
BE
CS
BE
CS
BE
CS
BE
CS
BE
Coreutils
Function-level
69.03%
65.98%
55.41%
52.00%
53.30%
48.29%
31.22%
24.61%
–
–
49.44%
47.04%
100%
99.55%
File-level
0%
0%
0%
0%
0%
0%
0%
0%
70.37%
55.56%
0%
0%
100%
81.48%
Coreutils- stripped
Function-level
61.68%
55.34%
49.40%
45.67%
48.72%
43.11%
15.78%
13.94%
–
–
34.29%
29.81%
99.12%
96.84%
File-level
0%
0%
0%
0%
0%
0%
0%
0%
–
–
0%
0%
44.44%
25.92%
Binutils
Function-level
80.12%
78.61%
43.14%
42.34%
39.31%
38.52%
21.30%
18.95%
–
–
51.83%
50.57%
100%
99.89%
TABLE I: Compilation success (CS) and behavioral equivalence (BE) on Coreutils and Binutils (function/file levels).
Dataset
Model
Comp. Succ.%
Runtime Failed (Post-Comp.)
+ ASan Fix (Count & %)
+ BP-Diff Fix (Count & %)
Coreutils
DeepSeek - V3
100%
320
17 (5.31%)
141 (44.06%)
Qwen3 - Coder
100%
320
20 (6.25%)
157 (49.06%)
GPT - 5.1
100%
320
20 (6.25%)
245 (76.56%)
Coreutils- stripped
DeepSeek - V3
90.72%
364
15 (4.12%)
90 (24.73%)
Qwen3 - Coder
94.02%
397
41 (10.32%)
185 (46.60%)
GPT - 5.1
99.12%
451
50 (11.09%)
239 (53.00%)
TABLE II: Sequential debug-repair effectiveness on Coreutils and Binutils . “Comp. Succ.” denotes the compilation success rate. “Runtime Failed” indicates functions that compiled but failed official tests. The repair columns report the number (and percentage) of these failures successfully fixed.
Dataset
PS
LT
LT+CP
LT+GV
LT+ CP+GV
Full
Coreutils
0.51%
9.58%
53.44%
17.42%
69.03%
100%
Coreutils-stripped
0.19%
12.64%
47.47%
15.43%
61.68%
99.12%
Binutils
1.01%
24.19%
67.80%
28.48%
80.12%
100%
Binutils-stripped
1.54%
21.74%
58.42%
25.55%
72.41%
99.15%
TABLE III: Ablation on compilation success rate across progressively richer contexts. Full pipeline includes compiler-guided LLM repair.
Fig. 5: Case studies of runtime feedback-guided repair, including: (a) ASan-guided memory repair , (b) BP-Diff-guided logic repair , and (c) BP-Diff-guided memory layout repair .
Fig. 6: Failure Case: Opaque signature recovery in indirect calls. BP-Diff accurately detects the symptom (unexpected control flow marked by MISS and EXTRA statuses), and the LLM can suspect the indirect call as the culprit. However, recovering the exact missing parameter requires LLM-assisted manual analysis to inspect the underlying machine state.
Appendix figures & tables3 assets
Supplementary material from the paper’s appendix.
Appendix
Fig. 7: Loader constructor that installs a signal handler, writes the process ID to a file, and pauses execution so a debugger can attach before the program proceeds.
Fig. 8: Runtime code patching: temporarily relaxing page permissions with mprotect , copying hook code into the target region, and restoring execute-only protection.
Fig. 9: Example of a source-level breakpoint plan (left) and a execution-trace record (right) used for breakpoint-matched differential tracing.
Code translation converts programs between languages, frameworks, and representations while aiming to preserve behavior and sometimes improve safety or performance.
Decompilation -- recovering source code from compiled binaries -- is essential for security analysis, malware reverse engineering, and legacy software maintenance. However, existing decompilers produce code that often fails to compile or execute correctly, limiting their practical utility. We present a multi-agent framework that transforms decompiled code into re-executable source through Multi-level Constraint-Guided Decompilation (MCGD). Our approach employs a hierarchical validation pipeline with three constraint levels: (1) syntactic correctness via parsing, (2) compilability via GCC, and (3) behavioral equivalence via LLM-generated test cases. When validation fails, specialized LLM agents iteratively refine the code using structured error feedback. We evaluate our framework on 1,641 real-world binaries from ExeBench across three decompilers (RetDec, Ghidra, and Angr). Our framework achieves 84-97% re-executability, improving baseline decompiler output by 28-89 percentage points. In comparison with state-of-the-art LLM-based decompilation methods using the same GPT-4o backbone, our approach (84.1%) outperforms LLM4Decompile (80.3%), SK2Decompile (73.9%), and SALT4Decompile (61.8%). Our ablation study reveals that execution-based validation is critical: compile-only approaches achieve 0% behavioral correctness despite 91-99% compilation rates. The system converges efficiently, with 90%+ binaries reaching correctness within 2 iterations at an average cost of $0.03-0.05 per binary. Our results demonstrate that constraint-guided agentic refinement can bridge the gap between raw decompiler output and practically useful source code.
Binary decompilation is a critical reverse engineering task aimed at reconstructing high-level source code from stripped executables. Although Large Language Models (LLMs) have recently shown promise, they often suffer from "logical hallucinations" and "semantic misalignment" due to the irreversible semantic loss during compilation, resulting in generated code that fails to re-execute. In this study, we propose Cognitive Decompiler Refinement with Robustness (CoDe-R), a lightweight two-stage code refinement framework. The first stage introduces Semantic Cognitive Enhancement (SCE), a Rationale-Guided Semantic Injection strategy that trains the model to recover high-level algorithmic intent alongside code. The second stage introduces a Dynamic Dual-Path Fallback (DDPF) mechanism during inference, which adaptively balances semantic recovery and syntactic stability via a hybrid verification strategy. Evaluation on the HumanEval-Decompile benchmark demonstrates that CoDe-R (using a 1.3B backbone) establishes a new State-of-the-Art (SOTA) in the lightweight regime. Notably, it is the first 1.3B model to exceed an Average Re-executability Rate of 50.00%, significantly outperforming the baseline and effectively bridging the gap between efficient models and expert-level performance. Our code is available at https://github.com/Theaoi/CoDe-R.
Qiang Zhang, Zhongnian Li
School of Computer Science and Technology / School of Artificial Intelligence, China University of Mining and Technology, Xuzhou, China · Mine Digitization Engineering Research Center of the Ministry of Education, China University of Mining and Technology, Xuzhou, China
Decompiled C often becomes recompilable only after repair, but recompilation alone does not establish test-observed behavior. A recompiled command-line binary can still parse options incorrectly, print different bytes, or return a different exit status. We present a few-step workflow for repairing decompiled C using compiler feedback and related official tests. Compiler and linker diagnostics first guide build repair. Once the repaired C recompiles into a binary, smoke checks and related official tests expose behavioral discrepancies for semantic repair. In a preliminary static-enriched evaluation on 104 Coreutils 9.5 binaries with available decompiler exports and deterministic exact-output smoke comparisons, 91 binaries (87.5%) recompile and pass the test gate; 9 do not recompile within the repair budget, and 4 recompile but still fail the test gate. The result suggests that test-gate feedback can make LLM-assisted repair of decompiled C more auditable than compile-only recovery.
Yuhan Huang, Puzhuo Liu, Jianlei Chi
Xidian University Xi’an, China · Ant Group Hangzhou, China