LLM4CodeRE: Generative AI for Code Decompilation Analysis and Reverse Engineering

Hamed Jelodar; Samita Bai; Tochukwu Emmanuel Nwankwo; Parisa Hamedi; Mohammad Meymani; Roozbeh Razavi-Far; Ali A. Ghorbani

cs.CRApr 7, 2026

LLM4CodeRE: Generative AI for Code Decompilation Analysis and Reverse Engineering

Authors: Hamed Jelodar, Samita Bai, Tochukwu Emmanuel Nwankwo, Parisa Hamedi, Mohammad Meymani, Roozbeh Razavi-Far, Ali A. Ghorbani

Organizations: Faculty of Computer Science, University of New Brunswick, Canada

Abstract

Code decompilation analysis is a fundamental yet challenging task in malware reverse engineering, particularly due to the pervasive use of sophisticated obfuscation techniques. Although recent large language models (LLMs) have shown promise in translating low-level representations into high-level source code, most existing approaches rely on generic code pretraining and lack adaptation to malicious software. We propose LLM4CodeRE, a domain-adaptive LLM framework for bidirectional code reverse engineering that supports both assembly-to-source decompilation and source-to-assembly translation within a unified model. To enable effective task adaptation, we introduce two complementary fine-tuning strategies: (i) a Multi-Adapter approach for task-specific syntactic and semantic alignment, and (ii) a Seq2Seq Unified approach using task-conditioned prefixes to enforce end-to-end generation constraints. Experimental results demonstrate that LLM4CodeRE outperforms existing decompilation tools and general-purpose code models, achieving robust bidirectional generalization.

Figures & tables

Fig. 1: System pipeline of the proposed LLM4CodeRE framework. Malware binaries are disassembled and normalized into paired assembly and source representations. A backbone LLM is pretrained using a causal language modeling (CLM) objective on malware corpora. Task adaptation is performed using LoRA and task-specific adapters or Seq2Seq Unified prefix tokens. The unified model supports bidirectional code transformation (Asm $\rightarrow$ Src and Src $\rightarrow$ Asm) and is evaluated using semantic similarity, edit similarity, and re-executability metrics.

Fig. 2: Relationship between fine-tuning strategies and trained models for decompiling tasks.

Dataset	Source	NLD	Assembly	Binary
1. BODMAS	93711	93711	92317	88605
2. MalwareBazaar	14746	14746	14051	13973
3. Sorel20m	81584	81584	81177	79166
4. Dike	17431	17431	12138	11726
5. XLangKode	468679	468679	5974	13299
Total	676151	676151	205657	206769

TABLE I: Statistics of the SBAN Dataset Across Constituent Corpora. [ 14 ]

Fig. 3: Pareto chart of the dedicated compiled count on the PE-Machine Learning-200 dataset. Bars (left axis) show per-model counts (sorted in descending order), and the line (right axis) shows the cumulative percentage of the total count.

Fig. 4: Perplexity comparison across datasets for four language models under two settings: Original (non–fine-tuned) and Domain (domain–fine-tuned). Left: grouped bar chart reporting absolute perplexity on each dataset (lower is better). Right: dumbbell plot illustrating the per-model change from Original to Domain, where shorter (left-shifted) Domain markers indicate improved performance after domain adaptation.

Fig. 5: Quantitative evaluation of conversion quality in both directions. (a) Asm-to-Src and (b) Src-to-Asm: Edit similarity and semantic similarity across models (higher is better)

Fig. 6: Re-executability scores (percentage of translated programs that recompile and execute successfully) for assembly-to-source (Asm→Src) translation on the XLangKode dataset. Methods are ranked by performance; LLM4CodeRE (S2S) achieves the highest re-executability (86%), followed by LLM4CodeRE (MA) (53%), LLM4Decompile (48%), and DeepSeek (15%).

Software Reverse Engineering

Software reverse engineering recovers program structure, behavior, and intent from binaries when source code is missing, optimized, or obfuscated.

See all 34 papers

Multi-View Decompilation for LLM-Based Malware Classification
Jun 18, 2026Bercan Turkmen, Vyas RainaSoftware Reverse Engineering LLM Prompting
Independent Researcher · SPARK
Automatically Attacking Software Reverse Engineering AI Agents
May 28, 2026Brian Crawford, Justin Phillips, Patrick McClureSoftware Engineering Adversarial Prompt Generation
Naval Postgraduate School, Monterey, CA, United States
CoDe-R: Refining Decompiler Output with LLMs via Rationale Guidance and Adaptive Inference
Apr 14, 2026Qiang Zhang, Zhongnian LiAdaptive Inference Software Reverse Engineering
School of Computer Science and Technology / School of Artificial Intelligence, China University of Mining and Technology, Xuzhou, China · Mine Digitization Engineering Research Center of the Ministry of Education, China University of Mining and Technology, Xuzhou, China

Jun 18, 2026J/K move · Enter open · S save

Multi-View Decompilation for LLM-Based Malware Classification

Bercan Turkmen, Vyas Raina

Independent Researcher · SPARK

Software Reverse Engineering LLM Prompting Malware Classification LLMs for Cybersecurity Malware Analysis Malware Detection

Open paper AskPDF arXiv

Malware analysts often inspect compiled binaries through decompiled pseudo-C, when source code is unavailable. Recent work suggests that large language models (LLMs) can assist this process by classifying decompiled code as benign or malicious, but existing pipelines typically rely on a single decompiler view. We argue that this assumption is fragile: decompilers are lossy heuristic tools, and different decompilers can expose different artefacts of the same binary. We curate a benchmark of benign utilities and malicious programs spanning a range of threat behaviors. Each sample is compiled and decompiled with both Ghidra and RetDec, yielding matched pseudo-C views. Across a range of LLMs from major model families, we find that providing both decompiler views improves malicious-class F1, mainly by increasing recall on malicious samples. Agreement analyses further show that Ghidra and RetDec make partially different errors, supporting the view that decompiler outputs provide complementary evidence. Our results suggest that multi-decompiler prompting is a simple, training-free way to improve LLM-based malware triage in practical settings.

Abstract

Software Reverse Engineering

Explore similar work

Multi-View Decompilation for LLM-Based Malware Classification

Automatically Attacking Software Reverse Engineering AI Agents

CoDe-R: Refining Decompiler Output with LLMs via Rationale Guidance and Adaptive Inference