[ { "arxiv_id": "2609.22719", "arxiv_version_reviewed": "v1", "authors": [ "Garima Agrawal", "Prasun Das", "Priyanka L", "Minisha N", "Akshay Sarvade", "Hemath Manivanan", "Sravani Joshna", "Prasad Kalyansundaram" ], "code_url": null, "date_basis": "First arXiv submission; no reviewed venue publication is established.", "date_basis_zh": "采用首次 arXiv 提交日期；未确立正式期刊或会议出版。", "date_precision": "day", "description_en": "Uses seven agents and human review to recover business requirements from source, tests, configuration and documentation. A reported enterprise migration checks extracted rules against production-defect records.", "description_zh": "利用七个智能体与人工审查，从源码、测试、配置及文档恢复业务需求；企业迁移案例以生产缺陷记录核对提取的规则。", "doi": "10.48550/arxiv.2609.22719", "entry_url": "https://awesomerea.org/papers/paper-agentic-business-rule-recovery/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-agentic-business-rule-recovery/", "evidence_urls": [ "https://arxiv.org/abs/2609.22719v1", "https://arxiv.org/html/2609.22719v1", "https://api.datacite.org/dois/10.48550/arxiv.2609.22719" ], "first_arxiv_date": "2026-09-19", "id": "paper-agentic-business-rule-recovery", "kind": "research", "metadata_notes": "Reviewed the September 2026 preprint and registered DOI. No dedicated public code or dataset was verified. Reported efficiency is an author case-study result, not an independently reproduced measurement.", "metadata_notes_zh": "已核对 2026 年 9 月预印本及注册 DOI，未核实专用公开代码或数据集。效率数字属于作者案例结果，并非独立复现实测。", "pdf_url": "https://arxiv.org/pdf/2609.22719v1", "project_url": null, "publication_date": "2026-09-19", "publication_status": "preprint", "runtime_tested": false, "scope_limitations_en": "Evidence covers one enterprise Java programme and one legacy pilot. The cost comparison uses a modeled manual baseline with asymmetric accounting. Static analysis misses some runtime and external rules; coverage does not establish completeness. Confidential inputs limit independent reproduction.", "scope_limitations_zh": "证据来自一个企业 Java 项目及一个遗留系统试点。成本比较采用估算的人工基线，核算口径不对称。静态分析遗漏部分运行时与外部规则，覆盖率不证明完整性；保密输入限制独立复现。", "targets": [ "app" ], "title": "From Code to Requirements: Agentic Reverse Engineering of Business Rules at Enterprise Scale", "title_zh": "从代码到需求：企业规模的智能体业务规则逆向恢复", "url": "https://arxiv.org/abs/2609.22719", "venue": "arXiv", "verification": "source-reviewed", "verified_at": "2026-10-20", "why_fits_en": "Extends application reconstruction to recovering behavioral specifications.", "why_fits_zh": "将应用逆向恢复扩展至行为规格与业务规则。", "year": 2026 }, { "arxiv_id": "2610.06900", "arxiv_version_reviewed": "v1", "authors": [ "Yujian Zhuang", "Dehong Gao", "Qichao Zhang", "Qijing Lai", "Jiaxin Wang", "Libin Yang", "Xiaoyan Cai" ], "code_url": null, "date_basis": "First arXiv submission date from the reviewed submission history; no formal publication was verified.", "date_basis_zh": "采用已核对的 arXiv 首次提交日期；尚未核实正式出版信息。", "date_precision": "day", "description_en": "ASAP aligns assembly and source representations during training, compresses assembly features into tokens, and supplies them alongside decompiler pseudocode to an LLM refiner. Masking and an assembly-advantage objective encourage the refiner to use low-level evidence.", "description_zh": "ASAP 在训练中对齐汇编与源码表示，将汇编特征压缩为标记，并与反编译伪代码一起交给 LLM 改进。掩码及汇编优势目标用于鼓励模型利用低层证据。", "doi": null, "entry_url": "https://awesomerea.org/papers/paper-asap-decompilation/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-asap-decompilation/", "evidence_urls": [ "https://arxiv.org/abs/2610.06900v1", "https://arxiv.org/html/2610.06900v1" ], "first_arxiv_date": "2026-09-30", "id": "paper-asap-decompilation", "kind": "research", "metadata_notes": "Both the abstract history and v1 HTML give 2026-09-30, despite the 2610 identifier prefix; the date was not inferred from that prefix. The article is CC BY 4.0. No author artifact URL or code/model/data license was verified from the reviewed sources and focused search; referenced training datasets retain their own terms.", "metadata_notes_zh": "尽管编号以 2610 开头，摘要历史与 v1 HTML 均给出 2026-09-30；日期未按编号前缀推算。文章采用 CC BY 4.0。已核对来源及定向检索未确认作者产物链接或代码／模型／数据许可；引用的训练数据集保留自身条款。", "pdf_url": "https://arxiv.org/pdf/2610.06900v1", "project_url": null, "publication_date": "2026-09-30", "publication_status": "preprint", "runtime_tested": false, "scope_limitations_en": "Evaluation uses C adaptations of HumanEval and MBPP, x86-64 GCC 11.4 at O0–O3, and Ghidra 11.0.3 pseudocode. Re-execution means passing supplied tests, not proving equivalence. Identifier/comment recovery is not a dedicated component, and frontier-scale model training is not exhaustively evaluated.", "scope_limitations_zh": "评估使用 HumanEval、MBPP 的 C 改编版本，采用 x86-64 GCC 11.4 的 O0–O3 及 Ghidra 11.0.3 伪代码。重新执行率指通过既有测试，并非等价证明。方法没有专门的标识符／注释恢复模块，也未穷尽评估前沿规模模型的训练。", "targets": [ "binary" ], "title": "ASAP: Assembly-Source Aligned Pseudocode Refinement For Binary Decompilation", "title_zh": "ASAP：通过汇编与源码对齐改进二进制反编译伪代码", "url": "https://arxiv.org/abs/2610.06900", "venue": "arXiv", "verification": "source-reviewed", "verified_at": "2026-10-20", "why_fits_en": "Adds an assembly-informed refinement approach that explicitly documents the limits of its execution-test evidence.", "why_fits_zh": "补充结合汇编证据的反编译改进方法，并明确执行测试证据的边界。", "year": 2026 }, { "arxiv_id": "2602.12681", "arxiv_version_reviewed": "v1", "authors": [ "Jiyong Uhm", "Minseok Kim", "Michalis Polychronakis", "Hyungjoon Koo" ], "code_url": null, "date_basis": "ACM's Crossref deposit records print and online publication on 2026-06-30. The PDF footer's July 2026 publication date and the FSE 2026 conference dates are not substituted for it.", "date_basis_zh": "ACM 提交的 Crossref 元数据将纸质与在线出版日期均记为 2026-06-30；本条目不以 PDF 页脚标注的 2026 年 7 月出版日期或 FSE 2026 会议日期替代该日期。", "date_precision": "day", "description_en": "The paper builds asmFooler to test whether learned binary code similarity detection (BCSD) models keep matching functions after semantics-preserving changes. From 620 baseline x86-64 ELF binaries (coreutils, binutils, PuTTY, nginx, SPEC2006 and others, built with Clang at O0–O3), it generates 9,565 variants using in-place instruction rewriting, basic-block reordering, Obfuscator-LLVM, semantic NOPs and junk code, and it adds a greedy search for dead-code sequences that make dissimilar functions look similar. Across Genius, Gemini, Asm2Vec, SAFE, Trex and BinShot, robustness depends on each model's preprocessing, architecture and features: block reordering drops BinShot's recall from 0.972 to 0.036 but lowers it by under 0.05 for the CFG-based Genius and Gemini. The false-positive attack reaches up to 100% success with 14.75 inserted instructions on average.", "description_zh": "论文构建 asmFooler，用于检验基于学习的二进制代码相似性检测（BCSD）模型在语义保持的改动后能否继续匹配函数。它以 620 个基准 x86-64 ELF 二进制（包括 coreutils、binutils、PuTTY、nginx、SPEC2006 等，均由 Clang 以 O0–O3 编译）为起点，通过原地指令改写、基本块重排、Obfuscator-LLVM、语义空操作和垃圾代码插入生成 9,565 个变体，并加入一种贪心搜索，寻找能让不相似函数显得相似的死代码序列。在 Genius、Gemini、Asm2Vec、SAFE、Trex 与 BinShot 上的结果表明，鲁棒性取决于各模型的预处理、架构与特征：基本块重排使 BinShot 的召回率从 0.972 降至 0.036，而基于控制流图的 Genius 与 Gemini 召回率降幅不足 0.05。误报攻击的成功率最高可达 100%，平均只需插入 14.75 条指令。", "doi": "10.1145/3797116", "entry_url": "https://awesomerea.org/papers/paper-asmfooler/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-asmfooler/", "evidence_urls": [ "https://dl.acm.org/doi/10.1145/3797116", "https://api.crossref.org/works/10.1145/3797116", "https://arxiv.org/abs/2602.12681", "https://arxiv.org/pdf/2602.12681v1", "https://zenodo.org/records/17116512" ], "first_arxiv_date": "2026-02-13", "id": "paper-asmfooler", "kind": "research", "metadata_notes": "Crossref records Proceedings of the ACM on Software Engineering volume 3, issue FSE, pages 1957–1980, with a CC BY 4.0 license; the PDF footer gives article FSE088. The ACM title capitalizes 'Semantics-Preserving', while arXiv writes 'Semantics-preserving'; the four-author order matches. The ACM landing page refused automated access, so publication facts follow Crossref and the reviewed text is arXiv v1 (2026-02-13), the only version, whose comment states FSE 2026 acceptance. The Data Availability section links Zenodo record 10.5281/zenodo.17116512, a software record named asmFooler (2025-09-11, CC BY 4.0) whose creator is listed as 'anonymous', with a 159 KB artifact archive and a 5 GB dataset archive. Because no author-identified code repository was found, code_url stays null and the Zenodo DOI is recorded here as an artifact identifier, not a paper identifier. The archives were not downloaded and nothing was run.", "metadata_notes_zh": "Crossref 记录该文刊于 Proceedings of the ACM on Software Engineering 第 3 卷 FSE 期，页码 1957–1980，许可证为 CC BY 4.0；PDF 页脚标注文章编号 FSE088。ACM 标题写作“Semantics-Preserving”，arXiv 则为“Semantics-preserving”；四位作者顺序一致。ACM 文章页面拒绝自动访问，因此出版信息以 Crossref 为准，所审阅的文本是唯一版本 arXiv v1（2026-02-13），其注释说明论文已被 FSE 2026 接收。数据可用性章节链接 Zenodo 记录 10.5281/zenodo.17116512，这是名为 asmFooler 的软件记录（2025-09-11，CC BY 4.0），创建者显示为“anonymous”，包含 159 KB 的产物压缩包和 5 GB 的数据集压缩包。由于未找到署名作者的代码仓库，code_url 保持为空，该 Zenodo DOI 仅作为产物标识记录于此，而非论文标识。本次未下载压缩包，也未运行任何内容。", "pdf_url": "https://arxiv.org/pdf/2602.12681v1", "project_url": null, "publication_date": "2026-06-30", "publication_status": "journal-article", "runtime_tested": false, "scope_limitations_en": "All samples are x86-64 ELF binaries compiled by the authors from open-source packages and SPEC2006; some packages failed to compile or transform, and the in-place transformation is non-deterministic and not formally verified. The six models evaluated (Genius, Gemini, Asm2Vec, SAFE, Trex and BinShot) exclude jTrans and LLM-based similarity models, so the findings are not shown to transfer to newer or LLM-based systems. Results depend on the transformation budgets the authors set to fit each model's input limits, and semantic NOPs and junk code are inserted only at function entry. Packing, encryption, string obfuscation and commercial protectors such as VMProtect and Themida are out of scope, and adversarial training is left to future work.", "scope_limitations_zh": "所有样本都是作者由开源软件包和 SPEC2006 编译的 x86-64 ELF 二进制；部分软件包未能成功编译或变换，原地变换具有不确定性，也未经形式化验证。评测的六个模型（Genius、Gemini、Asm2Vec、SAFE、Trex 与 BinShot）不包括 jTrans 及基于大语言模型的相似性模型，因此研究结论未被证明适用于更新的或基于大语言模型的系统。结果取决于作者为适应各模型输入上限而设定的变换预算，语义空操作与垃圾代码也只插入在函数入口处。加壳、加密、字符串混淆以及 VMProtect、Themida 等商业保护工具不在研究范围内，对抗训练留待后续工作。", "targets": [ "binary" ], "title": "Fool Me If You Can: On the Robustness of Binary Code Similarity Detection Models against Semantics-Preserving Transformations", "title_zh": "有本事就骗过我：二进制代码相似性检测模型对语义保持变换的鲁棒性研究", "url": "https://dl.acm.org/doi/10.1145/3797116", "venue": "Proceedings of the ACM on Software Engineering (FSE 2026)", "verification": "source-reviewed", "verified_at": "2026-10-19", "why_fits_en": "Adds a measured study of how code diversification and obfuscation mislead learned binary similarity models, which matters when reverse engineers rely on such models to match functions in transformed binaries.", "why_fits_zh": "补充一项关于代码多样化与混淆如何误导基于学习的二进制相似性模型的量化研究；当逆向工程依靠此类模型在经过变换的二进制中匹配函数时，这一问题尤为重要。", "year": 2026 }, { "arxiv_id": "2605.30667", "arxiv_version_reviewed": "v1", "authors": [ "Brian Crawford", "Justin Phillips", "Patrick McClure" ], "code_url": null, "date_basis": "Publisher and Crossref online publication date; arXiv submission is recorded separately.", "date_basis_zh": "采用出版方与 Crossref 的在线出版日期，arXiv 首次提交日期另行记录。", "date_precision": "day", "description_en": "A proof of concept for indirect prompt injection against Cline/GhidraMCP binary-analysis agents. An adapted AutoDAN generates embedded strings that make the agent describe different behavior. The authors demonstrate four small C programs with Qwen3-8B and transfer the examples to GPT-OSS-120B.", "description_zh": "研究针对 Cline/GhidraMCP 二进制分析智能体的间接提示注入。改造后的 AutoDAN 生成嵌入字符串，使分析报告偏离程序实际行为。作者以四个小型 C 程序在 Qwen3-8B 上演示，并将样例迁移到 GPT-OSS-120B。", "doi": "10.34190/eccws.25.1.4597", "entry_url": "https://awesomerea.org/papers/paper-attacking-re-ai-agents/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-attacking-re-ai-agents/", "evidence_urls": [ "https://papers.academic-conferences.org/index.php/eccws/article/view/4597", "https://papers.academic-conferences.org/index.php/eccws/article/download/4597/4412/17540", "https://api.crossref.org/works/10.34190/eccws.25.1.4597", "https://arxiv.org/abs/2605.30667v1", "https://arxiv.org/pdf/2605.30667v1" ], "first_arxiv_date": "2026-05-28", "id": "paper-attacking-re-ai-agents", "kind": "research", "metadata_notes": "ECCWS proceedings, pages 199–205; Crossref labels its deposit journal-article. Author order agrees across publisher, Crossref and arXiv. No implementation or dataset is linked in the reviewed primary sources; code/project links remain null. No experiments were run.", "metadata_notes_zh": "发表于 ECCWS 论文集，第 199–205 页；Crossref 将该元数据条目标为 journal-article。三处一手来源的作者顺序一致。所审阅的一手来源未链接实现或数据集，代码和项目链接留空。本次未运行实验。", "pdf_url": "https://papers.academic-conferences.org/index.php/eccws/article/download/4597/4412/17540", "project_url": null, "publication_date": "2026-06-15", "publication_status": "conference-paper", "runtime_tested": false, "scope_limitations_en": "Four illustrative programs, each with one or two functions; no repeated-trial success rate, realistic malware corpus or defense evaluation. The reported decompiler setting truncates strings beyond 2,048 characters. These examples do not establish general reliability across models or complex binaries.", "scope_limitations_zh": "仅有四个单函数或双函数示例，没有重复试验成功率、真实恶意软件语料或防御评测。论文所用反编译设置会截断超过 2,048 字符的字符串，结果不能推及其他模型或复杂二进制。", "targets": [ "binary" ], "title": "Automatically Attacking Software Reverse Engineering AI Agents", "title_zh": "针对软件逆向工程 AI 智能体的自动化攻击", "url": "https://papers.academic-conferences.org/index.php/eccws/article/view/4597", "venue": "ECCWS 2026", "verification": "source-reviewed", "verified_at": "2026-10-19", "why_fits_en": "Adds direct evidence of a trust-boundary failure in agent-assisted reverse engineering.", "why_fits_zh": "补充智能体辅助逆向工程中信任边界失效的直接研究证据。", "year": 2026 }, { "arxiv_id": "2606.16162", "arxiv_version_reviewed": "v2", "authors": [ "Peipei Liu", "Jian Sun", "Mingzhe Xing", "Yicheng Zeng", "Zhaoteng Yan", "Lixiao Zhang", "Li Chen", "Dan Li" ], "code_url": "https://zenodo.org/records/23120286", "date_basis": "First arXiv submission on 2026-06-15; the reviewed v2 revision is 2026-10-03, not a separate publication.", "date_basis_zh": "采用 2026-06-15 的 arXiv 首投日期；本次核对的 v2 修订日期为 2026-10-03，并非另一次出版。", "date_precision": "day", "description_en": "AutoDecompiler trains function-level decompilation models to revise assembly- or pseudocode-derived outputs using compilation, execution and I/O feedback. Its reinforcement-learning design combines diagnostic feedback with rewards for valid code, tested behavior, syntax and data-flow structure.", "description_zh": "AutoDecompiler 训练函数级反编译模型，利用编译、执行及 I/O 反馈修正汇编或伪代码输入产生的输出。其强化学习设计结合诊断反馈及代码有效性、测试行为、语法和数据流结构奖励。", "doi": null, "entry_url": "https://awesomerea.org/papers/paper-autodecompiler/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-autodecompiler/", "evidence_urls": [ "https://arxiv.org/abs/2606.16162v2", "https://arxiv.org/html/2606.16162v2", "https://arxiv.org/abs/2606.16162v1", "https://arxiv.org/pdf/2606.16162v2", "https://zenodo.org/api/records/23120286", "https://huggingface.co/api/models/AutoDecompiler/AutoDecompiler-1.3B-e2e" ], "first_arxiv_date": "2026-06-15", "id": "paper-autodecompiler", "kind": "research", "metadata_notes": "First submitted 2026-06-15; reviewed v2 is dated 2026-10-03. The arXiv record uses the shorter catalog title, while the v2 PDF/HTML use a longer title beginning “AutoDecompiler: Reinforcement-Learning-Trained”; eight authors match. Zenodo version 23120286 lists code/data archives under CC BY 4.0; only metadata and its small README were read. The inspected Hugging Face model has no license metadata. No weights or archives were downloaded or run.", "metadata_notes_zh": "首投日期为 2026-06-15，本次核对的 v2 日期为 2026-10-03。目录采用 arXiv 记录的较短标题，v2 PDF／HTML 采用以“AutoDecompiler: Reinforcement-Learning-Trained”开头的更长标题，八位作者一致。Zenodo 版本 23120286 列出采用 CC BY 4.0 的代码／数据归档；仅检查元数据与简短 README。已查 Hugging Face 模型未提供许可元数据。本次未下载或运行权重及归档。", "pdf_url": "https://arxiv.org/pdf/2606.16162v2", "project_url": "https://huggingface.co/AutoDecompiler", "publication_date": "2026-06-15", "publication_status": "preprint", "runtime_tested": false, "scope_limitations_en": "Evaluation uses C adaptations of HumanEval and MBPP with validation feedback; finite tests do not establish general equivalence. HumanEval also informs reward-weight selection, and base-model pretraining exposure cannot be ruled out. Refinement is context-limited, whole-program dependencies are not recovered, and unseen toolchains or protected binaries remain limitations.", "scope_limitations_zh": "评估采用 HumanEval、MBPP 的 C 改编版本及验证反馈，有限测试不证明一般等价。HumanEval 还用于选择奖励权重，无法排除基座模型预训练时接触基准。修正受上下文长度限制，不恢复完整程序依赖，对未见工具链或受保护二进制仍有局限。", "targets": [ "binary" ], "title": "Binary Decompilation LLM with Feedback-Driven Multi-Turn Refinement", "title_zh": "基于反馈驱动多轮修正的二进制反编译大语言模型", "url": "https://arxiv.org/abs/2606.16162", "venue": "arXiv", "verification": "source-reviewed", "verified_at": "2026-10-20", "why_fits_en": "Adds reinforcement-learning-trained use of program feedback, with separately recorded first submission and latest revision.", "why_fits_zh": "补充通过强化学习学习利用程序反馈的方案，并分别记录首投与最新修订。", "year": 2026 }, { "arxiv_id": null, "arxiv_version_reviewed": null, "authors": [ "Jonas Zaddach", "Luca Bruno", "Aurélien Francillon", "Davide Balzarotti" ], "code_url": "https://github.com/avatarone/avatar-python", "date_basis": "Internet Society-deposited Crossref metadata supplies only publication year 2014; the publisher PDF separately identifies the 23–26 February 2014 symposium, which is not used to assert a publication month or day.", "date_basis_zh": "Internet Society 向 Crossref 提交的元数据仅给出出版年份 2014；出版方 PDF 另列研讨会日期为 2014 年 2 月 23—26 日，本条目不据此推定出版月份或日期。", "date_precision": "year", "description_en": "Avatar runs embedded firmware in an instrumented emulator, S²E on QEMU, while forwarding memory-mapped I/O to the real device and injecting the device's interrupts back into the emulator, so firmware that depends on undocumented peripherals can still be analyzed dynamically. The device is reached through JTAG via OpenOCD or through a small debugging stub over a serial line. Because forwarding every access over a 38400-baud serial link is very slow, about five instructions per second in one of the authors' measurements, Avatar also keeps memory that never behaves like I/O local to the emulator, migrates selected code to run natively on the device, and switches state between the two. With S²E's selective symbolic execution, the authors probe a hard-disk mask-ROM bootloader for hidden commands, an IEEE 802.15.4 sensor node for an injected overflow, and the SMS decoding routines of a GSM feature phone.", "description_zh": "Avatar 在插桩模拟器（基于 QEMU 的 S²E）中运行嵌入式固件，同时把内存映射 I/O 转发给真实设备，并将设备产生的中断注入回模拟器，使依赖无文档外设的固件仍可接受动态分析。框架经由 OpenOCD 通过 JTAG 访问设备，或通过串口上的小型调试桩访问。由于经 38400 波特串口转发每次访问非常缓慢（作者的一次测量中约为每秒五条指令），Avatar 还会把从不表现为 I/O 的内存保留在模拟器本地，将选定代码迁移到设备上原生运行，并在两者之间切换状态。结合 S²E 的选择性符号执行，作者检查了硬盘掩膜 ROM 引导程序中的隐藏命令、一个 IEEE 802.15.4 传感器节点中人为注入的溢出，以及一部 GSM 功能手机的短信解码例程。", "doi": "10.14722/ndss.2014.23229", "entry_url": "https://awesomerea.org/papers/paper-avatar/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-avatar/", "evidence_urls": [ "https://www.ndss-symposium.org/ndss2014/ndss-2014-programme/avatar-framework-support-dynamic-security-analysis-embedded-systems-firmwares/", "https://api.crossref.org/works/10.14722/ndss.2014.23229", "https://www.ndss-symposium.org/wp-content/uploads/2017/09/02_3_1.pdf", "https://s3.eurecom.fr/tools/avatar/", "https://github.com/avatarone/avatar-python/blob/c6d74f85f63333e3031e1f5e208d3f90e316a9e4/README.rst", "https://github.com/avatarone/avatar-python/blob/c6d74f85f63333e3031e1f5e208d3f90e316a9e4/COPYRIGHT" ], "first_arxiv_date": null, "id": "paper-avatar", "kind": "research", "metadata_notes": "Crossref gives the title, the four-author order and year 2014 with no pages. The DOI’s registered target, a /ndss2014/programme/ URL ending in an encoded apostrophe, returned HTTP 404 on 2026-10-19, so this record uses the working NDSS programme page, which links the 16-page PDF and slides. The PDF footer identifies NDSS ’14, 23–26 February 2014, San Diego, with ISBN 1-891562-35-5, but its DOI line is the placeholder “http://dx.doi.org/OETT”; the Crossref DOI is recorded here. The paper gives the framework’s location as the EURECOM project page, which now carries a deprecation notice pointing to the successor Avatar² (avatartwo/avatar2), a later, separate project not covered by this record. That page links the Python core, whose eurecom-s3 URL redirects to avatarone/avatar-python; the reviewed 2016-10-18 commit is Apache-2.0 (Copyright 2013–2014 Institut Eurecom) and points to separate repositories for the NDSS’14 samples, the patched S²E and OpenOCD. No code was installed or run, and no devices were used.", "metadata_notes_zh": "Crossref 给出标题、四位作者顺序及年份 2014，未列页码。DOI 登记的目标地址是一个以编码撇号结尾的 /ndss2014/programme/ 链接，2026-10-19 访问时返回 HTTP 404，因此本条目使用可访问的 NDSS 会议议程页面，该页面链接 16 页 PDF 与幻灯片。PDF 页脚标明 NDSS ’14 于 2014 年 2 月 23—26 日在圣迭戈举行，载有 ISBN 1-891562-35-5，但 DOI 一行为占位符“http://dx.doi.org/OETT”；本条目记录的是 Crossref DOI。论文指明框架位于 EURECOM 项目页面，该页面现已注明项目停止维护，并指向后续项目 Avatar²（avatartwo/avatar2）；后者是较晚的独立项目，不在本条目范围内。该页面链接 Python 核心库，其 eurecom-s3 地址重定向至 avatarone/avatar-python；所审阅的 2016-10-18 提交采用 Apache-2.0 许可（版权归 Institut Eurecom 2013–2014），并指向另行存放的 NDSS’14 示例、修改版 S²E 与 OpenOCD 仓库。本次未安装或运行代码，也未使用任何设备。", "pdf_url": "https://www.ndss-symposium.org/wp-content/uploads/2017/09/02_3_1.pdf", "project_url": "https://s3.eurecom.fr/tools/avatar/", "publication_date": null, "publication_status": "conference-paper", "runtime_tested": false, "scope_limitations_en": "Avatar needs the physical device and a working debug channel or an injectable stub; it does not model peripherals, so it is not standalone rehosting. The three case studies are all ARM devices (a hard disk with an ARM966 core, a Redwire Econotag and a Motorola C118 phone), and each needed manual work to choose hook points and code regions. Full-separation mode is too slow for time-critical code such as DRAM initialization, and the authors report that memory changed by DMA, or by code migrated to the device, is hard to keep synchronized with the emulator. The sensor-node vulnerability was artificially inserted into a demonstration program, the bootloader study confirmed documented commands rather than finding a backdoor, and the phone's GSM stack was too complex for symbolic execution: 42 subroutines were explored without an exploitable condition before state explosion. These are 2014 results on an S²E port the authors extended for ARM.", "scope_limitations_zh": "Avatar 需要实体设备以及可用的调试通道或可注入的调试桩；它不对外设建模，因此不是独立的固件重托管。三个案例均为 ARM 设备（采用 ARM966 内核的硬盘、Redwire Econotag 与 Motorola C118 手机），每个案例都需人工选择挂钩点与代码区域。完全分离模式过慢，无法处理 DRAM 初始化等时间敏感代码；作者也指出，由 DMA 或迁移到设备上运行的代码修改的内存，难以与模拟器保持同步。传感器节点中的漏洞是人为插入演示程序的，引导程序研究确认的是已有文档的命令，而非发现后门；手机的 GSM 协议栈对符号执行而言过于复杂，在状态爆炸前探索了 42 个子程序，未发现可利用条件。这些是 2014 年的结果，所用 S²E 由作者扩展了 ARM 支持。", "targets": [ "firmware" ], "title": "Avatar: A Framework to Support Dynamic Security Analysis of Embedded Systems’ Firmwares", "title_zh": "Avatar：支持嵌入式系统固件动态安全分析的框架", "url": "https://www.ndss-symposium.org/ndss2014/ndss-2014-programme/avatar-framework-support-dynamic-security-analysis-embedded-systems-firmwares/", "venue": "NDSS 2014", "verification": "source-reviewed", "verified_at": "2026-10-19", "why_fits_en": "Adds hardware-in-the-loop firmware analysis, which forwards emulator I/O to the real device, alongside the collection's emulation-based firmware rehosting research.", "why_fits_zh": "补充将模拟器 I/O 转发至真实设备的硬件在环固件分析方法，与合集中基于仿真的固件重托管研究互为补充。", "year": 2014 }, { "arxiv_id": "2212.08950", "arxiv_version_reviewed": "v1", "authors": [ "Iman Hosseini", "Brendan Dolan-Gavitt" ], "code_url": "https://figshare.com/s/2c68b9c181e80f4e3b06", "date_basis": "Internet Society-deposited Crossref metadata supplies only publication year 2022; the publisher PDF separately identifies the 24 April 2022 workshop, which is not used to assert a publication month or day.", "date_basis_zh": "Internet Society 向 Crossref 提交的元数据仅给出出版年份 2022；出版方 PDF 另列研讨会日期为 2022 年 4 月 24 日，本条目不据此推定出版月份或日期。", "date_precision": "year", "description_en": "BTC (Beyond The C) treats decompilation as plain-text translation from compiler-emitted x86-64 assembly to source code. It uses byte-pair-encoding tokenizers trained separately on assembly and source, and a standard fairseq transformer. Function pairs are matched through the compiler's CFI and line directives rather than language-specific parsers, compiler plugins or lifters, so the same pipeline is retrained for Go, Fortran, OCaml and C. Training sets range from about 10,000 functions for small C, Go and Fortran corpora to 2 million C functions built from Debian packages. The best model, trained on the large C set, reaches a normalized average edit distance of 0.46 on held-out functions.", "description_zh": "BTC（Beyond The C）将反编译视为从编译器输出的 x86-64 汇编到源码的纯文本翻译，分别在汇编与源码上训练字节对编码分词器，并使用标准 fairseq Transformer。它借助编译器输出的 CFI 与行号指令配对函数，而非依赖特定语言的解析器、编译器插件或提升器，因此同一流程可针对 Go、Fortran、OCaml 与 C 重新训练。训练集规模从小型 C、Go 与 Fortran 语料的约 10,000 个函数，到基于 Debian 软件包构建的 200 万个 C 函数不等。在大型 C 数据集上训练的最佳模型，在留出函数上的归一化平均编辑距离为 0.46。", "doi": "10.14722/bar.2022.23009", "entry_url": "https://awesomerea.org/papers/paper-beyond-the-c/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-beyond-the-c/", "evidence_urls": [ "https://www.ndss-symposium.org/ndss-paper/auto-draft-298/", "https://www.ndss-symposium.org/wp-content/uploads/bar2022_23009_paper.pdf", "https://doi.org/10.14722/bar.2022.23009", "https://api.crossref.org/works/10.14722/bar.2022.23009", "https://arxiv.org/abs/2212.08950v1", "https://figshare.com/s/2c68b9c181e80f4e3b06" ], "first_arxiv_date": "2022-12-17", "id": "paper-beyond-the-c", "kind": "research", "metadata_notes": "The NDSS paper page lists Iman Hosseini and Brendan Dolan-Gavitt (NYU) and links the PDF and slides; Crossref gives the same two authors and only the year 2022. The PDF footer gives BAR 2022, 24 April 2022, San Diego, with ISBN 1-891562-76-2 and the DOI. arXiv v1 (2022-12-17), the only version, was posted after the workshop and links the BAR DOI. The paper's Availability section gives the figshare link for code, data and trained models. It is a private-share link: a scripted request received an HTTP 202 challenge, while a browser showed an item titled “Beyond the C - data & code”, marked as privately shared, CC BY 4.0, modified 2022-01-04, with btc.zip (18.98 GB) and additional.zip. The archives were not downloaded or inspected, and the promised VS Code extension was not located. Nothing was run.", "metadata_notes_zh": "NDSS 论文页面列出 Iman Hosseini 与 Brendan Dolan-Gavitt（纽约大学），并链接 PDF 与演示幻灯片；Crossref 给出相同的两位作者，仅记载年份 2022。PDF 页脚标明 BAR 2022 于 2022 年 4 月 24 日在圣迭戈举行，并载有 ISBN 1-891562-76-2 与 DOI。arXiv v1（2022-12-17）是唯一版本，发布于研讨会之后，并链接 BAR DOI。论文的可用性章节给出存放代码、数据与训练模型的 figshare 链接。该链接为私有分享链接：脚本请求收到 HTTP 202 质询，而浏览器显示一个名为“Beyond the C - data & code”的条目，标注为私有分享、CC BY 4.0、修改于 2022-01-04，含 btc.zip（18.98 GB）与 additional.zip。本次未下载或检查这些压缩包，也未找到论文提及的 VS Code 扩展。本次未运行任何内容。", "pdf_url": "https://www.ndss-symposium.org/wp-content/uploads/bar2022_23009_paper.pdf", "project_url": null, "publication_date": null, "publication_status": "conference-paper", "runtime_tested": false, "scope_limitations_en": "Evaluation covers four languages at function level and scores outputs only by normalized edit distance to the original source. No compilation, test-based or semantic-equivalence check is reported, and whole-program decompilation is not evaluated. The authors state that the method cannot guarantee semantic correctness and is not yet ready for practical use on real code: even the best score means changes to roughly half of a function's tokens. Input is compiler-produced x86-64 assembly with labels and CFI directives intact, so disassembly of stripped binaries, other architectures and compilers without such directives are outside the evaluation. Sequence-length limits exclude long functions, and the small corpora are mostly competitive-programming and small utility code. The comparison with Katz et al. cites that work's reported score on shorter snippets rather than rerunning it on the same data.", "scope_limitations_zh": "评测在函数层面覆盖四种语言，仅以与原始源码的归一化编辑距离评分；未报告编译、测试或语义等价检查，也未评估完整程序的反编译。作者指出该方法无法保证语义正确，尚不能用于真实代码：即便最佳分数也意味着大约一半的函数词元需要修改。输入是保留标签与 CFI 指令的编译器生成 x86-64 汇编，因此对去符号二进制的反汇编、其他架构以及不输出此类指令的编译器均不在评测范围内。序列长度限制排除了较长函数，小型语料主要来自编程竞赛题和小型工具代码。与 Katz 等人的比较引用的是该工作在更短代码片段上报告的分数，而非在相同数据上重新运行。", "targets": [ "binary" ], "title": "Beyond the C: Retargetable Decompilation using Neural Machine Translation", "title_zh": "超越 C：基于神经机器翻译的可重定向反编译", "url": "https://www.ndss-symposium.org/ndss-paper/auto-draft-298/", "venue": "Workshop on Binary Analysis Research (BAR) 2022", "verification": "source-reviewed", "verified_at": "2026-10-18", "why_fits_en": "Adds neural decompilation evaluated beyond C, in Go, Fortran and OCaml, with a language-agnostic data pipeline, complementing the C-focused neural and LLM decompilation research in this section.", "why_fits_zh": "补充在 C 之外的 Go、Fortran 与 OCaml 上评测、并采用语言无关数据流程的神经反编译研究，与本节中聚焦 C 语言的神经网络及大语言模型反编译研究互补。", "year": 2022 }, { "arxiv_id": "2401.11161", "arxiv_version_reviewed": "v3", "authors": [ "Ling Jiang", "Junwen An", "Huihui Huang", "Qiyi Tang", "Sen Nie", "Shi Wu", "Yuqun Zhang" ], "code_url": null, "date_basis": "ACM's Crossref deposit records print and online publication on 2024-04-12, two days before the April 14–20 ICSE 2024 conference; the conference dates and arXiv dates are not substituted for it.", "date_basis_zh": "ACM 提交的 Crossref 元数据将纸质与在线出版日期均记为 2024-04-12，早于 4 月 14–20 日举行的 ICSE 2024 两天；本条目不以会议日期或 arXiv 日期替代该日期。", "date_precision": "day", "description_en": "BinaryAI identifies which open-source C/C++ libraries a stripped binary reuses by matching its functions to source code. Ghidra decompiles each binary function to pseudo-C, and a Pythia-410M model, trained with a CLIP-style contrastive loss on about 10 million binary–source function pairs, embeds pseudo-code and source functions in one space. Candidates retrieved from a corpus of 56,342,179 source functions from 12,013 libraries are refined with link-time locality and the call graph, and a library is reported when the share of its matched functions exceeds a threshold. The authors report 22.54% recall@1 against 10.75% for CodeCMR, and library-detection precision and recall of 85.84% and 64.98% against 73.36% and 59.81% for an unnamed commercial tool.", "description_zh": "BinaryAI 通过将剥离符号的二进制中的函数与源代码匹配，识别其复用了哪些开源 C/C++ 库。它先用 Ghidra 将每个二进制函数反编译为类 C 伪代码，再用以 CLIP 式对比损失、在约 1,000 万对二进制—源码函数上训练的 Pythia-410M 模型，把伪代码与源码函数嵌入同一向量空间。从包含 12,013 个库、56,342,179 个源码函数的语料中检索出候选后，方法借助链接时的位置局部性和调用图加以精炼；当某个库中被匹配函数的比例超过阈值时，即判定二进制包含该库。作者报告其 recall@1 为 22.54%，CodeCMR 为 10.75%；库识别的精确率与召回率分别为 85.84% 和 64.98%，一款未具名商业工具为 73.36% 和 59.81%。", "doi": "10.1145/3597503.3639100", "entry_url": "https://awesomerea.org/papers/paper-binaryai/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-binaryai/", "evidence_urls": [ "https://dl.acm.org/doi/10.1145/3597503.3639100", "https://api.crossref.org/works/10.1145/3597503.3639100", "https://arxiv.org/abs/2401.11161", "https://arxiv.org/pdf/2401.11161v3", "https://www.binaryai.cn/", "https://github.com/binaryai/sdk/blob/095d4add957bde2e6b07008a271fd86822923155/README.md" ], "first_arxiv_date": "2024-01-20", "id": "paper-binaryai", "kind": "research", "metadata_notes": "Crossref records the ICSE 2024 proceedings article, pages 1–13, and its seven-author order matches arXiv. arXiv v1 is dated 2024-01-20, v2 2024-01-23 and v3 2024-08-26; the reviewed v3 carries the ICSE '24 ACM reference format and DOI. The ACM landing page refused automated access, so publication facts follow Crossref and the arXiv v3 copy. The abstract links binaryai.net, which now redirects to the binaryai.cn web service, and the GPL-3.0 binaryai/sdk repository is a client for that service that needs a service credential. Neither releases the model, training pairs, corpus or labeled test set, so code_url and project_url stay null. A footnote says the module is deployed in industry with a growing corpus; another says the base model went through earlier OPT and BLOOM iterations before Pythia. Nothing was run.", "metadata_notes_zh": "Crossref 记录该文为 ICSE 2024 论文集文章，页码 1–13，七位作者顺序与 arXiv 一致。arXiv v1 发布于 2024-01-20，v2 为 2024-01-23，v3 为 2024-08-26；所审阅的 v3 带有 ICSE '24 的 ACM 引用格式与 DOI。ACM 文章页面拒绝自动访问，因此出版信息以 Crossref 和 arXiv v3 为准。摘要链接 binaryai.net，该地址现重定向至 binaryai.cn 在线服务；采用 GPL-3.0 许可的 binaryai/sdk 仓库是该服务的客户端，使用时需要服务凭据。两者都未发布模型、训练函数对、语料或带标注的测试集，因此 code_url 与 project_url 均为空。论文脚注说明该模块已在工业界部署且语料持续扩充；另一脚注说明基础模型此前曾采用 OPT 与 BLOOM，后改用 Pythia。本次未运行任何内容。", "pdf_url": "https://arxiv.org/pdf/2401.11161v3", "project_url": null, "publication_date": "2024-04-12", "publication_status": "conference-paper", "runtime_tested": false, "scope_limitations_en": "Training pairs come from ArchLinux and AUR packages compiled automatically with DWARF debug information, and the corpus and test set cover C/C++ projects only. The SCA test set is 150 stripped binaries the authors compiled from 85 GitHub projects, with 1,045 reused libraries labeled manually from build files, headers and license metadata; function-level ground truth covers 15 of those binaries (23,529 pairs). The recall@1 figures combine the model's validation set with those 15 binaries. The two commercial baselines are anonymized under confidentiality agreements, and every baseline was rebuilt on the authors' 12,013-library dataset. The 112 false positives the authors examined all trace to incomplete library-dependency data. The model, training pairs, source-function corpus and labeled test set are not public, and the hosted service the paper links may run a different model and corpus from the evaluated 2024 system. Matches identify reused source; they are not a decompilation or proof that the binary is unmodified.", "scope_limitations_zh": "训练函数对来自自动编译并保留 DWARF 调试信息的 ArchLinux 与 AUR 软件包，语料和测试集均只涵盖 C/C++ 项目。软件成分分析测试集是作者由 85 个 GitHub 项目编译出的 150 个剥离符号的二进制，其中 1,045 个被复用库依据构建文件、头文件和许可证元数据人工标注；函数级真实标签仅覆盖其中 15 个二进制（23,529 对）。recall@1 数据合并了模型验证集与这 15 个二进制。两款商业基线依保密协议匿名，所有基线均在作者的 12,013 个库数据集上重建。作者检查的 112 个误报都可追溯到不完整的库依赖数据。模型、训练函数对、源码函数语料和带标注的测试集均未公开；论文链接的在线服务所用模型与语料可能不同于 2024 年评测的系统。匹配结果说明复用了哪些源码，并不是反编译结果，也不能证明二进制未被修改。", "targets": [ "binary" ], "title": "BinaryAI: Binary Software Composition Analysis via Intelligent Binary Source Code Matching", "title_zh": "BinaryAI：基于智能二进制—源代码匹配的二进制软件成分分析", "url": "https://dl.acm.org/doi/10.1145/3597503.3639100", "venue": "ICSE 2024", "verification": "source-reviewed", "verified_at": "2026-10-19", "why_fits_en": "Adds binary-to-source function matching and binary software composition analysis, which identify reused open-source code inside stripped binaries, complementing binary-to-binary similarity and decompilation research.", "why_fits_zh": "补充二进制到源代码的函数匹配和二进制软件成分分析，用于识别剥离符号的二进制中复用的开源代码，与二进制间相似性及反编译研究互补。", "year": 2024 }, { "arxiv_id": null, "arxiv_version_reviewed": null, "authors": [ "Jared Chandler", "Adam Wick", "Kathleen Fisher" ], "citation": { "container_title": "Proceedings 2023 Network and Distributed System Security Symposium", "publisher": "Internet Society", "sources": [ "https://api.crossref.org/works/10.14722/ndss.2023.23131" ] }, "code_url": "https://github.com/binaryinferno/binaryinferno", "date_basis": "The official NDSS paper and publisher-deposited Crossref metadata establish publication year 2023. Crossref supplies no publication month or day; the conference dates and DOI registration date are not substituted.", "date_basis_zh": "NDSS 官方论文与出版方提交的 Crossref 元数据确立出版年份为 2023。Crossref 未给出出版月份或日期；本条目不以会议日期或 DOI 注册日期代替。", "date_precision": "year", "description_en": "Infers partial binary-message formats from static message samples without instrumenting an executable. Specialized detectors recognize floats, timestamps, lengths, entropy boundaries and serialization patterns; a graph-based integration step reconciles their descriptions. Across samples from ten protocols, the authors report top-level field-boundary precision of 0.69, recall of 0.73 and false-positive rate of 0.04 for the 1,000-message setting without analyst priors.", "description_zh": "无需对可执行程序插桩，即可从静态报文样本推断部分二进制报文格式。专用检测器识别浮点数、时间戳、长度、熵边界和序列化模式，再通过基于图的集成步骤协调各自的描述。作者对十种协议的样本开展评估，在每组 1,000 条报文且不使用分析者先验的设置下，报告顶层字段边界的精确率为 0.69、召回率为 0.73、假阳性率为 0.04。", "doi": "10.14722/ndss.2023.23131", "entry_url": "https://awesomerea.org/papers/paper-binaryinferno/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-binaryinferno/", "evidence_urls": [ "https://www.ndss-symposium.org/ndss-paper/binaryinferno-a-semantic-driven-approach-to-field-inference-for-binary-message-formats/", "https://www.ndss-symposium.org/wp-content/uploads/2023/02/ndss2023_s131_paper.pdf", "https://api.crossref.org/works/10.14722/ndss.2023.23131", "https://binaryinferno.net", "https://www.eecs.tufts.edu/~chandler/binaryinferno.html", "https://github.com/binaryinferno/binaryinferno/blob/cb42a63ada74737c10d01e2c22f4502ba3983976/README.md", "https://github.com/binaryinferno/binaryinferno/blob/cb42a63ada74737c10d01e2c22f4502ba3983976/LICENSE", "https://github.com/binaryinferno/binaryinferno/blob/cb42a63ada74737c10d01e2c22f4502ba3983976/binaryinferno/blackboard.py", "https://github.com/binaryinferno/binaryinferno/blob/cb42a63ada74737c10d01e2c22f4502ba3983976/binaryinferno/deconflict.py", "https://github.com/binaryinferno/binaryinferno/blob/cb42a63ada74737c10d01e2c22f4502ba3983976/binaryinferno/rep_parallel.sh", "https://github.com/binaryinferno/binaryinferno/blob/cb42a63ada74737c10d01e2c22f4502ba3983976/dataset/README.md" ], "first_arxiv_date": null, "id": "paper-binaryinferno", "kind": "research", "metadata_notes": "Three-author order, title and DOI agree across the publisher, paper and Crossref. No arXiv identifier or proceedings page range was verified; the PDF has 18 pages. The paper’s project URL leads to the author’s Tufts page, which links the repository. The reviewed 2023-05-02 snapshot has GPL-3.0-or-later code headers and a GPLv3 LICENSE; third-party trace provenance and rights require separate checking. README prerequisites are Python 3, sklearn, scipy and parallel, without pinned dependency versions; the pattern-search launcher also uses timeout and hardcodes 30 parallel jobs. Input is one hexadecimal message per line; timestamp search accepts a supplied time range. The actual entry file is binaryinferno/blackboard.py, despite the README’s basic-command blackboard.by typo. A dataset directory is present, but its README remains a placeholder. Historical setup and dataset completeness were not reproduced; no captures, binaries or model payloads were downloaded and no upstream code or notebooks were run.", "metadata_notes_zh": "出版方、论文和 Crossref 的三位作者顺序、标题及 DOI 一致。未核实到 arXiv 标识符或论文集页码范围；PDF 共 18 页。论文给出的项目网址跳转到作者的 Tufts 页面，该页面链接了仓库。所审阅的 2023-05-02 快照在代码头部声明 GPL-3.0-or-later，并包含 GPLv3 LICENSE；第三方轨迹的来源与权利需另行核查。README 要求 Python 3、sklearn、scipy 和 parallel，未固定依赖版本；模式搜索启动脚本还使用 timeout，并将并行任务数写定为 30。输入为每行一条十六进制报文；时间戳搜索可接受给定的时间范围。实际入口文件为 binaryinferno/blackboard.py，README 的基本命令将其误写为 blackboard.by。仓库包含数据集目录，但其 README 仍是占位说明。本次未复现历史环境或确认数据集完整性；未下载捕获数据、二进制或模型载荷，也未运行上游代码或笔记本。", "pdf_url": "https://www.ndss-symposium.org/wp-content/uploads/2023/02/ndss2023_s131_paper.pdf", "project_url": null, "publication_date": null, "publication_status": "conference-paper", "runtime_tested": false, "scope_limitations_en": "Assumes error-free, uncompressed, unencrypted, byte-aligned data and infers common fields or payload regions beginning at consistent offsets. It leaves optional/union fields and unsupported serialization patterns unresolved; sample diversity matters. The 26 encapsulated-payload test sets were pre-grouped using ground-truth message types, not discovered automatically. Ground truth merges adjacent fields that are constant across the sample; empty inference results are excluded from reported averages where stated. BI+ additionally uses supplied endianness and capture-time ranges. These are field-boundary results, not complete semantic recovery, protocol-state inference or behavioral equivalence.", "scope_limitations_zh": "假设数据无错误、未经压缩或加密、按字节对齐，并推断起始偏移一致的共有字段或载荷区域。可选字段、联合类型字段及不支持的序列化模式仍未解决；样本多样性会影响结果。26 组封装载荷测试集依据已知真实报文类型预先分组，并非自动发现。真实标签合并了在整个样本中均保持常量的相邻字段；文中注明的平均值排除了没有推断结果的样本。BI+ 额外使用给定的字节序和捕获时间范围。这些是字段边界结果，不代表完整语义恢复、协议状态推断或行为等价。", "targets": [ "protocol" ], "title": "BinaryInferno: A Semantic-Driven Approach to Field Inference for Binary Message Formats", "title_zh": "BinaryInferno：面向二进制报文格式字段推断的语义驱动方法", "url": "https://www.ndss-symposium.org/ndss-paper/binaryinferno-a-semantic-driven-approach-to-field-inference-for-binary-message-formats/", "venue": "NDSS 2023", "verification": "source-reviewed", "verified_at": "2026-10-17", "why_fits_en": "Provides trace-only semantic field inference that complements executable-assisted analysis and protocol-state learning, with explicit assumptions and evaluated false-positive behavior.", "why_fits_zh": "提供仅依赖报文轨迹的语义字段推断，与借助可执行程序的分析及协议状态学习互补，并明确列出假设和假阳性评估。", "year": 2023 }, { "arxiv_id": "2608.07038", "arxiv_version_reviewed": "v1", "authors": [ "Xiuwei Shang", "Li Hu", "Xiao Jiang", "Jieke Shi", "Junda He", "Zhou Yang", "Shaoyin Cheng", "Guoqiang Chen", "Weiming Zhang", "David Lo" ], "citation": { "container_title": "Proceedings of the 41st IEEE/ACM International Conference on Automated Software Engineering", "pages": "106-118", "publisher": "ACM", "sources": [ "https://api.crossref.org/works/10.1145/3832783.3834339" ] }, "code_url": null, "date_basis": "Publisher-deposited print publication date; online and arXiv dates are recorded separately.", "date_basis_zh": "采用出版方提交的印刷出版日期；在线及 arXiv 日期另行说明。", "date_precision": "day", "description_en": "BinJudgeBench collects expert judgments for function naming, binary-code summaries and decompilation refinement. BinJudge learns to select a judge configuration for each input and task, evaluating agreement with human scores rather than executable correctness.", "description_zh": "BinJudgeBench 收集函数命名、二进制代码摘要及反编译改进的专家评分。BinJudge 学习为每个输入及任务选择评审配置，评估与人工评分的一致性，而非可执行正确性。", "doi": "10.1145/3832783.3834339", "entry_url": "https://awesomerea.org/papers/paper-binjudge/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-binjudge/", "evidence_urls": [ "https://arxiv.org/abs/2608.07038v1", "https://arxiv.org/html/2608.07038v1", "https://api.crossref.org/works/10.1145/3832783.3834339", "https://zenodo.org/api/records/19247812", "https://zenodo.org/records/19310393" ], "first_arxiv_date": "2026-08-07", "id": "paper-binjudge", "kind": "research", "metadata_notes": "The arXiv abstract still says accepted, while ACM’s Crossref deposit records ASE 2026 publication on 2026-10-07. Direct ACM access returned HTTP 403. The paper-linked Zenodo concept 19247812 resolves to version 19310393, titled Artifact for BinJudge, with anonymous creator metadata and CC BY 4.0. Its 2.36 GB archive was not downloaded; internal code/data licensing and reproduction were not audited.", "metadata_notes_zh": "arXiv 摘要页仍写已录用，ACM 的 Crossref 元数据则记录 ASE 2026 于 2026-10-07 出版。ACM 直接访问返回 HTTP 403。论文链接的 Zenodo 概念记录 19247812 解析到版本 19310393，标题为 Artifact for BinJudge，创建者元数据匿名，声明 CC BY 4.0。本次未下载约 2.36 GB 归档，未审计内部代码／数据许可或复现实验。", "pdf_url": "https://arxiv.org/pdf/2608.07038v1", "project_url": "https://zenodo.org/records/19310393", "publication_date": "2026-10-07", "publication_status": "conference-paper", "runtime_tested": false, "scope_limitations_en": "The router uses five-fold validation on 1,233 annotated outputs. Initial annotators are three authors, with an independent industrial expert checking a subset. Human scores are subjective, and fluent unsupported answers can mislead judges. Correlation on these tasks neither proves program equivalence nor establishes that judges can replace human review.", "scope_limitations_zh": "路由器在 1,233 个已标注输出上进行五折验证。初始标注者是三位作者，另有独立产业专家复核子集。人工评分具有主观性，流畅但无依据的回答也可能误导评审。任务上的相关性既不证明程序等价，也不能据此认定评审模型可替代人工复核。", "targets": [ "binary" ], "title": "Beyond Text Matching: Towards Reference-Free Evaluation for Human-Oriented Binary Reverse Engineering", "title_zh": "超越文本匹配：面向人的二进制逆向工程的无参考评估", "url": "https://dl.acm.org/doi/10.1145/3832783.3834339", "venue": "ASE 2026", "verification": "source-reviewed", "verified_at": "2026-10-20", "why_fits_en": "Provides evidence-oriented evaluation resources for interpreting names, summaries and refined pseudocode.", "why_fits_zh": "补充解释恢复名称、代码摘要及改进后伪代码时所需的评估证据。", "year": 2026 }, { "arxiv_id": "2505.07360", "arxiv_version_reviewed": "v1", "authors": [ "Xiuwei Shang", "Guoqiang Chen", "Shaoyin Cheng", "Benlong Wu", "Li Hu", "Gangyang Li", "Weiming Zhang", "Nenghai Yu" ], "code_url": null, "date_basis": "The IJCAI Organization’s Crossref deposit gives publication month September 2025. The proceedings page’s citation metadata separately gives 2025-09-16; this entry keeps the month that both sources state and does not use the August 16–22 conference dates.", "date_basis_zh": "IJCAI 组织向 Crossref 提交的元数据给出出版月份为 2025 年 9 月；论文集页面的引用元数据另给出 2025-09-16。本条目采用两处来源均载明的月份，不使用 8 月 16–22 日的会议日期。", "date_precision": "month", "description_en": "BinMetric poses 1,000 questions across six binary-analysis tasks: call-site reconstruction, decompilation, signature recovery, binary code summarization, algorithm classification and assembly instruction generation. The questions come from 20 open-source C projects compiled for x86-64, stripped and processed with IDA Pro, and aligned with source code through DWARF information. The authors evaluate 12 LLMs from five model families with one-shot prompts, alongside IDA Pro’s decompiler, LLM4Decompile, BinT5 and HexT5 where those apply.", "description_zh": "BinMetric 提供六类二进制分析任务共 1,000 道题目：调用点重建、反编译、函数签名恢复、二进制代码摘要、算法分类与汇编指令生成。题目取自 20 个开源 C 项目：项目针对 x86-64 编译、剥离符号并经 IDA Pro 处理，再借助 DWARF 信息与源码对齐。作者使用单样例提示评测来自五个模型家族的 12 个大语言模型，并在适用任务上与 IDA Pro 反编译器、LLM4Decompile、BinT5 和 HexT5 对比。", "doi": "10.24963/ijcai.2025/858", "entry_url": "https://awesomerea.org/papers/paper-binmetric/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-binmetric/", "evidence_urls": [ "https://www.ijcai.org/proceedings/2025/858", "https://www.ijcai.org/proceedings/2025/0858.pdf", "https://api.crossref.org/works/10.24963/ijcai.2025/858", "https://arxiv.org/abs/2505.07360", "https://arxiv.org/pdf/2505.07360v1" ], "first_arxiv_date": "2025-05-12", "id": "paper-binmetric", "kind": "research", "metadata_notes": "The proceedings title reads “Binary Code Analysis Benchmark”; arXiv v1, the only version, is titled “A Comprehensive Binary Analysis Benchmark for Large Language Models” and is a 23-page extended version whose comment says it was to be published in IJCAI 2025. The proceedings PDF, page metadata and Crossref agree on the eight-author order, the DOI and pages 7715–7723 in the Main Track. Neither the proceedings PDF nor arXiv v1 links code, data or a leaderboard. A same-named GitHub repository describes itself as the IJCAI’25 benchmark but declares no license and is not linked from the paper, so it is not recorded as author-provided code. Per-task counts are 70 call-site, 250 decompilation, 250 signature, 250 summarization, 80 classification and 100 assembly-generation items. No benchmark data was downloaded, and no experiments were run.", "metadata_notes_zh": "论文集中的标题为“Binary Code Analysis Benchmark”；arXiv 唯一版本 v1 的标题为“A Comprehensive Binary Analysis Benchmark for Large Language Models”，是 23 页的扩展版本，备注称将发表于 IJCAI 2025。论文集 PDF、页面元数据与 Crossref 一致给出八位作者顺序、DOI 及主会第 7715–7723 页。论文集 PDF 与 arXiv v1 均未链接代码、数据或排行榜。GitHub 上一个同名仓库自称为该 IJCAI’25 基准，但未声明许可证，论文也未链接它，因此不将其记录为作者提供的代码。各任务题目数分别为调用点重建 70 道、反编译 250 道、签名恢复 250 道、代码摘要 250 道、算法分类 80 道、汇编生成 100 道。本次未下载基准数据，也未运行实验。", "pdf_url": "https://www.ijcai.org/proceedings/2025/0858.pdf", "project_url": null, "publication_date": "2025-09", "publication_status": "conference-paper", "runtime_tested": false, "scope_limitations_en": "Scores are question-level metrics on isolated snippets, not end-to-end reverse-engineering workflows or agentic tool use. Preprocessing requires IDA Pro, and all binaries are x86-64 builds with each project’s default compiler settings on Ubuntu 22.04; other architectures, optimization sweeps and obfuscation are not studied. Most tasks score text overlap with Rouge-L, BLEU, METEOR or CodeBLEU, so they do not test semantic equivalence; only assembly generation checks compilation and test-case execution, where the average execution pass rate is below 1%. Summary labels were generated by ChatGPT and then manually reviewed, and algorithm classification uses 80 snippets from a single algorithms project. Leakage screening relied on exact-match web searches. The evaluated models predate 2025 (including gpt-3.5-turbo-16k-0613 and gpt-4-0613) and ran with a maximum length of 8,192 tokens, so the rankings are historical.", "scope_limitations_zh": "得分是针对孤立代码片段的题目级指标，并不代表端到端逆向工程流程或智能体工具使用能力。预处理需要 IDA Pro，所有二进制均是在 Ubuntu 22.04 上以各项目默认编译设置构建的 x86-64 程序；未研究其他架构、优化级别变化或混淆。多数任务以 Rouge-L、BLEU、METEOR 或 CodeBLEU 衡量文本重合度，因而并不检验语义等价；只有汇编生成任务检查能否编译及测试用例执行结果，其平均执行通过率低于 1%。摘要标签由 ChatGPT 生成后经人工审核；算法分类使用取自单一算法项目的 80 个片段。数据泄露筛查依赖网页精确匹配搜索。被评测模型均早于 2025 年（包括 gpt-3.5-turbo-16k-0613 与 gpt-4-0613），最大长度设为 8,192 个词元，因此排名只反映当时情况。", "targets": [ "binary" ], "title": "BinMetric: A Comprehensive Binary Code Analysis Benchmark for Large Language Models", "title_zh": "BinMetric：面向大语言模型的综合二进制代码分析基准", "url": "https://www.ijcai.org/proceedings/2025/858", "venue": "IJCAI 2025", "verification": "source-reviewed", "verified_at": "2026-10-18", "why_fits_en": "Adds a multi-task benchmark spanning binary lifting, semantic recovery, algorithm identification and assembly synthesis, complementing single-task decompilation and agent benchmarks.", "why_fits_zh": "补充一个涵盖二进制提升、语义恢复、算法识别与汇编合成的多任务基准，与单一任务的反编译及智能体基准互补。", "year": 2025 }, { "arxiv_id": "2409.01994", "arxiv_version_reviewed": "v1", "authors": [ "Jiayi Jiang", "Xiyuan Zhang", "Chengcheng Wan", "Haoyi Chen", "Haiying Sun", "Ting Su" ], "citation": { "container_title": "Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security", "pages": "3689-3703", "publisher": "ACM", "sources": [ "https://api.crossref.org/works/10.1145/3658644.3690299" ] }, "code_url": "https://github.com/ecnusse/BinPRE", "date_basis": "The publisher’s Crossref deposit records published/print publication on 2024-12-02 and a separate publisher publication-history assertion on 2024-12-09. This record uses the published/print date; the October 14–18 CCS meeting dates and the September arXiv submission are separate.", "date_basis_zh": "出版方提交的 Crossref 元数据将 published／纸质出版日期记为 2024-12-02，另有一项出版方发表历史声明记为 2024-12-09。本条目采用 published／纸质出版日期；10 月 14–18 日的 CCS 会议日期及 9 月的 arXiv 提交日期另行区分。", "date_precision": "day", "description_en": "Infers protocol-message field boundaries and semantics from instrumented server binaries and input messages. BinPRE groups bytes by the instruction operators that process them, applies detectors for field types and functions, then refines results across similar messages. On eight protocols with 50 messages each, the authors report average field perfection of 0.73 and type/function F1 scores of 0.74/0.81.", "description_zh": "根据受插桩监测的服务端二进制及输入报文，推断协议报文的字段边界与语义。BinPRE 按处理字节的指令操作符进行分组，使用检测器识别字段类型和功能，再借助相似报文细化结果。作者在八种协议、每种 50 条报文上报告平均字段完美分割率为 0.73，类型／功能推断的 F1 分数为 0.74／0.81。", "doi": "10.1145/3658644.3690299", "entry_url": "https://awesomerea.org/papers/paper-binpre/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-binpre/", "evidence_urls": [ "https://dl.acm.org/doi/10.1145/3658644.3690299", "https://api.crossref.org/works/10.1145/3658644.3690299", "https://tingsu.github.io/files/ccs24-BinPRE.pdf", "https://tingsu.github.io/files/publication.html", "https://arxiv.org/abs/2409.01994", "https://arxiv.org/pdf/2409.01994v1", "https://github.com/ecnusse/BinPRE/blob/9a32bd22b6158d285a237dec10d11403eda8ac4c/README.md", "https://github.com/ecnusse/BinPRE/blob/9a32bd22b6158d285a237dec10d11403eda8ac4c/requirements.txt", "https://github.com/ecnusse/BinPRE/blob/9a32bd22b6158d285a237dec10d11403eda8ac4c/Dockerfile", "https://github.com/ecnusse/BinPRE/blob/9a32bd22b6158d285a237dec10d11403eda8ac4c/install_pin.sh", "https://github.com/ecnusse/BinPRE/blob/9a32bd22b6158d285a237dec10d11403eda8ac4c/Artifact_Evaluation/BinPRE_scripts/run_modbus_client.sh", "https://github.com/ecnusse/BinPRE/blob/9a32bd22b6158d285a237dec10d11403eda8ac4c/Artifact_Evaluation/BinPRE_scripts/run_modbus_server.sh", "https://github.com/ecnusse/BinPRE/blob/9a32bd22b6158d285a237dec10d11403eda8ac4c/Analyzer/config.py", "https://github.com/ecnusse/BinPRE/blob/9a32bd22b6158d285a237dec10d11403eda8ac4c/Analyzer/AAA_Evaluation/Syntax_Evaluator.py" ], "first_arxiv_date": "2024-09-03", "id": "paper-binpre", "kind": "research", "metadata_notes": "The author’s publication page links the CCS-formatted paper, the 17-page arXiv v1 and the artifact. Six-author order, DOI and proceedings pages match Crossref. The reviewed artifact snapshot is dated 2024-10-25 and declares no project-level license. Its README specifies Ubuntu 20.04, Python 3.8 and Intel Pin 3.28; the workflow runs a server and client and requires protocol/thread selection. The reviewed tree supplies a Modbus example, not a complete eight-protocol benchmark package; additional servers, captures and evaluation ground truth need separate setup. The README’s Docker example uses a privileged container, and the Dockerfile fetches a named branch rather than the reviewed commit. Public availability does not grant rights to bundled binaries or dependencies. No binaries, captures, containers or installers were downloaded, and no upstream code or experiments were executed.", "metadata_notes_zh": "作者发表列表链接了 CCS 排版论文、17 页的 arXiv v1 及产物。六位作者顺序、DOI 和论文集页码与 Crossref 一致。所审阅产物快照日期为 2024-10-25，未声明项目级许可证。README 指定 Ubuntu 20.04、Python 3.8 与 Intel Pin 3.28；流程运行服务端和客户端，并需选择协议与线程。所审阅源码树提供 Modbus 示例，并非完整的八协议评测包；其他服务端、捕获数据及评估用真实标签需要另行配置。README 的 Docker 示例使用特权容器，Dockerfile 获取具名分支，而非所审阅的固定提交。公开可见不授予捆绑二进制或依赖的使用权。本次未下载二进制、捕获数据、容器或安装程序，也未执行上游代码或实验。", "pdf_url": "https://tingsu.github.io/files/ccs24-BinPRE.pdf", "project_url": null, "publication_date": "2024-12-02", "publication_status": "conference-paper", "runtime_tested": false, "scope_limitations_en": "This is field inference, not recovery of a protocol state machine or complete endpoint behavior. It requires an accessible, instrumentable implementation and runtime message processing; passive captures alone are insufficient. Perfection counts exactly segmented fields against all true fields, not fully recovered protocols. The detector library covers five semantic types and six functions. Byte-level taint cannot accurately resolve bit flags, and unexercised behavior is not established. Ground truth uses Wireshark dissectors and specifications; three binary-analysis baselines were author reimplementations. Reported fuzzing improvements are a downstream evaluation, not proof of implementation equivalence.", "scope_limitations_zh": "研究对象是字段推断，不是恢复协议状态机或端点的完整行为。方法需要能够访问并插桩的实现及运行时的报文处理；仅有被动捕获数据并不足够。完美分割率统计被精确分割的字段占全部真实字段的比例，而非完整恢复的协议比例。检测器库覆盖五种语义类型与六种功能。字节级污点分析无法准确解析位标志，也不确立未执行行为。真实标签依据 Wireshark 解析器与协议规范构建；三种二进制分析基线由作者重新实现。报告的模糊测试改进属于下游评估，不是实现等价性的证明。", "targets": [ "protocol" ], "title": "BinPRE: Enhancing Field Inference in Binary Analysis Based Protocol Reverse Engineering", "title_zh": "BinPRE：增强基于二进制分析的协议逆向工程中的字段推断", "url": "https://dl.acm.org/doi/10.1145/3658644.3690299", "venue": "ACM CCS 2024", "verification": "source-reviewed", "verified_at": "2026-10-17", "why_fits_en": "Adds recent executable-assisted protocol field and semantic inference, complementing the collection’s traffic-based syntax inference and protocol-state learning research.", "why_fits_zh": "补充近期借助可执行程序进行协议字段与语义推断的研究，与合集已有的流量语法推断和协议状态学习形成互补。", "year": 2024 }, { "arxiv_id": null, "arxiv_version_reviewed": null, "authors": [ "Anil Altinay", "Joseph Nash", "Taddeus Kroes", "Prabhu Rajasekaran", "Dixin Zhou", "Adrian Dabrowski", "David Gens", "Yeoul Na", "Stijn Volckaert", "Cristiano Giuffrida", "Herbert Bos", "Michael Franz" ], "code_url": "https://github.com/trailofbits/binrec-tob", "date_basis": "ACM-deposited Crossref print-publication date; the online-publication date is recorded separately in metadata notes. The April 27–30 conference dates are not used.", "date_basis_zh": "采用 ACM 在 Crossref 登记的印刷出版日期；在线出版日期在元数据说明中单独记录。本条目不采用 4 月 27—30 日的会议日期。", "date_precision": "day", "description_en": "BinRec lifts an executable to LLVM IR from dynamic traces instead of static disassembly, then lowers the IR back to a recovered binary, so compiler passes can optimize, harden or otherwise transform it. Tracing runs the binary under S²E, which translates the executed code through QEMU into LLVM IR; BinRec removes the emulation instrumentation, merges traces from several inputs into one program, and adds optimizations such as register de-aliasing and promotion of emulated state to locals. When the recovered binary reaches a path that was not traced, a configurable handler stops it, falls back to the original code, or lifts the new path incrementally. The authors report recovering all SPEC CINT2006 benchmarks, including C++ programs, and apply it to reoptimization, control-flow integrity, AddressSanitizer and SafeStack hardening, and partial deobfuscation of virtualization-obfuscated code.", "description_zh": "BinRec 依据动态执行轨迹而非静态反汇编，将可执行文件提升为 LLVM 中间表示，再将其降级为恢复出的二进制，从而可用编译器优化遍对其进行优化、加固或其他变换。追踪阶段在 S²E 中运行二进制，由 S²E 经 QEMU 将执行到的代码翻译为 LLVM 中间表示；BinRec 去除仿真插桩，将多个输入的轨迹合并为一个程序，并加入寄存器去别名、将仿真状态提升为局部变量等优化。恢复出的二进制若进入未被追踪的路径，可配置的处理程序会停止执行、回退到原始代码，或增量提升新路径。作者报告恢复了全部 SPEC CINT2006 基准程序（包括 C++ 程序），并将其用于重新优化、控制流完整性、AddressSanitizer 与 SafeStack 加固，以及对虚拟化混淆代码的部分去混淆。", "doi": "10.1145/3342195.3387550", "entry_url": "https://awesomerea.org/papers/paper-binrec/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-binrec/", "evidence_urls": [ "https://dl.acm.org/doi/10.1145/3342195.3387550", "https://api.crossref.org/works/10.1145/3342195.3387550", "https://download.vusec.net/papers/binrec_eurosys20.pdf", "https://github.com/securesystemslab/BinRec/blob/96b9315c60f3ea0ddf0021cbed9ffab3e5607629/README.md", "https://github.com/trailofbits/binrec-tob/blob/e1ceeaaf4094609eb7a8e8bdf71417a5b8d7f155/README.md", "https://github.com/trailofbits/binrec-tob/blob/e1ceeaaf4094609eb7a8e8bdf71417a5b8d7f155/LICENSE" ], "first_arxiv_date": null, "id": "paper-binrec", "kind": "research", "metadata_notes": "ACM metadata records print publication on 2020-04-15 and online publication on 2020-04-17, pages 1–16; Crossref lists the title as “BinRec” with the subtitle “dynamic binary lifting and recompilation”, and the twelve-author order shown here, the first three marked as equal-contribution joint first authors. The VUSec-hosted PDF is the 16-page ACM-formatted version created on 2020-03-30. The paper gives github.com/securesystemslab/BinRec, whose README (2022-11-29) now says the source is available at trailofbits/binrec-tob. The reviewed Trail of Bits commit (2022-11-22; the repository was last pushed 2023-09-18) carries an MIT license with an ONR DFARS acknowledgment and documents Ubuntu 20.04.03 or Debian 11.3, LLVM 14, Python 3.9 and s2e-env at 4bd6a45, with x86 Linux as the only supported environment. This later release is not shown to reproduce the paper’s SPEC results. Nothing was built or run.", "metadata_notes_zh": "ACM 元数据记载印刷出版于 2020-04-15，在线出版于 2020-04-17，页码为 1–16；Crossref 将标题记为“BinRec”，副标题为“dynamic binary lifting and recompilation”，十二位作者顺序如本条目所列，前三位被标注为同等贡献的共同第一作者。VUSec 托管的 PDF 是 2020-03-30 生成的 16 页 ACM 排版版本。论文给出的地址是 github.com/securesystemslab/BinRec，其 README（2022-11-29）现说明源码发布于 trailofbits/binrec-tob。所审阅的 Trail of Bits 提交（2022-11-22；仓库最后推送于 2023-09-18）采用 MIT 许可，并附 ONR DFARS 资助声明；文档列出 Ubuntu 20.04.03 或 Debian 11.3、LLVM 14、Python 3.9 及 4bd6a45 版本的 s2e-env，且 x86 Linux 是唯一受支持的环境。没有证据表明这一较晚的发布能复现论文中的 SPEC 结果。本次未构建或运行任何内容。", "pdf_url": "https://download.vusec.net/papers/binrec_eurosys20.pdf", "project_url": null, "publication_date": "2020-04-15", "publication_status": "conference-paper", "runtime_tested": false, "scope_limitations_en": "The prototype handles only single-threaded 32-bit x86 Linux ELF binaries and does not support self-modifying code. A recovered binary supports only control-flow paths observed during lifting, so behavior on untraced inputs depends on the chosen miss handler and on input coverage. Lifting through S²E is slow, and floating-point instructions are emulated in lifted code; across the SPEC benchmarks, recovered binaries ran at a geometric-mean 0.98x the time of unoptimized inputs and 1.29x that of optimized inputs. BinRec does not map stack slots to variables. The deobfuscation case uses two small programs obfuscated with the authors' own virtualizer, not commercial obfuscators. The McSema and rev.ng comparisons reflect 2020 versions.", "scope_limitations_zh": "原型只支持单线程的 32 位 x86 Linux ELF 二进制，也不支持自修改代码。恢复出的二进制只支持提升时观察到的控制流路径，因此在未被追踪的输入上的行为取决于所选的缺失处理程序及输入覆盖率。经由 S²E 的提升速度较慢，浮点指令在提升后的代码中以仿真方式执行；在 SPEC 基准上，恢复出的二进制运行时间的几何平均值为未优化输入的 0.98 倍、已优化输入的 1.29 倍。BinRec 不建立栈槽与变量之间的映射。去混淆案例使用的是由作者自己的虚拟化器混淆的两个小程序，而非商业混淆器。与 McSema 和 rev.ng 的比较反映的是 2020 年的版本。", "targets": [ "binary" ], "title": "BinRec: Dynamic Binary Lifting and Recompilation", "title_zh": "BinRec：动态二进制提升与重编译", "url": "https://dl.acm.org/doi/10.1145/3342195.3387550", "venue": "EuroSys 2020", "verification": "source-reviewed", "verified_at": "2026-10-19", "why_fits_en": "Adds dynamic lifting of executables to compiler IR and recompilation back to working binaries, complementing the collection's decompilation research, which recovers source-level code rather than a rebuildable IR.", "why_fits_zh": "补充将可执行文件动态提升为编译器中间表示、再重编译为可运行二进制的研究，与合集中恢复源码级代码而非可重建中间表示的反编译研究互补。", "year": 2020 }, { "arxiv_id": "2211.16074", "arxiv_version_reviewed": "v2", "authors": [ "Andrea Pferscher", "Bernhard K. Aichernig" ], "code_url": "https://github.com/apferscher/ble-learning", "date_basis": "Springer-deposited Crossref metadata and the article page give the August 2022 issue date of volume 61, issue 1, represented at month precision; the 22 May 2023 online publication is recorded in metadata notes.", "date_basis_zh": "Springer 向 Crossref 提交的元数据及文章页面将第 61 卷第 1 期的刊期标为 2022 年 8 月，本目录采用月份精度；2023 年 5 月 22 日的在线出版日期另在元数据说明中记录。", "date_precision": "month", "description_en": "Learns Mealy-machine models of Bluetooth Low Energy implementations on physical peripherals by active automata learning. An nRF52840 central running SweynTooth-derived firmware sends abstract BLE inputs, with error handling, repeated queries and caching for lost packets and non-deterministic replies. The authors learn connection-procedure models of six devices and legacy-pairing models of three, and use model differences to fingerprint their SoCs.", "description_zh": "通过主动自动机学习，为实体外设上的低功耗蓝牙（BLE）协议实现推断 Mealy 状态机模型。运行 SweynTooth 衍生固件的 nRF52840 中心设备发送抽象 BLE 输入，并以错误处理、重复查询和缓存应对丢包与不确定的响应。作者学习了六款设备的连接过程模型和其中三款的传统配对（legacy pairing）模型，并利用模型差异识别各设备的 SoC。", "doi": "10.1007/s10703-023-00425-y", "entry_url": "https://awesomerea.org/papers/paper-ble-automata-learning/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-ble-automata-learning/", "evidence_urls": [ "https://doi.org/10.1007/s10703-023-00425-y", "https://api.crossref.org/works/10.1007/s10703-023-00425-y", "https://link.springer.com/article/10.1007/s10703-023-00425-y", "https://arxiv.org/abs/2211.16074", "https://arxiv.org/pdf/2211.16074v2", "https://api.crossref.org/works/10.1007/978-3-030-90870-6_28", "https://github.com/apferscher/ble-learning/blob/febd774109c41a6635659b8847cc766e667841dd/README.md", "https://github.com/apferscher/ble-learning/blob/febd774109c41a6635659b8847cc766e667841dd/requirements.txt", "https://github.com/DES-Lab/AALpy/blob/335c50a1b4b5a830d788f86b7c30a8cb6c73ecc0/README.md" ], "first_arxiv_date": "2022-11-29", "id": "paper-ble-automata-learning", "kind": "research", "metadata_notes": "Formal Methods in System Design 61(1), pages 35–62, published online on 22 May 2023 as an open-access CC BY 4.0 article. It extends the authors’ FM 2021 paper ‘Fingerprinting Bluetooth Low Energy Devices via Active Automata Learning’ (LNCS 13047, pages 524–542, DOI 10.1007/978-3-030-90870-6_28), which is not listed separately because no open copy was verified. The ble-learning README, linked from AALpy’s applications list, names this article ‘Identification and Analysis of Bluetooth Devices via Automata Learning’, unlike the published title. Springer’s PDF could not be fetched automatically, so its full-text page and arXiv v2, the accepted manuscript, were reviewed. The study used Python 3.9.0, AALpy 1.0.1 and a modified Scapy 2.4.4; the repository, pinned at a 2025 commit, now requires aalpy>=1.1.7 and scapy>=2.4.5. It needs an nRF52840 dongle or development kit flashed with the supplied SweynTooth-derived firmware, and pairing also needs Linux with SweynTooth’s BlueZ-based Security Manager module. The repository has no license file, so no reuse license is implied. No learning experiments were run.", "metadata_notes_zh": "发表于 Formal Methods in System Design 第 61 卷第 1 期，35–62 页，于 2023 年 5 月 22 日在线出版，为 CC BY 4.0 开放获取论文。本文是作者 FM 2021 论文“Fingerprinting Bluetooth Low Energy Devices via Active Automata Learning”（LNCS 13047，524–542 页，DOI 10.1007/978-3-030-90870-6_28）的扩展版；因未核实该会议论文的公开全文，未单独收录。AALpy 应用列表链接的 ble-learning README 将本文称为“Identification and Analysis of Bluetooth Devices via Automata Learning”，与正式标题不同。Springer 的 PDF 无法自动获取，因此核查的是出版方全文页面和 arXiv v2（作者接收稿）。研究使用 Python 3.9.0、AALpy 1.0.1 和修改版 Scapy 2.4.4；固定在 2025 年提交的仓库目前要求 aalpy>=1.1.7 和 scapy>=2.4.5。运行需要一块刷入仓库所附 SweynTooth 衍生固件的 nRF52840 Dongle 或开发板，配对实验另需 Linux 及 SweynTooth 基于 BlueZ 的安全管理器（Security Manager）模块。仓库没有许可证文件，因此不意味着授予任何复用许可。本次未运行学习实验。", "pdf_url": "https://arxiv.org/pdf/2211.16074v2", "project_url": null, "publication_date": "2022-08", "publication_status": "journal-article", "runtime_tested": false, "scope_limitations_en": "Models are bounded by the chosen abstract alphabet and cover only connection and legacy pairing; message formats are not inferred, and secure pairing is left to future work. Equivalence was approximated with a small number of conformance tests per state, so models are hypotheses, not proofs. One SoC was learnable only with reduced alphabets, two were learned from an already-connected state, and some pairing runs needed manual hard resets. The fingerprinting sequence holds only for the tested SoCs. Apart from one crashing input sequence, the authors report no security vulnerabilities in the learned models.", "scope_limitations_zh": "模型受所选抽象输入字母表限制，仅覆盖连接过程和传统配对；不推断报文格式，安全配对留待后续研究。等价性仅以每个状态少量的一致性测试近似检验，因此模型只是假设而非证明。其中一款 SoC 只能缩减输入字母表后学习，两款设备从已建立连接的状态开始学习，部分配对实验还需人工硬重置设备。所得指纹识别序列仅适用于受测 SoC。除一条会导致设备崩溃的输入序列外，作者未在学习所得模型中发现安全漏洞。", "targets": [ "protocol" ], "title": "Fingerprinting and analysis of Bluetooth devices with automata learning", "title_zh": "基于自动机学习的蓝牙设备指纹识别与分析", "url": "https://doi.org/10.1007/s10703-023-00425-y", "venue": "Formal Methods in System Design", "verification": "source-reviewed", "verified_at": "2026-10-17", "why_fits_en": "Reconstructs the protocol-state behavior of closed BLE implementations through black-box interaction with real devices, showing how learned state machines expose implementation differences and deviations from the specification.", "why_fits_zh": "通过与真实设备的黑盒交互重建封闭 BLE 实现的协议状态行为，展示学习所得的状态机如何揭示不同实现之间的差异及其与规范的偏离。", "year": 2022 }, { "arxiv_id": "2608.29737", "arxiv_version_reviewed": "v1", "authors": [ "Qinying Wang", "Florian Hofhammer", "Eduard Vlad", "Jianqiang Wang", "Marcel Busch", "Shouling Ji", "Mathias Payer" ], "code_url": null, "date_basis": "arXiv first submission date; no separate publication was verified.", "date_basis_zh": "采用 arXiv 首次提交日期，未核实另行出版的版本。", "date_precision": "day", "description_en": "Bluezz models peripherals as stateful event-condition-action systems, coordinating interrupts, MMIO and DMA rather than treating accesses independently. It uses these models to rehost BLE firmware and reach connected protocol states for analysis and fuzzing.", "description_zh": "Bluezz 将外设建模为具有状态的事件—条件—动作系统，协调中断、MMIO 与 DMA，而非孤立处理各次访问；据此迁移 BLE 固件，进入已连接协议状态进行分析与模糊测试。", "doi": null, "entry_url": "https://awesomerea.org/papers/paper-bluezz-rpm/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-bluezz-rpm/", "evidence_urls": [ "https://arxiv.org/abs/2608.29737v1", "https://arxiv.org/html/2608.29737v1" ], "first_arxiv_date": "2026-08-30", "id": "paper-bluezz-rpm", "kind": "research", "metadata_notes": "Reviewed arXiv v1 as a preprint: earlier conference submissions are not acceptance. The paper links an anonymous review artifact and describes release upon acceptance; its landing page was reachable, but implementation availability and licensing were not verified.", "metadata_notes_zh": "按预印本审阅 arXiv v1：此前向会议投稿不等于录用。论文给出匿名评审产物链接，并说明录用后发布；入口页可访问，但未核实实现的可获取性及许可。", "pdf_url": "https://arxiv.org/pdf/2608.29737v1", "project_url": null, "publication_date": "2026-08-30", "publication_status": "preprint", "runtime_tested": false, "scope_limitations_en": "The BLE evaluation covers 18 targets, with additional limited MCU examples. Hardware specifications, behavioral rules and use-case drivers require preparation and human validation; agent-generated rules do not remove that work. Coverage and reported crashes do not establish hardware equivalence or exhaustive protocol support. Nothing was executed for this review.", "scope_limitations_zh": "BLE 评测覆盖 18 个目标，并补充了有限的其他 MCU 案例。硬件规格、行为规则与用例驱动仍需准备和人工验证，智能体生成规则不消除这些工作。覆盖率与已报告崩溃不证明硬件等价或协议支持穷尽，本次未执行产物。", "targets": [ "firmware", "protocol" ], "title": "Reactive Peripheral Modeling for Faithful Firmware Rehosting", "title_zh": "面向忠实固件运行迁移的响应式外设建模", "url": "https://arxiv.org/abs/2608.29737", "venue": "arXiv", "verification": "source-reviewed", "verified_at": "2026-10-20", "why_fits_en": "Reconstructs missing peripheral semantics so firmware and protocol behavior can be inspected in emulation.", "why_fits_zh": "重建缺失的外设语义，使固件及协议行为可以在仿真中被观察。", "year": 2026 }, { "arxiv_id": null, "arxiv_version_reviewed": null, "authors": [ "Xiaoao Zhu", "Jie Ren", "Zhiqiang Li", "Jie Zheng", "Zhanyong Tang", "Zheng Wang" ], "code_url": "https://github.com/Azhu-c/BRIDGE-rag", "date_basis": "The official ACL Anthology citation and BibTeX give July 2026. Crossref records only the year; the July 2–7 conference dates printed in the PDF are not treated as a publication day.", "date_basis_zh": "ACL Anthology 官方引文与 BibTeX 给出 2026 年 7 月。Crossref 仅记录年份；PDF 中印有的 7 月 2–7 日会议日期不作为具体出版日。", "date_precision": "month", "description_en": "BRIDGE lifts stripped, optimized x86-64 and ARM64 functions, given as llvm-objdump disassembly, to LLVM IR. Its target is the unoptimized IR that a fixed clang -O0 configuration emits for the original source. Offline, it builds a retrieval database from 69,253 ExeBench functions compiled at -O0 to -O3, using LLVM pseudo-probe instrumentation to align assembly fragments with the matching -O0 IR regions. At inference it splits each function's angr-recovered control-flow graph into control-flow segments such as loops and if–else regions, retrieves the three nearest aligned assembly–IR pairs per segment from a FAISS index of Nova-1.3B embeddings, and prompts a hosted general-purpose LLM (DeepSeek-chat) to write the IR. Up to five refinement rounds then feed LLVM verifier and compiler diagnostics and unit-test failures back to the model. On HumanEval-Decompile and MBPP compiled with Clang 19 at -O0 to -O3, average re-executability is 65.2% and 65.4% on x86-64 and 45.6% and 42.1% on ARM64. The rule-based MCTOLL reaches 62.1% and 64.9% on x86-64, and the five directly prompted API LLMs reach at most 21.5%.", "description_zh": "BRIDGE 将以 llvm-objdump 反汇编形式给出的、已剥离符号并经过优化的 x86-64 与 ARM64 函数提升为 LLVM IR，目标是固定 clang -O0 配置为原始源码生成的未优化 IR。离线阶段，它将 69,253 个 ExeBench 函数分别以 -O0 至 -O3 编译并构建检索数据库，借助 LLVM 伪探针插桩将汇编片段与对应的 -O0 IR 区域对齐。推理时，它把 angr 恢复的函数控制流图划分为循环、if–else 等控制流片段，从基于 Nova-1.3B 嵌入的 FAISS 索引中为每个片段检索三个最相近的已对齐汇编—IR 对，再提示托管的通用大语言模型（DeepSeek-chat）生成 IR。随后最多进行五轮修正，把 LLVM 校验器与编译器诊断信息以及单元测试失败结果反馈给模型。在以 Clang 19 按 -O0 至 -O3 编译的 HumanEval-Decompile 与 MBPP 上，其平均可重新执行率在 x86-64 上为 65.2% 和 65.4%，在 ARM64 上为 45.6% 和 42.1%。基于规则的 MCTOLL 在 x86-64 上为 62.1% 和 64.9%，五个直接提示的 API 大语言模型最高为 21.5%。", "doi": "10.18653/v1/2026.acl-long.527", "entry_url": "https://awesomerea.org/papers/paper-bridge-lifting/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-bridge-lifting/", "evidence_urls": [ "https://aclanthology.org/2026.acl-long.527/", "https://aclanthology.org/2026.acl-long.527.bib", "https://aclanthology.org/2026.acl-long.527.pdf", "https://api.crossref.org/works/10.18653/v1/2026.acl-long.527", "https://github.com/Azhu-c/BRIDGE-rag/tree/9add8abe0f15748cfae36395b07c6fc4e4ecc386", "https://github.com/Azhu-c/BRIDGE-rag/blob/9add8abe0f15748cfae36395b07c6fc4e4ecc386/README.md", "https://github.com/Azhu-c/BRIDGE-rag/blob/9add8abe0f15748cfae36395b07c6fc4e4ecc386/requirements.txt", "https://github.com/Azhu-c/BRIDGE-rag/blob/9add8abe0f15748cfae36395b07c6fc4e4ecc386/default.env.example", "https://github.com/Azhu-c/BRIDGE-rag/blob/9add8abe0f15748cfae36395b07c6fc4e4ecc386/configs/knowledge_base.yaml", "https://github.com/Azhu-c/BRIDGE-rag/blob/9add8abe0f15748cfae36395b07c6fc4e4ecc386/src/llm/llm_api.py", "https://github.com/Azhu-c/BRIDGE-rag/tree/9add8abe0f15748cfae36395b07c6fc4e4ecc386/Evaluation_datasets" ], "first_arxiv_date": null, "id": "paper-bridge-lifting", "kind": "research", "metadata_notes": "The ACL Anthology page and BibTeX give the Proceedings of the 64th Annual Meeting of the ACL (Volume 1: Long Papers), pages 11498–11516, San Diego, published by the ACL, and the same six authors in order; the Crossref DOI record matches the title, authors and pages and gives only the year. No arXiv version was found by arXiv title and keyword searches, so arxiv_id is null. In §6.1 the text gives 42.1% average re-executability for ARM64 HumanEval-Decompile, while Table 1 lists 45.6% for that benchmark and 42.1% for ARM64 MBPP; this record follows the table. The PDF's online-materials note links Azhu-c/BRIDGE-rag. At the reviewed 2026-07-06 commit the repository has no LICENSE file and GitHub reports no license. Its README recommends Python 3.10 and requires a DeepSeek API key, and the LLM wrapper defaults to the deepseek-chat model through an OpenAI-compatible client. requirements.txt pins openai 1.57.0, angr 9.2.162, torch 2.5.1 and faiss-gpu 1.7.2. The knowledge-base configuration expects ExeBench samples under ./data/exebench_samples and a local Nova-1.3b model path; neither is in the repository. Evaluation_datasets holds HumanEval-Decompile and MBPP-subset inputs for both instruction sets with BRIDGE and baseline outputs, and docs/ holds a copy of the paper. Nothing was downloaded beyond the paper, and no code or experiments were run.", "metadata_notes_zh": "ACL Anthology 页面与 BibTeX 列出第 64 届 ACL 年会论文集（第 1 卷：长文）、第 11498–11516 页、圣迭戈、由 ACL 出版，作者为顺序相同的六人；Crossref DOI 记录的标题、作者与页码一致，但只给出年份。arXiv 标题与关键词检索均未找到该论文，因此 arxiv_id 为 null。§6.1 正文称 ARM64 HumanEval-Decompile 的平均可重新执行率为 42.1%，而表 1 列出该基准为 45.6%、ARM64 MBPP 为 42.1%；本条目以表格为准。PDF 的在线材料说明链接 Azhu-c/BRIDGE-rag。在所审阅的 2026-07-06 提交中，仓库没有 LICENSE 文件，GitHub 也未识别出许可证。README 推荐 Python 3.10 并要求 DeepSeek API 密钥，大语言模型封装代码默认通过 OpenAI 兼容客户端调用 deepseek-chat 模型。requirements.txt 固定 openai 1.57.0、angr 9.2.162、torch 2.5.1 与 faiss-gpu 1.7.2。知识库配置要求在 ./data/exebench_samples 下提供 ExeBench 样本，并指定本地 Nova-1.3b 模型路径；二者都不在仓库中。Evaluation_datasets 包含两种指令集的 HumanEval-Decompile 与 MBPP 子集输入，以及 BRIDGE 和基线的输出；docs/ 中存有论文副本。除论文外未下载任何内容，也未运行代码或实验。", "pdf_url": "https://aclanthology.org/2026.acl-long.527.pdf", "project_url": null, "publication_date": "2026-07", "publication_status": "conference-paper", "runtime_tested": false, "scope_limitations_en": "Evaluation is function-level on short benchmark programs: HumanEval-Decompile and an MBPP subset, with inputs of 2 to 628 assembly instructions, built by the authors with one LLVM/Clang 19 toolchain on Linux. Canonical means matching one fixed clang -O0 configuration, not recovering the original source. Refinement and the re-executability metric both use the unit tests these benchmarks supply; the authors note that such test oracles are rarely available in practical reverse engineering. On x86-64 HumanEval-Decompile, re-executability falls from 65.2% to 60.8% with LLM-generated tests and to 53.5% with no tests. Output still diverges structurally from the reference: average edit similarity stays below 50%, and exact control-flow-graph matches reach 25.9% on that benchmark. The pipeline calls a hosted LLM API, as do the LLM baselines; results are geometric means of five runs and can shift as hosted models change. Forklift and LLM Compiler FTD are excluded from the baselines because the authors treat them as lifting compiler-emitted assembly text, and MCTOLL is compared only on x86-64. Other instruction sets need a rebuilt retrieval database. BRIDGE produces LLVM IR, not C source, so it is not a decompiler to C. The code repository has no license.", "scope_limitations_zh": "评测在函数级别、针对短小的基准程序进行：HumanEval-Decompile 与 MBPP 子集，输入为 2 至 628 条汇编指令，由作者在 Linux 上使用单一 LLVM/Clang 19 工具链构建。“规范”指与一个固定的 clang -O0 配置输出一致，而非恢复原始源码。修正过程与可重新执行率指标都使用这些基准自带的单元测试；作者指出，实际逆向工程中很少有这类测试预言。在 x86-64 HumanEval-Decompile 上，改用大语言模型生成的测试时可重新执行率从 65.2% 降至 60.8%，不使用测试时降至 53.5%。输出在结构上仍与参考结果存在差异：平均编辑相似度低于 50%，该基准上控制流图完全匹配率为 25.9%。流水线调用托管的大语言模型 API，大语言模型基线同样如此；结果为五次运行的几何平均值，可能随托管模型变化而改变。作者认为 Forklift 与 LLM Compiler FTD 处理的是编译器生成的汇编文本，因此未将其列为基线；MCTOLL 仅在 x86-64 上参与比较。支持其他指令集需要重建检索数据库。BRIDGE 输出的是 LLVM IR 而非 C 源码，因此不是面向 C 的反编译器。代码仓库没有许可证。", "targets": [ "binary" ], "title": "Lifting Optimized Binaries to Canonical Compiler IR via Structure-Aware Retrieval and Iterative Verification", "title_zh": "基于结构感知检索与迭代验证将优化二进制提升为规范编译器 IR", "url": "https://aclanthology.org/2026.acl-long.527/", "venue": "ACL 2026", "verification": "source-reviewed", "verified_at": "2026-10-19", "why_fits_en": "Adds retrieval-guided LLM lifting of optimized machine code to compiler IR with verifier and test feedback, complementing rule-based lifters such as rev.ng and the assembly-to-C neural decompilation papers in this section.", "why_fits_zh": "补充借助检索引导、并以校验器与测试反馈修正的大语言模型方法，将优化后的机器码提升为编译器 IR，与 rev.ng 等基于规则的提升工具及本节中从汇编生成 C 的神经反编译论文互补。", "year": 2026 }, { "arxiv_id": "2610.23546", "arxiv_version_reviewed": "v1", "authors": [ "Junlin Li", "Jianjun Huang", "Wei You", "Bin Liang" ], "code_url": null, "date_basis": "First arXiv submission; the reviewed version is v1, not a verified proceedings publication.", "date_basis_zh": "采用 arXiv 首次提交日期；审阅版本为 v1，并非已经核实的会议录出版。", "date_precision": "day", "description_en": "BScout matches decompiled functions to a source corpus using chunked embeddings and inlining-aware training. Existing matches provide positional clues to expand candidates; LLM selection and structural filters refine the resulting correspondences.", "description_zh": "BScout 通过分块嵌入及考虑内联的训练，将反编译函数匹配到源码语料；已有匹配提供位置线索以扩充候选，再由大语言模型选择及结构过滤改进对应关系。", "doi": null, "entry_url": "https://awesomerea.org/papers/paper-bscout/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-bscout/", "evidence_urls": [ "https://arxiv.org/abs/2610.23546", "https://arxiv.org/html/2610.23546v1" ], "first_arxiv_date": "2026-10-16", "id": "paper-bscout", "kind": "research", "metadata_notes": "Reviewed arXiv v1 and its four-author order. The paper promises a replication package upon formal peer-reviewed publication; no dedicated public implementation or license was verified. No models, binaries or experiments were run.", "metadata_notes_zh": "审阅 arXiv v1 并采用其四位作者顺序。论文承诺在同行评审版本正式出版后发布复现包，本次未核实专用公开实现或许可；未运行模型、二进制或实验。", "pdf_url": "https://arxiv.org/pdf/2610.23546v1", "project_url": null, "publication_date": "2026-10-16", "publication_status": "preprint", "runtime_tested": false, "scope_limitations_en": "BinKit-BCSA covers 3,904 small-utility binaries; Large-10 covers larger projects only at x86-64/O2. Some anomaly thresholds come from FreeCAD in Large-10. Incomplete ground truth, sparse anchors and source-corpus coverage limit conclusions. Function chunks are encoded independently, and extra refinement trades precision and cost against recall. This is correspondence retrieval, not proof of source recovery or semantic equivalence.", "scope_limitations_zh": "BinKit-BCSA 包含 3,904 个小型工具二进制，Large-10 的较大项目仅采用 x86-64/O2 构建；部分异常阈值来自 Large-10 中的 FreeCAD。不完整真值、稀疏锚点及源码语料覆盖限制结论。函数分块独立编码，增加改进轮次会在召回、精度和成本之间权衡。这是对应关系检索，不是源码恢复或语义等价证明。", "targets": [ "binary" ], "title": "Recall-Oriented Precise Binary-to-Source Function Matching", "title_zh": "面向召回率的精确二进制到源码函数匹配", "url": "https://arxiv.org/abs/2610.23546", "venue": "arXiv", "verification": "source-reviewed", "verified_at": "2026-10-20", "why_fits_en": "Helps identify source origins and reused components in stripped binaries, including inlined functions.", "why_fits_zh": "帮助识别去符号二进制中的源码来源及复用组件，并考虑内联函数。", "year": 2026 }, { "arxiv_id": "2504.00694", "arxiv_version_reviewed": "v2", "authors": [ "Yiling He", "Hongyu She", "Xingzhi Qian", "Xinran Zheng", "Zhuo Chen", "Zhan Qin", "Lorenzo Cavallaro" ], "code_url": null, "date_basis": "ACM's Crossref deposit gives online publication and the issued date as 2025-06-11, with a print date of 2025-06-25, the first day of the June 25–28 conference. This entry uses the publisher's online date; the arXiv dates are not substituted.", "date_basis_zh": "ACM 提交的 Crossref 元数据将在线出版日期及发布日期列为 2025-06-11，纸质出版日期为 2025-06-25，即 6 月 25–28 日会议的首日。本条目采用出版方的在线出版日期，不以 arXiv 日期替代。", "date_precision": "day", "description_en": "CAMA is a framework for benchmarking how code LLMs read decompiled Android malware. Androguard decompiles each APK into Java functions, and each model returns a structured output per function: a summary, a refined function name and a 0–10 maliciousness score. Two analysis tasks build on these outputs. Malicious-function identification is scored by consistency (whether scores and names stay stable when the model is re-prompted with its own summaries) and by fidelity (how much a LightGBM malware-category classifier loses confidence when the top-scored function descriptors are removed). Malware-purpose summarization is scored by semantic relevance (BLEU, METEOR and ROUGE-L against reference app descriptions). The benchmark holds 118 APKs from 6 categories and 13 families, with 7,542,799 decompiled functions. Of the four models evaluated, StarChat-Beta has the highest maliciousness consistency (0.813, against 0.381 for CodeLlama) and narrowly the highest semantic-relevance scores, while fidelity varies widely across models and removal sizes. Renaming functions with model-suggested names raises fidelity for CodeLlama and StarChat but lowers METEOR by about 10%.", "description_zh": "CAMA 是一个评测代码大语言模型理解反编译 Android 恶意软件能力的基准框架。它使用 Androguard 将每个 APK 反编译为 Java 函数，并要求模型为每个函数输出结构化结果：功能摘要、改进后的函数名以及 0–10 分的恶意程度评分。两项分析任务以这些输出为基础。恶意函数识别以一致性（模型依据自身摘要再次作答时评分与命名是否稳定）和保真度（移除评分最高的函数描述后，LightGBM 恶意软件类别分类器的置信度下降多少）衡量；恶意软件用途摘要则以语义相关性（与参考应用描述之间的 BLEU、METEOR 和 ROUGE-L）衡量。基准包含来自 6 个类别、13 个家族的 118 个 APK，共 7,542,799 个反编译函数。在四个受测模型中，StarChat-Beta 的恶意程度一致性最高（0.813，CodeLlama 为 0.381），语义相关性得分也以微弱优势居首；保真度则随模型和移除数量大幅波动。用模型建议的名称重命名函数会提高 CodeLlama 和 StarChat 的保真度，但会使 METEOR 下降约 10%。", "doi": "10.1145/3713081.3731745", "entry_url": "https://awesomerea.org/papers/paper-cama/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-cama/", "evidence_urls": [ "https://dl.acm.org/doi/10.1145/3713081.3731745", "https://api.crossref.org/works/10.1145/3713081.3731745", "https://arxiv.org/abs/2504.00694", "https://arxiv.org/pdf/2504.00694v2", "https://zenodo.org/records/15155917", "https://zenodo.org/api/records/15155917", "https://zenodo.org/records/14884736" ], "first_arxiv_date": "2025-04-01", "id": "paper-cama", "kind": "research", "metadata_notes": "ACM's Crossref deposit gives the ISSTA Companion '25 proceedings, pages 153–160, a CC BY 4.0 license and the same seven authors in order; the arXiv v2 PDF prints the ACM reference and DOI. The workshop name rests on the arXiv comment and the Zenodo description, which both state acceptance to the LLMSC Workshop 2025 of the 34th ACM SIGSOFT ISSTA Companion; Crossref names only the companion proceedings. arXiv v1 is dated 2025-04-01 and v2 2025-04-23. The paper links no code repository, so code_url is null. Its outputs are the Zenodo dataset 10.5281/zenodo.15155917 (2025-04-05, CC BY 4.0, a 710 MB CAMA.zip that was not downloaded); that dataset DOI is not used as the paper identifier. The samples and reference descriptions come from the LAMD dataset 10.5281/zenodo.14884736, whose 2 MB archive is described as CSV sample information and logs. The ACM landing page refused automated requests, so the review relied on Crossref and the arXiv PDF. No code or experiments were run.", "metadata_notes_zh": "ACM 提交的 Crossref 元数据列出 ISSTA Companion '25 论文集、第 153–160 页、CC BY 4.0 许可，以及顺序相同的七位作者；arXiv v2 PDF 印有 ACM 引用格式与 DOI。研讨会名称依据 arXiv 注释与 Zenodo 说明，二者均称论文被第 34 届 ACM SIGSOFT ISSTA Companion 的 LLMSC Workshop 2025 接收；Crossref 只列出配套论文集名称。arXiv v1 发布于 2025-04-01，v2 为 2025-04-23。论文未链接代码仓库，因此 code_url 为 null。其输出发布为 Zenodo 数据集 10.5281/zenodo.15155917（2025-04-05，CC BY 4.0，710 MB 的 CAMA.zip，未下载）；该数据集 DOI 不用作论文标识符。样本与参考描述来自 LAMD 数据集 10.5281/zenodo.14884736，其 2 MB 压缩包被描述为 CSV 样本信息与日志。ACM 页面拒绝自动请求，因此本次审阅依据 Crossref 与 arXiv PDF。本次未运行代码或实验。", "pdf_url": "https://arxiv.org/pdf/2504.00694v2", "project_url": null, "publication_date": "2025-06-11", "publication_status": "conference-paper", "runtime_tested": false, "scope_limitations_en": "This is an eight-page workshop paper that evaluates four open-source code LLMs: CodeLlama-7b-Instruct, StarChat-Beta and the base-size CodeT5 and PLBART, not current frontier models. CodeT5 and PLBART were fine-tuned for three epochs to produce the output fields, and their maliciousness scores come from a separate DeepSeek-R1-Distill-Llama-70B model, so score-based results do not measure those two models alone; both are also excluded from the renaming study. No function-level ground truth exists: malicious-function identification is measured indirectly through classifier confidence, and the reference app descriptions are GPT-4-generated summaries from the earlier LAMD dataset; the authors note that these surrogates can add noise and bias. The 118 samples are de-duplicated LAMD malware decompiled only with Androguard, and obfuscation is not studied separately. Fidelity scores have standard deviations close to their means, for example 0.332 ± 0.30 for CodeT5 at k = 2. The Zenodo record holds the structured model outputs (function summaries, refined names and maliciousness scores); neither it nor the LAMD record states that it contains the APK samples. CAMA does not detect malware and is not a decompiler.", "scope_limitations_zh": "这是一篇 8 页的研讨会论文，评测四个开源代码大语言模型：CodeLlama-7b-Instruct、StarChat-Beta 以及基础规模的 CodeT5 和 PLBART，并非当前的前沿模型。CodeT5 与 PLBART 经过三轮微调后才能输出所需字段，其恶意程度评分由另一个 DeepSeek-R1-Distill-Llama-70B 模型给出，因此基于评分的结果并非单独衡量这两个模型；二者也未纳入重命名实验。研究缺少函数级真实标签：恶意函数识别通过分类器置信度间接衡量，参考应用描述则是此前 LAMD 数据集中由 GPT-4 生成的摘要；作者指出这些替代方法可能引入噪声与偏差。118 个样本是经过去重的 LAMD 恶意软件，仅使用 Androguard 反编译，也未单独研究混淆的影响。保真度得分的标准差与均值相近，例如 CodeT5 在 k = 2 时为 0.332 ± 0.30。Zenodo 记录保存的是结构化模型输出（函数摘要、改进名称与恶意程度评分）；该记录与 LAMD 记录均未说明包含 APK 样本。CAMA 不是恶意软件检测系统，也不是反编译器。", "targets": [ "app" ], "title": "On Benchmarking Code LLMs for Android Malware Analysis", "title_zh": "面向 Android 恶意软件分析的代码大语言模型基准评测", "url": "https://dl.acm.org/doi/10.1145/3713081.3731745", "venue": "ISSTA Companion 2025 (LLMSC Workshop)", "verification": "source-reviewed", "verified_at": "2026-10-19", "why_fits_en": "Adds a benchmark of code LLMs reading decompiled Android malware, complementing DeGuard's identifier recovery and the single Android case study in the USENIX Security 2024 code-analysis study elsewhere in the bibliography.", "why_fits_zh": "补充一个评测代码大语言模型阅读反编译 Android 恶意软件的基准，与书目中 DeGuard 的标识符恢复研究以及 USENIX Security 2024 代码分析研究中的单个 Android 案例互补。", "year": 2025 }, { "arxiv_id": "2507.17691", "arxiv_version_reviewed": "v2", "authors": [ "Shan Jiang", "Pranoy Kovuri", "David Tao", "Zhixun Tan" ], "citation": { "container_title": "Proceedings of the IEEE/ACM 48th International Conference on Software Engineering: Software Engineering in Practice", "pages": "292-302", "publisher": "ACM", "sources": [ "https://api.crossref.org/works/10.1145/3786583.3786873" ] }, "code_url": "https://github.com/google/jsir", "date_basis": "ACM-deposited Crossref print-publication date, which matches the ICSE 2026 start date; the online-publication date is recorded separately in metadata notes.", "date_basis_zh": "采用 ACM 在 Crossref 登记的印刷出版日期，与 ICSE 2026 开幕日期一致；在线出版日期在元数据说明中单独记录。", "date_precision": "day", "description_en": "Uses Gemini to locate the prelude functions that Obfuscator.IO inserts for string obfuscation, then applies constant-propagation and inlining passes in the JSIR compiler IR to restore string literals and API names deterministically.", "description_zh": "利用 Gemini 定位 Obfuscator.IO 为字符串混淆插入的前置（prelude）函数，再在 JSIR 编译器中间表示上执行常量传播与内联，以确定性方式还原字符串字面量和 API 名称。", "doi": "10.1145/3786583.3786873", "entry_url": "https://awesomerea.org/papers/paper-cascade/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-cascade/", "evidence_urls": [ "https://doi.org/10.1145/3786583.3786873", "https://api.crossref.org/works/10.1145/3786583.3786873", "https://arxiv.org/abs/2507.17691", "https://github.com/google/jsir/blob/3ef1529ee4ecaa97f2891125b8d01ba2d0a75c3e/README.md", "https://github.com/google/jsir/blob/3ef1529ee4ecaa97f2891125b8d01ba2d0a75c3e/LICENSE", "https://github.com/google/jsir/blob/3ef1529ee4ecaa97f2891125b8d01ba2d0a75c3e/maldoca/js/ast/transforms/extract_prelude/pass.h", "https://github.com/google/jsir/blob/3ef1529ee4ecaa97f2891125b8d01ba2d0a75c3e/maldoca/js/ir/analyses/dynamic_constant_propagation/dynamic_prelude.h" ], "first_arxiv_date": "2025-07-23", "id": "paper-cascade", "kind": "research", "metadata_notes": "ACM-deposited Crossref metadata records print publication on 2026-04-12 and online publication on 2026-07-11, pages 292–302. The publisher title writes 'LLM-powered'; the arXiv record capitalizes 'Powered'. The reviewed text is arXiv v2, which carries the ICSE-SEIP '26 header. The paper says its prompt templates and JSIR are open-sourced at google/jsir. At the pinned commit that Apache-2.0 repository contains JSIR with prelude-extraction and dynamic constant-propagation code, but no prompt-template, Gemini pipeline or evaluation-set files were found; the paper prints its prelude-detection prompt in Figure 5 and lists an open-source CASCADE release as future work.", "metadata_notes_zh": "ACM 在 Crossref 登记的元数据记载印刷出版于 2026-04-12，在线出版于 2026-07-11，页码为 292–302。出版方标题写作“LLM-powered”，arXiv 记录则大写为“Powered”。审阅文本为带有 ICSE-SEIP '26 页眉的 arXiv v2。论文称其提示词模板和 JSIR 已在 google/jsir 开源。固定提交中该 Apache-2.0 仓库包含 JSIR 及前置函数提取、动态常量传播等代码，但未发现提示词模板、Gemini 流程或评测集文件；论文在图 5 中给出了前置函数识别提示词，并将开源 CASCADE 本身列为后续工作。", "pdf_url": "https://arxiv.org/pdf/2507.17691v2", "project_url": null, "publication_date": "2026-04-12", "publication_status": "conference-paper", "runtime_tested": false, "scope_limitations_en": "The method addresses Obfuscator.IO string obfuscation; control-flow flattening, other obfuscators and an agent-based design are future work. Evaluation obfuscates 3,000 programs from the ETH 150k JavaScript dataset with four Obfuscator.IO presets and measures prelude detection, recovered literals and run time, not functional equivalence. Production deployment and scan volume are author-reported, and production pre-filtering uses a proprietary YARA rule.", "scope_limitations_zh": "该方法针对 Obfuscator.IO 的字符串混淆；控制流平坦化、其他混淆器及基于智能体的设计留待后续工作。评测以 Obfuscator.IO 的四种预设配置混淆 ETH 150k JavaScript 数据集中的 3,000 个程序，衡量前置函数识别、还原的字面量数量和运行时间，而非功能等价性。生产部署及扫描规模均为作者自述，生产环境的预筛选依赖一条未公开的 YARA 规则。", "targets": [ "website" ], "title": "CASCADE: LLM-powered JavaScript Deobfuscator at Google", "title_zh": "CASCADE：谷歌基于大语言模型的 JavaScript 反混淆器", "url": "https://doi.org/10.1145/3786583.3786873", "venue": "ICSE-SEIP 2026", "verification": "source-reviewed", "verified_at": "2026-10-17", "why_fits_en": "Shows how an LLM can be confined to locating obfuscation helpers while a compiler IR performs the rewrites, a practical pattern for website deobfuscation.", "why_fits_zh": "展示了将 LLM 限定于定位混淆辅助函数、由编译器中间表示完成改写的做法，可作为网站反混淆的实用模式。", "year": 2026 }, { "arxiv_id": "2608.27981", "arxiv_version_reviewed": "v1", "authors": [ "Varun Kohli", "N Raghava", "Biplab Sikdar", "Dinil Mon Divakaran" ], "code_url": "https://github.com/VarunKohli18/chisel", "date_basis": "Acceptance is reported in the author arXiv record and publications page; proceedings publication is not verified.", "date_basis_zh": "作者的 arXiv 记录及论文页面报告已录用；未核实正式论文集出版。", "date_precision": "year", "description_en": "CHISEL refines Ghidra pseudocode using compiler diagnostics and type-aware differential fuzzing against the original function. It retains counterexamples and candidate history; existing I/O pairs are held out for evaluation rather than supplied to the recovery loop.", "description_zh": "CHISEL 利用编译诊断及针对原函数的类型感知差分模糊测试改进 Ghidra 伪代码，并保留反例与候选历史。既有 I/O 样例用于保留评测，不提供给恢复循环。", "doi": null, "entry_url": "https://awesomerea.org/papers/paper-chisel-iterative-recovery/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-chisel-iterative-recovery/", "evidence_urls": [ "https://arxiv.org/abs/2608.27981v1", "https://arxiv.org/html/2608.27981v1", "https://www.dinil.net/publications", "https://github.com/VarunKohli18/chisel/blob/855acb07d0ee69b759d91895e8b5a846291db5a5/README.md", "https://api.github.com/repos/VarunKohli18/chisel/git/trees/ece4cc2b45641e4aa968f2343f165c5ca242d5da" ], "first_arxiv_date": "2026-08-28", "id": "paper-chisel-iterative-recovery", "kind": "research", "metadata_notes": "Author sources report acceptance to SURE 2026; the manuscript DOI remains a placeholder, so no proceedings publication date or DOI is assigned. The paper says selection requires at least 200 tests, while the pinned README says at least 100 held-out I/O pairs; exact evaluated artifact alignment remains unresolved. The article is CC BY 4.0, but the inspected root/README did not establish a code/data license. Nothing was run.", "metadata_notes_zh": "作者来源报告已被 SURE 2026 录用；手稿 DOI 仍是占位值，因此不填入正式论文集出版日期或 DOI。论文的筛选要求至少 200 个测试，固定版本 README 则写至少 100 个保留 I/O 样例，尚未确定与实际评估产物的精确对应。文章采用 CC BY 4.0，但所查根目录及 README 未确立代码／数据许可。本次未运行产物。", "pdf_url": "https://arxiv.org/pdf/2608.27981v1", "project_url": null, "publication_date": null, "publication_status": "conference-accepted", "runtime_tested": false, "scope_limitations_en": "Evaluation covers 120 selected ExeBench functions, x86-64 O0–O3, stripped/unstripped variants and a fixed Gemma4:31b model. The feedback oracle still falsely accepts candidates; finite fuzzing and held-out tests do not establish equivalence. Signature recovery and possible benchmark exposure remain limitations.", "scope_limitations_zh": "评估覆盖 120 个选定 ExeBench 函数、x86-64 的 O0–O3、有／无符号变体及固定的 Gemma4:31b 模型。反馈判定器仍会错误接受候选；有限模糊测试及保留测试不证明等价。签名恢复及基准可能进入预训练语料仍是限制。", "targets": [ "binary" ], "title": "CHISEL-ing Back Source Code with AI-enabled Iterative Recovery", "title_zh": "CHISEL：借助 AI 迭代恢复源码", "url": "https://arxiv.org/abs/2608.27981", "venue": "SURE @ ACM CCS 2026", "verification": "source-reviewed", "verified_at": "2026-10-20", "why_fits_en": "Adds test-suite-free in-loop refinement while explicitly separating oracle acceptance from verified behavior.", "why_fits_zh": "补充循环内不依赖既有测试集的修正方法，并区分判定器接受与行为验证。", "year": 2026 }, { "arxiv_id": "2402.16928", "arxiv_version_reviewed": "v1", "authors": [ "Hao Wang", "Zeyu Gao", "Chao Zhang", "Zihan Sha", "Mingyang Sun", "Yuchen Zhou", "Wenyu Zhu", "Wenju Sun", "Han Qiu", "Xi Xiao" ], "code_url": "https://github.com/Hustcw/CLAP", "date_basis": "ACM's Crossref deposit records print and online publication on 2024-09-11; the September 16–20 ISSTA 2024 conference dates and the arXiv date are not substituted for it.", "date_basis_zh": "ACM 提交的 Crossref 元数据将纸质与在线出版日期均记为 2024-09-11；本条目不以 ISSTA 2024 于 9 月 16–20 日举行的会议日期或 arXiv 日期替代该日期。", "date_precision": "day", "description_en": "CLAP (Contrastive Language-Assembly Pre-training) learns assembly-function embeddings aligned with natural-language explanations. A dataset engine compiles Ubuntu C/C++ packages with GCC and Clang at O0–O3 and Os, has GPT-3.5 explain about 2.6 million matching source functions, and fine-tunes a Vicuna-13B “shadow model” on half of those explanations to label more code, yielding 195 million assembly–explanation pairs. A 110M-parameter assembly encoder, using address rebasing, a WordPiece tokenizer and jump-aware embeddings, is first pre-trained on assembly and then contrastively aligned with a text encoder. The embeddings support zero-shot classification by matching code against text prompts. On BinaryCorp-3M similarity search in pools of 10,000 functions, zero-shot CLAP reports 0.836 average recall@1 against 0.571 for fine-tuned jTrans.", "description_zh": "CLAP（对比式语言—汇编预训练）学习与自然语言解释对齐的汇编函数嵌入。其数据引擎以 GCC 和 Clang 在 O0–O3 与 Os 下编译 Ubuntu 的 C/C++ 软件包，由 GPT-3.5 为约 260 万个对应的源码函数生成解释，再用其中一半解释微调 Vicuna-13B“影子模型”为更多代码生成说明，最终得到 1.95 亿对汇编—解释数据。采用地址重定基、WordPiece 分词与跳转感知嵌入的 1.1 亿参数汇编编码器先在汇编上预训练，再与文本编码器进行对比对齐。所得嵌入可通过将代码与文本提示匹配来实现零样本分类。在候选池为 10,000 个函数的 BinaryCorp-3M 相似性检索中，零样本 CLAP 的平均 recall@1 为 0.836，经微调的 jTrans 为 0.571。", "doi": "10.1145/3650212.3652145", "entry_url": "https://awesomerea.org/papers/paper-clap/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-clap/", "evidence_urls": [ "https://dl.acm.org/doi/10.1145/3650212.3652145", "https://api.crossref.org/works/10.1145/3650212.3652145", "https://arxiv.org/abs/2402.16928", "https://arxiv.org/pdf/2402.16928v1", "https://github.com/Hustcw/CLAP/tree/18e38ded87bdf49e3f7eeb87c0329d1ca9f6a21b", "https://github.com/Hustcw/CLAP/blob/18e38ded87bdf49e3f7eeb87c0329d1ca9f6a21b/README.md", "https://huggingface.co/hustcw/clap-asm/blob/620f4beba2edce172e8f35e263399716494950c9/README.md", "https://huggingface.co/hustcw/clap-text/blob/3c4bfe1a936fd9f9140892c4d1d813e4a23301f8/README.md" ], "first_arxiv_date": "2024-02-26", "id": "paper-clap", "kind": "research", "metadata_notes": "Crossref records the ISSTA '24 proceedings article, pages 503–515, and a CC BY-NC-SA 4.0 license; its ten-author order matches arXiv. The ACM landing page refused automated access, so publication facts follow Crossref and the reviewed text is arXiv v1 (2024-02-26), the only version, which carries the ISSTA 2024 header with a placeholder DOI. Table 1 gives zero-shot CLAP an average recall@1 of 0.836, while the introduction states 83.3%. The paper links Hustcw/CLAP. At the reviewed 2024-09-28 commit the repository has no license file and holds a case-study notebook, IDA databases and rebased assembly for a bubble sort, SHA-3 and a malware sample identified by its VirusTotal hash, prompt files, human-evaluation screenshots and an IDA processing script; it does not include training code or the 195-million-pair dataset. The README links the Hugging Face models hustcw/clap-asm and hustcw/clap-text, whose cards declare MIT and which load with trust_remote_code. No models were downloaded and nothing was run.", "metadata_notes_zh": "Crossref 记录该文为 ISSTA '24 论文集文章，页码 503–515，许可证为 CC BY-NC-SA 4.0；十位作者顺序与 arXiv 一致。ACM 文章页面拒绝自动访问，因此出版信息以 Crossref 为准，所审阅的文本是唯一版本 arXiv v1（2024-02-26），其页眉带有 ISSTA 2024 标识及占位 DOI。表 1 给出零样本 CLAP 的平均 recall@1 为 0.836，引言则写作 83.3%。论文链接 Hustcw/CLAP。在所审阅的 2024-09-28 提交中，仓库没有许可证文件，包含案例研究笔记本、冒泡排序、SHA-3 及一个以 VirusTotal 哈希标识的恶意样本的 IDA 数据库与重定基汇编、提示词文件、人工评估截图和 IDA 处理脚本，但不含训练代码或 1.95 亿对数据集。README 链接 Hugging Face 模型 hustcw/clap-asm 与 hustcw/clap-text，其模型卡声明 MIT 许可证，加载时需启用 trust_remote_code。本次未下载模型，也未运行任何内容。", "pdf_url": "https://arxiv.org/pdf/2402.16928v1", "project_url": null, "publication_date": "2024-09-11", "publication_status": "conference-paper", "runtime_tested": false, "scope_limitations_en": "Training explanations are generated by GPT-3.5 and a fine-tuned Vicuna model from source code, not written by humans; five experts scored 50 explanations per model, mostly as acceptable. The authors name the Ubuntu-only build environment and the GPT-3.5 explanations as possible sources of bias. Functions are disassembled with IDA Pro 7.6, and functions with fewer than three basic blocks are excluded. Similarity results use BinaryCorp-3M optimization-level pairs, where baselines get a linear probe and jTrans is also fully fine-tuned while CLAP is not; crypto identification (17 algorithms, about 70K functions labeled by name and package metadata) and protocol categorization (18 types) use datasets the authors built from Ubuntu packages, where fine-tuned CLAP beats the baselines while zero-shot CLAP trails the best baseline on crypto. The malware and sorting results are single case studies. Training used 32 A100 GPUs. CLAP produces embeddings and label scores; it is not a decompiler or a malware detector.", "scope_limitations_zh": "训练用的解释由 GPT-3.5 和经微调的 Vicuna 模型依据源码生成，并非人工撰写；五位专家为每个模型的 50 条解释打分，多数被评为可接受。作者指出，仅使用 Ubuntu 构建环境以及采用 GPT-3.5 生成解释都可能带来偏差。函数由 IDA Pro 7.6 反汇编，少于三个基本块的函数被排除。相似性结果使用 BinaryCorp-3M 中不同优化级别的函数对，各基线采用线性探测，jTrans 另做了完整微调，CLAP 则未经微调；密码算法识别（17 种算法，约 7 万个依据函数名与软件包元数据标注的函数）和协议分类（18 种类型）使用作者从 Ubuntu 软件包构建的数据集，其中微调后的 CLAP 超过基线，零样本 CLAP 在密码算法识别上则略逊于最佳基线。恶意软件与排序算法结果仅为个案研究。训练使用 32 块 A100 GPU。CLAP 输出的是嵌入和标签分数，既不是反编译器，也不是恶意软件检测器。", "targets": [ "binary" ], "title": "CLAP: Learning Transferable Binary Code Representations with Natural Language Supervision", "title_zh": "CLAP：借助自然语言监督学习可迁移的二进制代码表示", "url": "https://dl.acm.org/doi/10.1145/3650212.3652145", "venue": "ACM ISSTA 2024", "verification": "source-reviewed", "verified_at": "2026-10-19", "why_fits_en": "Adds assembly representation learning aligned with natural language, which supports zero-shot and few-shot function labeling and similarity search in binary analysis, complementing jTrans and the LLM-based decompilation and summarization records.", "why_fits_zh": "补充与自然语言对齐的汇编表示学习方法，可在二进制分析中支持零样本和少样本函数标注及相似性检索，与 jTrans 以及基于大语言模型的反编译和摘要研究互补。", "year": 2024 }, { "arxiv_id": "1906.12029", "arxiv_version_reviewed": "v1", "authors": [ "Cheng Fu", "Huili Chen", "Haolan Liu", "Xinyun Chen", "Yuandong Tian", "Farinaz Koushanfar", "Jishen Zhao" ], "code_url": null, "date_basis": "The NeurIPS proceedings page and its metadata give publication year 2019 (Advances in Neural Information Processing Systems 32). No publication day is asserted; neither the December conference dates nor the June 2019 arXiv submission is substituted.", "date_basis_zh": "NeurIPS 论文集页面及其元数据给出出版年份 2019（Advances in Neural Information Processing Systems 第 32 卷）。本条目不推定具体出版日，也不以 12 月的会议日期或 2019 年 6 月的 arXiv 提交日期代替。", "date_precision": "year", "description_en": "Coda decompiles the assembly of short functions into C in two phases. An instruction-type-aware N-ary Tree-LSTM encoder and an attention-fed AST decoder first generate a code sketch; an ensemble of neural error predictors then proposes token corrections, each kept only if recompiling the candidate does not increase its edit distance to the input assembly. On synthetic benchmarks the authors report 82% average program accuracy after correction, against 12% for a sequence-to-sequence baseline with attention.", "description_zh": "Coda 分两个阶段将短函数的汇编反编译为 C。首先由区分指令类型的 N 叉 Tree-LSTM 编码器与带注意力输入的 AST 解码器生成代码草图；随后由多个神经错误预测器的集成提出词元修正，只有当候选代码重新编译后与输入汇编的编辑距离不增加时，才保留该修正。在合成基准上，作者报告修正后的平均程序准确率为 82%，而带注意力的序列到序列基线为 12%。", "doi": null, "entry_url": "https://awesomerea.org/papers/paper-coda/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-coda/", "evidence_urls": [ "https://proceedings.neurips.cc/paper_files/paper/2019/hash/093b60fd0557804c8ba0cbf1453da22f-Abstract.html", "https://proceedings.neurips.cc/paper_files/paper/2019/file/093b60fd0557804c8ba0cbf1453da22f-Metadata.json", "https://proceedings.neurips.cc/paper_files/paper/2019/file/093b60fd0557804c8ba0cbf1453da22f-Paper.pdf", "https://proceedings.neurips.cc/paper_files/paper/2019/file/093b60fd0557804c8ba0cbf1453da22f-Supplemental.zip", "https://arxiv.org/abs/1906.12029v1" ], "first_arxiv_date": "2019-06-28", "id": "paper-coda", "kind": "research", "metadata_notes": "The sole arXiv version, v1 of 2019-06-28, is titled 'A Neural-based Program Decompiler' and lists the same seven authors; this record uses the proceedings title. NeurIPS metadata gives Advances in Neural Information Processing Systems 32, pages 3708–3719; the proceedings page lists no DOI. A footnote expands Coda as CodeAttack. The proceedings supplemental ZIP holds one appendix PDF with dataset statistics, hyper-parameters, the x86-64 table and RetDec examples. The paper cites third-party disassemblers (mipt-mips, REDasm) but no author code, data or model release. No code or experiments were run.", "metadata_notes_zh": "arXiv 仅有 2019-06-28 提交的 v1，题为“A Neural-based Program Decompiler”，作者同为七人；本条目采用论文集标题。NeurIPS 元数据给出 Advances in Neural Information Processing Systems 第 32 卷第 3708–3719 页，论文集页面未列出 DOI。论文脚注说明 Coda 是 CodeAttack 的缩写。论文集补充材料 ZIP 内含一份附录 PDF，提供数据集统计、超参数、x86-64 结果表及 RetDec 示例。论文引用了第三方反汇编器（mipt-mips、REDasm），但未发布作者代码、数据或模型。本次未运行代码或实验。", "pdf_url": "https://proceedings.neurips.cc/paper_files/paper/2019/file/093b60fd0557804c8ba0cbf1453da22f-Paper.pdf", "project_url": null, "publication_date": null, "publication_status": "conference-paper", "runtime_tested": false, "scope_limitations_en": "Training and test programs are randomly generated from Karel commands, math.h calls and arithmetic or logical expressions, in short and long variants (average length 15 and 30), 50,000 pairs per task, compiled without optimization: clang -O0 for the main MIPS results and gcc -O0 for an x86-64 appendix that reports sketch token accuracy only, about 6% lower on average. Real-world checks are small PyTorch C++ API model-construction and Hacker's Delight loop-free programs. Program accuracy requires an exact token match with the ground-truth source, the metric under which the paper reports 0% for conventional decompilers. Error correction assumes the compiler configuration is known, and token accuracy drops for longer programs. The results show neither optimized, whole-program nor binary-equivalent decompilation, and the paper names no author implementation.", "scope_limitations_zh": "训练与测试程序均为随机生成，涵盖 Karel 指令、math.h 调用及算术或逻辑表达式，分为短、长两种（平均长度 15 与 30），每项任务 50,000 对，并在不开启优化的条件下编译：主要 MIPS 结果使用 clang -O0，x86-64 附录使用 gcc -O0，且只报告草图词元准确率，平均约低 6%。真实场景检查仅包括小型 PyTorch C++ API 模型构建程序和 Hacker’s Delight 无循环程序。程序准确率要求与真实源码词元完全一致，论文正是在该指标下报告常规反编译器为 0%。错误修正假定已知编译器配置，程序变长时词元准确率下降。这些结果既不能说明优化代码、整程序或二进制等价的反编译能力，论文也未给出作者实现。", "targets": [ "binary" ], "title": "Coda: An End-to-End Neural Program Decompiler", "title_zh": "Coda：端到端神经程序反编译器", "url": "https://proceedings.neurips.cc/paper_files/paper/2019/hash/093b60fd0557804c8ba0cbf1453da22f-Abstract.html", "venue": "NeurIPS 2019", "verification": "source-reviewed", "verified_at": "2026-10-18", "why_fits_en": "Adds an early (2019) end-to-end neural decompiler that pairs learned code generation with compiler-checked iterative correction, predating the LLM-based decompilation papers in this section.", "why_fits_zh": "补充一种 2019 年的早期端到端神经反编译器，它将学习式代码生成与经编译器检验的迭代修正相结合，早于本节中基于大语言模型的反编译论文。", "year": 2019 }, { "arxiv_id": "2405.15383", "arxiv_version_reviewed": null, "authors": [ "Nicola Dainese", "Matteo Merler", "Minttu Alakuijala", "Pekka Marttinen" ], "citation": { "container_title": "Advances in Neural Information Processing Systems", "pages": "60429-60474", "sources": [ "https://proceedings.neurips.cc/paper_files/paper/2024/hash/6f479ea488e0908ac8b1b37b27fd134c-Abstract-Conference.html", "https://api.crossref.org/works/10.52202/079017-1933" ], "volume": "37" }, "code_url": "https://github.com/nicoladainese96/code-world-models", "date_basis": "The final NeurIPS proceedings and publisher-deposited Crossref record identify 2024. No publication month or day is asserted; conference event dates are not substituted for publication dates.", "date_basis_zh": "正式 NeurIPS 论文集及出版方提交的 Crossref 记录给出 2024 年。不推定出版月份或日期，也不把会议举办日期当作出版日期。", "date_precision": "year", "description_en": "GIF-MCTS generates executable Python transition and reward models from natural-language environment descriptions and offline state-transition trajectories, using prediction feedback to generate, improve and repair code. CWMB evaluates 18 reinforcement-learning environments and downstream planning; a separate experiment uses a simplified Read to Fight Monsters grid world.", "description_zh": "GIF-MCTS 根据环境的自然语言描述与离线状态转移轨迹生成可执行的 Python 状态转移和奖励模型，并利用预测反馈生成、改进和修复代码。CWMB 评估 18 个强化学习环境及后续规划；另一个实验使用简化的 Read to Fight Monsters 网格世界。", "doi": "10.52202/079017-1933", "entry_url": "https://awesomerea.org/papers/paper-code-world-models/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-code-world-models/", "evidence_urls": [ "https://proceedings.neurips.cc/paper_files/paper/2024/hash/6f479ea488e0908ac8b1b37b27fd134c-Abstract-Conference.html", "https://proceedings.neurips.cc/paper_files/paper/2024/file/6f479ea488e0908ac8b1b37b27fd134c-Paper-Conference.pdf", "https://api.crossref.org/works/10.52202/079017-1933", "https://arxiv.org/abs/2405.15383", "https://sites.google.com/view/code-world-models/home", "https://github.com/nicoladainese96/code-world-models/blob/e17e787b41137793bcef9f860bdfe9e6fc07b768/README.md", "https://github.com/nicoladainese96/code-world-models/blob/e17e787b41137793bcef9f860bdfe9e6fc07b768/LICENSE", "https://github.com/nicoladainese96/code-world-models/blob/e17e787b41137793bcef9f860bdfe9e6fc07b768/RTFM/LICENSE", "https://github.com/nicoladainese96/code-world-models/blob/e17e787b41137793bcef9f860bdfe9e6fc07b768/environment.yml", "https://github.com/nicoladainese96/code-world-models/blob/e17e787b41137793bcef9f860bdfe9e6fc07b768/src/mcts/gif_mcts/simulators/simulator_cwm.py", "https://github.com/nicoladainese96/code-world-models/blob/e17e787b41137793bcef9f860bdfe9e6fc07b768/src/cwm_benchmark/generate_env.py", "https://github.com/nicoladainese96/code-world-models/blob/e17e787b41137793bcef9f860bdfe9e6fc07b768/src/experiments/eval_cwm_planning.py", "https://github.com/nicoladainese96/code-world-models/blob/e17e787b41137793bcef9f860bdfe9e6fc07b768/data/prompts/rtfm/generate.md" ], "first_arxiv_date": "2024-05-24", "id": "paper-code-world-models", "kind": "research", "metadata_notes": "Reviewed the final proceedings paper, pages 60429–60474. Its WorldCoder baseline follows the first arXiv version, not later revisions. The Apache-2.0 repository provides prompts, replay-buffer files and evaluation scripts; bundled RTFM carries CC BY-NC 4.0. The pinned evaluator balances reward classes, grants partial credit over next-state components, skips terminal next-state checks, and accepts nonempty valid-action subsets for RTFM; continuous states use 1e-5 relative/absolute tolerance. Its score is not a strict full-transition match rate. The planning script defaults to two episodes, while the paper reports ten. Reproduction needs the Linux-oriented Conda/Python 3.10 environment, Gymnasium/MuJoCo and model access. No upstream code, serialized buffer or model was executed.", "metadata_notes_zh": "核查的是正式论文集版本，页码 60429–60474。其中的 WorldCoder 基线依据首个 arXiv 版本，而非后续修订版。Apache-2.0 仓库提供提示词、回放缓冲区文件和评估脚本；随附 RTFM 采用 CC BY-NC 4.0。固定版本评估器对奖励类别作平衡加权，按下一状态分量给予部分分数，跳过终止转移的下一状态核对，并允许 RTFM 返回有效动作集合的非空子集；连续状态采用 1e-5 的相对和绝对容差。因此该分数不是严格的完整转移匹配率。规划脚本默认运行两个回合，而论文报告十个回合。复现需要面向 Linux 的 Conda/Python 3.10 环境、Gymnasium/MuJoCo 及模型访问权限。本次未执行上游代码、加载序列化缓冲区或调用模型。", "pdf_url": "https://proceedings.neurips.cc/paper_files/paper/2024/file/6f479ea488e0908ac8b1b37b27fd134c-Paper-Conference.pdf", "project_url": "https://sites.google.com/view/code-world-models/home", "publication_date": null, "publication_status": "conference-paper", "runtime_tested": false, "scope_limitations_en": "Assumes deterministic, fully observable dynamics and sufficiently detailed descriptions; this is not recovery from pixels or binaries alone. Accuracy uses the replay transitions supplied during synthesis, alongside planning-return evaluation, rather than proving correctness on all unseen states or full-engine equivalence. RTFM fixes the manual across episodes and keeps monsters stationary. CWMB also includes non-game control and physics tasks; some planning returns are unavailable and complex continuous-state models remain difficult.", "scope_limitations_zh": "假设环境动态具有确定性、状态完全可观测，并且描述足够详细；并非仅凭像素或二进制进行恢复。准确率使用合成过程中提供的回放转移，并结合规划回报评估，不能证明所有未见状态上的正确性或完整引擎等价。RTFM 在不同回合间固定手册内容，并让怪物保持静止。CWMB 也包含非游戏的控制与物理任务；部分规划回报未给出，复杂连续状态模型仍然困难。", "targets": [ "game" ], "title": "Generating Code World Models with Large Language Models Guided by Monte Carlo Tree Search", "title_zh": "通过蒙特卡洛树搜索引导大语言模型生成代码世界模型", "url": "https://proceedings.neurips.cc/paper_files/paper/2024/hash/6f479ea488e0908ac8b1b37b27fd134c-Abstract-Conference.html", "venue": "NeurIPS 2024", "verification": "source-reviewed", "verified_at": "2026-10-17", "why_fits_en": "Shows how documented rules and observed transitions in game-like environments can become executable behavior models with test feedback. It complements game reconstruction without claiming recovery of original engines, graphics or assets.", "why_fits_zh": "展示如何借助测试反馈，将类游戏环境中的已记录规则和已观察转移转为可执行行为模型。它可补充游戏重建研究，但不声称恢复原始引擎、图形或资产。", "year": 2024 }, { "arxiv_id": "2402.11842", "arxiv_version_reviewed": "v1", "authors": [ "Zian Su", "Xiangzhe Xu", "Ziyang Huang", "Zhuo Zhang", "Yapeng Ye", "Jianjun Huang", "Xiangyu Zhang" ], "code_url": "https://github.com/ziansu/codeart", "date_basis": "ACM's Crossref deposit records print and online publication on 2024-07-12. The July 2024 issue date in the reference format and the FSE 2024 conference dates are not substituted for it.", "date_basis_zh": "ACM 提交的 Crossref 元数据将纸质与在线出版日期均记为 2024-07-12；本条目不以引用格式中的 2024 年 7 月期号日期或 FSE 2024 会议日期替代该日期。", "date_precision": "day", "description_en": "CodeArt pre-trains a BERT-sized encoder from scratch on 26 million stripped x86-64 functions built from jTrans's BinaryCorp. Instead of relying on symbols, it uses IDA Pro control-flow graphs and a binary data-flow analysis to compute control and data dependences, then restricts self-attention with masks so a token attends only to instructions it transitively depends on or that depend on it, to tokens in its own instruction, and to a global [CLS] token; pre-training masks tokens and perturbs the dependence graph. The authors fine-tune it for binary similarity, malware family classification and type inference. They report improvements over prior models from 53% to 64% recall@1 for similarity in pools of 500, from 49% to 60% LRAP for malware families, and from 74% to 94% average F1 for type inference.", "description_zh": "CodeArt 基于 jTrans 的 BinaryCorp 构建的 2,600 万个剥离符号的 x86-64 函数，从零开始预训练一个 BERT 规模的编码器。它不依赖符号，而是利用 IDA Pro 控制流图和面向二进制的数据流分析计算控制依赖与数据依赖，再通过注意力掩码，使每个词元只能关注与其存在传递依赖关系的指令、同一条指令内的词元以及全局 [CLS] 词元；预训练时同时遮蔽词元并扰动依赖图。作者将其微调用于二进制相似性分析、恶意软件家族分类和类型推断，报告相对已有模型的提升为：在 500 个函数的候选池中相似性 recall@1 由 53% 升至 64%，恶意软件家族分类 LRAP 由 49% 升至 60%，类型推断平均 F1 由 74% 升至 94%。", "doi": "10.1145/3643752", "entry_url": "https://awesomerea.org/papers/paper-codeart/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-codeart/", "evidence_urls": [ "https://dl.acm.org/doi/10.1145/3643752", "https://api.crossref.org/works/10.1145/3643752", "https://arxiv.org/abs/2402.11842", "https://arxiv.org/pdf/2402.11842v1", "https://github.com/ziansu/codeart/blob/0f787140e51e9c419a9629fe2aac3e7a4477e6c3/README.md", "https://github.com/ziansu/codeart/blob/0f787140e51e9c419a9629fe2aac3e7a4477e6c3/LICENSE", "https://github.com/ziansu/codeart/blob/0f787140e51e9c419a9629fe2aac3e7a4477e6c3/README-docker.md", "https://github.com/ziansu/codeart/blob/0f787140e51e9c419a9629fe2aac3e7a4477e6c3/REQUIREMENTS", "https://huggingface.co/collections/PurCL/codeart-artifacts-662e73dcd9b837e4b970c9be" ], "first_arxiv_date": "2024-02-19", "id": "paper-codeart", "kind": "research", "metadata_notes": "Crossref records Proceedings of the ACM on Software Engineering volume 1, issue FSE, pages 562–585, and the seven-author order matches arXiv. The ACM landing page refused automated access, so publication facts follow Crossref and the reviewed text is arXiv v1 (2024-02-19), the only version, which carries the PACMSE reference format and DOI. The abstract lists the three gains in the order similarity, type inference, malware; the contribution list and evaluation assign 49%→60% LRAP to malware family classification and 74%→94% F1 to type inference, which this record follows. The paper links ziansu/codeart. At the reviewed 2025-03-10 commit the repository declares MIT and its README points to an artifacts branch; README-docker.md describes a 3.8 GB Docker image with a Gradio demo and links the PurCL CodeArt-Artifacts collection on Hugging Face, whose checkpoints and datasets, including top-100 malware-family data, declare no license. The REQUIREMENTS file asks for Docker, 64 GB RAM, a 24 GB GPU and up to 100 GB of disk. Nothing was downloaded or run.", "metadata_notes_zh": "Crossref 记录该文刊于 Proceedings of the ACM on Software Engineering 第 1 卷 FSE 期，页码 562–585，七位作者顺序与 arXiv 一致。ACM 文章页面拒绝自动访问，因此出版信息以 Crossref 为准，所审阅的文本是唯一版本 arXiv v1（2024-02-19），其中带有 PACMSE 引用格式与 DOI。摘要按相似性分析、类型推断、恶意软件的顺序列出三项提升；贡献列表与评估部分则将 LRAP 49%→60% 归于恶意软件家族分类，将 F1 74%→94% 归于类型推断，本条目以后者为准。论文链接 ziansu/codeart。在所审阅的 2025-03-10 提交中，仓库声明 MIT 许可证，README 指向 artifacts 分支；README-docker.md 介绍了一个 3.8 GB、带 Gradio 演示界面的 Docker 镜像，并链接 Hugging Face 上的 PurCL CodeArt-Artifacts 合集，其中的检查点与数据集（包括最常见 100 个恶意软件家族的数据）均未声明许可证。REQUIREMENTS 文件要求 Docker、64 GB 内存、24 GB 显存 GPU 及最多 100 GB 磁盘空间。本次未下载或运行任何内容。", "pdf_url": "https://arxiv.org/pdf/2402.11842v1", "project_url": null, "publication_date": "2024-07-12", "publication_status": "journal-article", "runtime_tested": false, "scope_limitations_en": "The model handles x86-64 only, with functions disassembled by IDA Pro and inputs capped at 512 tokens. Similarity is fine-tuned on BinaryCorp-3M and tested on six projects (Curl, Binutils, ImageMagick, SQLite, OpenSSL and PuTTY), with Coreutils for validation, against GNN, GMN, jTrans and DiEmph baselines; on PuTTY, whose functions are short, CodeArt is only comparable to DiEmph. Type inference uses the x86-64 part of StateFormer's dataset with 35 labels and compares with StateFormer's reported results rather than a rerun. Malware classification uses 5,484 VirusTotal and VirusShare samples from the 100 most frequent families, against jTrans and a re-implemented CNN. All gains are relative to these baselines and settings. CodeArt produces embeddings and task-specific predictions; it is neither a decompiler nor a malware detector.", "scope_limitations_zh": "模型仅处理 x86-64，函数由 IDA Pro 反汇编，输入上限为 512 个词元。相似性任务在 BinaryCorp-3M 上微调，以 Coreutils 作验证集，在 Curl、Binutils、ImageMagick、SQLite、OpenSSL 和 PuTTY 六个项目上测试，基线为 GNN、GMN、jTrans 与 DiEmph；PuTTY 的函数较短，CodeArt 在其上仅与 DiEmph 相当。类型推断使用 StateFormer 数据集中的 x86-64 部分及 35 个标签，并与 StateFormer 已报告的结果比较，而非重新运行。恶意软件分类使用来自 VirusTotal 与 VirusShare、属于最常见 100 个家族的 5,484 个样本，对比 jTrans 和重新实现的 CNN。所有提升都是相对这些基线和设定而言。CodeArt 输出嵌入及特定任务的预测，既不是反编译器，也不是恶意软件检测器。", "targets": [ "binary" ], "title": "CodeArt: Better Code Models by Attention Regularization When Symbols Are Lacking", "title_zh": "CodeArt：在缺少符号时通过注意力正则化改进代码模型", "url": "https://dl.acm.org/doi/10.1145/3643752", "venue": "Proceedings of the ACM on Software Engineering (FSE 2024)", "verification": "source-reviewed", "verified_at": "2026-10-19", "why_fits_en": "Adds general-purpose pre-training for stripped binary functions that uses program dependences in place of missing symbols, evaluated on similarity, type inference and malware-family tasks that support reverse engineering.", "why_fits_zh": "补充面向剥离符号二进制函数的通用预训练方法，以程序依赖关系代替缺失的符号，并在支持逆向工程的相似性分析、类型推断和恶意软件家族分类任务上评估。", "year": 2024 }, { "arxiv_id": "2503.07215", "arxiv_version_reviewed": "v3", "authors": [ "Peipei Liu", "Jian Sun", "Rongkang Sun", "Li Chen", "Zhaoteng Yan", "Xiaoling Zhang", "Dawei Wang", "Dapeng Sun", "Peizheng Zhang", "Dan Li" ], "citation": { "container_title": "Proceedings of the 41st IEEE/ACM International Conference on Automated Software Engineering", "pages": "3278-3289", "publisher": "ACM", "sources": [ "https://api.crossref.org/works/10.1145/3832783.3837554" ] }, "code_url": "https://github.com/LiuPeiP-CS/CodeInverter", "date_basis": "Online and print publication date in ACM’s Crossref deposit; arXiv first submission is recorded separately.", "date_basis_zh": "采用 ACM 向 Crossref 提交的在线及印刷出版日期，另行保留 arXiv 首次提交日期。", "date_precision": "day", "description_en": "CodeInverter studies function-level LLM decompilation using control-flow graphs and memory-to-data mappings extracted with IDA/objdump. It presents a prompt workflow, training corpus and model family, evaluated through compilation, benchmark input/output tests and edit similarity.", "description_zh": "CodeInverter 研究函数级 LLM 反编译，使用 IDA／objdump 提取的控制流图和内存到数据映射补充输入。论文提出提示工作流、训练语料与模型系列，并以编译、基准输入输出测试和编辑相似性评估结果。", "doi": "10.1145/3832783.3837554", "entry_url": "https://awesomerea.org/papers/paper-codeinverter-suite/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-codeinverter-suite/", "evidence_urls": [ "https://api.crossref.org/works/10.1145/3832783.3837554", "https://arxiv.org/abs/2503.07215v3", "https://arxiv.org/pdf/2503.07215v3", "https://arxiv.org/html/2503.07215v3", "https://arxiv.org/abs/2503.07215v1", "https://arxiv.org/abs/2503.07215v2", "https://github.com/LiuPeiP-CS/CodeInverter/blob/548e59c5db07bd108659bf2bfb069f1cfd0c9298/README.md", "https://zenodo.org/api/records/19351453", "https://huggingface.co/CodeInverter/CIM-1.3b/raw/1f7745e19c5420a8c5896f5c31d6938f83454be4/README.md", "https://github.com/LiuPeiP-CS/CodeInverter/blob/548e59c5db07bd108659bf2bfb069f1cfd0c9298/code4train/train/run_ms2decllm_train.sh", "https://github.com/LiuPeiP-CS/CodeInverter/blob/548e59c5db07bd108659bf2bfb069f1cfd0c9298/code4train/LICENSE", "https://github.com/LiuPeiP-CS/CodeInverter/blob/548e59c5db07bd108659bf2bfb069f1cfd0c9298/code4train/LICENSE-MODEL" ], "first_arxiv_date": "2025-03-10", "id": "paper-codeinverter-suite", "kind": "research", "metadata_notes": "The v3 title and ten-author order match ACM’s Crossref deposit. The repository README at 548e59c still cites v2/2025. Direct ACM access returned HTTP 403: this record uses the publisher deposit and author v3 DOI header, not a reviewed publisher PDF. Artifact snapshots are separately versioned. The training directory contains MIT and DeepSeek notices; the CIM-1.3B card declares CC BY 4.0, but a uniform license for all code, weights and data is not established. Weights and dataset archives were not downloaded.", "metadata_notes_zh": "v3 的标题和十位作者顺序与 ACM 的 Crossref 元数据一致，仓库 548e59c 版本的 README 仍引用 v2／2025。直接访问 ACM 返回 HTTP 403；本条目依据出版元数据及作者 v3 的 DOI 页眉，未审阅出版方 PDF。各产物使用独立版本。训练目录包含 MIT 与 DeepSeek 许可说明，CIM-1.3B 模型卡声明 CC BY 4.0，但不能据此为全部代码、权重和数据认定统一许可。本次未下载权重或数据归档。", "pdf_url": "https://arxiv.org/pdf/2503.07215v3", "project_url": "https://huggingface.co/CodeInverter", "publication_date": "2026-10-07", "publication_status": "conference-paper", "runtime_tested": false, "scope_limitations_en": "Evaluation covers individual C functions under 32/64-bit GCC settings. Whole-program recovery, aggressive optimization and protected binaries remain limitations; passing benchmark tests does not establish general equivalence. The text reports one epoch (15 steps), while the pinned launch example sets one epoch and 100 warmup steps; the exact training schedule remains unresolved. No upstream code, models or experiments were run for this collection.", "scope_limitations_zh": "评估针对 32／64 位 GCC 设置下的单个 C 函数。完整程序恢复、激进优化和受保护二进制仍有局限；基准测试通过不代表一般等价。正文写有 1 个 epoch（15 步），固定版本启动示例设置 1 个 epoch 及 100 个预热步，尚无法据此核实精确训练日程。本合集未运行上游代码、模型或实验。", "targets": [ "binary" ], "title": "The CodeInverter Suite: Structure- and Data-Aware Binary Decompilation with Efficient LLMs", "title_zh": "CodeInverter 套件：利用高效大语言模型进行结构与数据感知的二进制反编译", "url": "https://dl.acm.org/doi/10.1145/3832783.3837554", "venue": "ASE 2026", "verification": "source-reviewed", "verified_at": "2026-10-19", "why_fits_en": "Adds structure- and data-informed LLM decompilation with separate compilation, execution-test and similarity evidence.", "why_fits_zh": "补充结合程序结构与数据上下文的 LLM 反编译研究，并区分编译、执行测试与相似性证据。", "year": 2026 }, { "arxiv_id": "2609.38872", "arxiv_version_reviewed": "v1", "authors": [ "Hongyuan Li", "Ke Wang", "Wei Zhou", "Le Guan" ], "code_url": "https://github.com/IoTS-P/LargeRehostingTesting", "date_basis": "Dates this extended arXiv release. Author-reported NDSS 2027 acceptance is recorded separately and is not a 2027 publication claim.", "date_basis_zh": "日期指此扩展版的 arXiv 发布；另行注明作者报告的 NDSS 2027 录用，不作 2027 年已出版声明。", "date_precision": "day", "description_en": "Organizes 24 MCU analysis tools into configuration recovery, emulation, fuzzing and diagnosis stages, then evaluates the runnable, pipeline-compatible subset on 4,571 filtered Cortex-M firmware images. Studies where recovered configurations and emulation artifacts fail to support later analysis.", "description_zh": "将 24 项 MCU 分析工具组织为配置恢复、仿真、模糊测试及诊断阶段，并在 4,571 个筛选后的 Cortex-M 固件镜像上评估可运行且兼容流程的子集，研究恢复的配置和仿真产物为何无法支撑后续分析。", "doi": null, "entry_url": "https://awesomerea.org/papers/paper-cortexm-emulation-sok/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-cortexm-emulation-sok/", "evidence_urls": [ "https://arxiv.org/abs/2609.38872v1", "https://arxiv.org/html/2609.38872v1", "https://github.com/IoTS-P/LargeRehostingTesting/blob/4950719b50c973624ba7cc4444ccacd9e23d88d3/README.md", "https://api.github.com/repos/IoTS-P/LargeRehostingTesting/git/trees/c477332e0c123a6140df36f7b9298992c6c28e29" ], "first_arxiv_date": "2026-09-30", "id": "paper-cortexm-emulation-sok", "kind": "research", "metadata_notes": "The arXiv comment calls this an extended version of a paper accepted to NDSS 2027; the manuscript has a placeholder DOI and no final proceedings date is assigned. Pinned framework README describes a 20-image functional check, not full-corpus replication. Firmware is not redistributed; OTACap access is under NDA. No root code license was established, and no firmware or tools were run.", "metadata_notes_zh": "arXiv 备注称这是 NDSS 2027 已录用论文的扩展版，手稿 DOI 仍为占位值，未填写最终会议录日期。固定框架 README 描述的是 20 镜像功能检查，并非完整语料复现。固件不随仓库重分发，OTACap 访问受保密协议约束。未确立根代码许可证，本次未运行固件或工具。", "pdf_url": "https://arxiv.org/pdf/2609.38872v1", "project_url": null, "publication_date": "2026-09-30", "publication_status": "preprint", "runtime_tested": false, "scope_limitations_en": "Excludes tools requiring unavailable manuals, source or hardware context, so this is not a uniform execution comparison of all 24 tools. ISA identification, admission thresholds and sampled crash diagnosis involve empirical judgments; findings do not generalize to other architectures. Reported crashes are not confirmed vulnerabilities.", "scope_limitations_zh": "排除需要无法取得的手册、源码或硬件上下文的工具，因此不是对全部 24 项工具的统一执行比较。指令集识别、准入阈值及抽样崩溃诊断含经验判断，结论不能直接泛化到其他架构；报告的崩溃不等于已确认漏洞。", "targets": [ "firmware", "binary" ], "title": "SoK: A Large-Scale Empirical Study of Emulation-Based Dynamic Analysis Research for ARM Cortex-M Firmware (Extended Version)", "title_zh": "ARM Cortex-M 固件仿真动态分析研究的大规模实证综述（扩展版）", "url": "https://arxiv.org/abs/2609.38872", "venue": "arXiv (extended version)", "verification": "source-reviewed", "verified_at": "2026-10-20", "why_fits_en": "Adds evidence on the practical limits of reconstructing executable environments for black-box firmware.", "why_fits_zh": "补充为黑盒固件重建可执行环境时实际能力边界的证据。", "year": 2026 }, { "arxiv_id": "2605.10597", "arxiv_version_reviewed": "v1", "authors": [ "Isaac David", "Arthur Gervais" ], "code_url": null, "date_basis": "arXiv v1 submission", "date_basis_zh": "arXiv v1 首次提交日期。", "date_precision": "day", "description_en": "Evaluates agents on executable-checked CrackMe tasks: infer validation logic from binaries and submit an accepted input or artifact, while recording tool use, time, and scoring attempts.", "description_zh": "用可执行程序判定结果的 CrackMe 任务评估智能体：从二进制推断验证逻辑，提交可被接受的输入或产物，并记录工具使用、耗时与评分尝试。", "doi": null, "entry_url": "https://awesomerea.org/papers/paper-crackmebench/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-crackmebench/", "evidence_urls": [ "https://arxiv.org/abs/2605.10597", "https://arxiv.org/html/2605.10597v1" ], "first_arxiv_date": "2026-05-11", "id": "paper-crackmebench", "kind": "research", "metadata_notes": "No conference venue is stated in the reviewed arXiv record. Tool repositories cited in its bibliography are not treated as the paper's own code.", "metadata_notes_zh": "所审阅 arXiv 记录未标明会议发表场所。参考文献中的工具仓库不视为论文自己的代码产物。", "pdf_url": "https://arxiv.org/pdf/2605.10597", "project_url": null, "publication_date": "2026-05-11", "publication_status": "preprint", "runtime_tested": false, "scope_limitations_en": "The v0 study uses 12 generated tasks and eight public calibration tasks, Linux x86-64 ELF binaries, a shell interface, and a five-minute budget. Its compact educational tasks do not establish performance on large applications. No paper-linked public artifact URL was verified.", "scope_limitations_zh": "v0 研究使用 12 个生成任务和 8 个公开校准任务，限定 Linux x86-64 ELF、Shell 接口和五分钟预算。紧凑的教学任务不能证明大型应用上的表现。未确认论文直接关联的公开研究产物 URL。", "targets": [ "binary" ], "title": "CrackMeBench: Binary Reverse Engineering for Agents", "title_zh": "CrackMeBench：面向智能体的二进制逆向工程基准", "url": "https://arxiv.org/abs/2605.10597", "venue": "arXiv", "verification": "source-reviewed", "verified_at": "2026-10-16", "why_fits_en": "Directly measures whether an autonomous reverse-engineering workflow produces a verifiably accepted result.", "why_fits_zh": "直接衡量自主逆向工程流程能否产生可验证、被目标程序接受的结果。", "year": 2026 }, { "arxiv_id": null, "arxiv_version_reviewed": null, "authors": [ "Ali Mesbah", "Arie van Deursen", "Stefan Lenselink" ], "code_url": "https://github.com/crawljax/crawljax", "date_basis": "ACM’s Crossref deposit gives March 2012 for print and online publication, matching the article footer’s “Publication date: March 2012”. The archived ACM page’s 01 March 2012 is read as the issue month, so month precision is retained.", "date_basis_zh": "ACM 提交的 Crossref 元数据将印刷与在线出版日期均记为 2012 年 3 月，与文章页脚的“Publication date: March 2012”一致。ACM 页面存档中的 2012 年 3 月 1 日被视为期号月份，因此保留月精度。", "date_precision": "month", "description_en": "Crawljax infers a state-flow graph of an Ajax web application by driving it in a real browser. It scans the DOM for candidate clickable elements, fires events on them, compares the resulting DOM against known states with configurable comparison and similarity thresholds, and records new states and the event transitions between them, backtracking by reloading and replaying paths. A concurrent variant partitions the crawl across browser instances. The Java tool uses Selenium WebDriver and plugins; one plugin writes a static mirror of the crawled states. The authors evaluate six open-source and industrial sites and measure how the number of concurrent browsers affects crawling runtime on Google AdSense.", "description_zh": "Crawljax 在真实浏览器中驱动 Ajax Web 应用，以推断其状态流图。它扫描 DOM 中候选的可点击元素并触发事件，再用可配置的比较方法与相似度阈值将得到的 DOM 与已知状态比对，记录新状态及状态间的事件转换，并通过重新加载与重放路径进行回溯。并发版本将爬取任务划分给多个浏览器实例。该 Java 工具基于 Selenium WebDriver 与插件机制，其中一个插件可为已爬取的状态生成静态镜像。作者评测了六个开源与工业网站，并在 Google AdSense 上测量并发浏览器数量对爬取耗时的影响。", "doi": "10.1145/2109205.2109208", "entry_url": "https://awesomerea.org/papers/paper-crawljax/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-crawljax/", "evidence_urls": [ "https://dl.acm.org/doi/10.1145/2109205.2109208", "https://web.archive.org/web/20250216232237/https://dl.acm.org/doi/10.1145/2109205.2109208", "https://api.crossref.org/works/10.1145/2109205.2109208", "https://people.ece.ubc.ca/amesbah/resources/papers/tweb-final.pdf", "https://github.com/crawljax/crawljax/blob/5771f6161c645c75f710a8cdc14e3c6898727e06/README.md", "https://github.com/crawljax/crawljax/blob/5771f6161c645c75f710a8cdc14e3c6898727e06/LICENSE", "https://github.com/crawljax/crawljax/blob/5771f6161c645c75f710a8cdc14e3c6898727e06/pom.xml" ], "first_arxiv_date": null, "id": "paper-crawljax", "kind": "research", "metadata_notes": "Crossref and the archived ACM page give the three authors, ACM Transactions on the Web volume 6, issue 1, pages 1–30; the article’s reference format gives Article 3 (March 2012), 30 pages. The text was reviewed in the 30-page author copy on Ali Mesbah’s UBC site; the ACM page holds the version of record. The article is a revised and expanded version of the authors’ ICWE 2008 paper. It describes Crawljax as Apache-licensed and available from crawljax.com. The code link is the crawljax/crawljax repository, whose largest contributor is the first author; the reviewed 2023-06-19 commit carries an Apache-2.0 LICENSE, version 5.2.4-SNAPSHOT, Java 11 and Selenium 4.9.0. No code or experiments were run.", "metadata_notes_zh": "Crossref 与 ACM 页面存档给出三位作者，以及 ACM Transactions on the Web 第 6 卷第 1 期第 1–30 页；文章的引用格式标为 Article 3（2012 年 3 月），共 30 页。正文审阅依据 Ali Mesbah 在 UBC 网站上提供的 30 页作者版本；版本记录以 ACM 页面为准。本文是作者 ICWE 2008 论文的修订扩展版。文中称 Crawljax 采用 Apache 许可，可从 crawljax.com 获取。代码链接指向 crawljax/crawljax 仓库，其最大贡献者为第一作者；所审阅的 2023-06-19 提交附有 Apache-2.0 LICENSE，版本为 5.2.4-SNAPSHOT，使用 Java 11 与 Selenium 4.9.0。本次未运行代码或实验。", "pdf_url": "https://dl.acm.org/doi/pdf/10.1145/2109205.2109208", "project_url": null, "publication_date": "2012-03", "publication_status": "journal-article", "runtime_tested": false, "scope_limitations_en": "Crawljax recovers client-side UI states and navigation transitions, not application source code, server-side logic or a complete behavioral model. The inferred graph is one snapshot instance: click order, server-side factors and state-explosion limits such as depth, time and state caps affect what is found. With default settings it clicks each element once and missed elements that only appear after repeated clicks: 33 of 36 annotated elements were found in Pet Store, and 38 of 40 sampled clickables across four external sites. No gold standard or comparable Ajax crawler was available, so accuracy was assessed by injected elements, a manual reference model and spot checks. External sites change over time, and the concurrent study ran at Google on AdSense. The reviewed 2023 repository is a later Java 11 and Selenium 4 codebase, not the 2012 evaluation build.", "scope_limitations_zh": "Crawljax 恢复的是客户端 UI 状态与导航转换，而非应用源码、服务端逻辑或完整的行为模型。推断出的图只是某一时刻的快照实例：点击顺序、服务端因素以及深度、时间与状态数上限等状态爆炸控制都会影响结果。默认设置下每个元素只点击一次，因而遗漏了需要多次点击才出现的元素：在 Pet Store 中找到 36 个标注元素中的 33 个，在四个外部网站抽样的 40 个可点击元素中找到 38 个。由于缺少黄金标准与可比较的 Ajax 爬虫，准确性通过注入元素、人工参考模型及抽查评估。外部网站会随时间变化，并发实验则在 Google 内部基于 AdSense 进行。所审阅的 2023 年仓库是后来基于 Java 11 与 Selenium 4 的代码，并非 2012 年评测所用版本。", "targets": [ "website" ], "title": "Crawling Ajax-Based Web Applications through Dynamic Analysis of User Interface State Changes", "title_zh": "通过动态分析用户界面状态变化爬取基于 Ajax 的 Web 应用", "url": "https://dl.acm.org/doi/10.1145/2109205.2109208", "venue": "ACM Transactions on the Web", "verification": "source-reviewed", "verified_at": "2026-10-19", "why_fits_en": "Adds a classic dynamic-analysis method for recovering a running web application’s UI state machine, complementing the section’s screenshot-, video- and code-based reconstruction research.", "why_fits_zh": "补充一种经典的动态分析方法，可恢复运行中 Web 应用的 UI 状态机，与本节基于截图、视频及代码的重建研究互补。", "year": 2012 }, { "arxiv_id": "2604.03750", "arxiv_version_reviewed": "v2", "authors": [ "Baicheng Chen", "Yu Wang", "Ziheng Zhou", "Xiangru Liu", "Juanru Li", "Yilei Chen", "Tianxing He" ], "code_url": "https://github.com/wangyu-ovo/CREBench", "date_basis": "Publication year from the official COLM 2026 OpenReview record and its BibTeX; no finer publication date is asserted.", "date_basis_zh": "采用 COLM 2026 官方 OpenReview 记录及其 BibTeX 标明的出版年份，不推定更精确的出版日期。", "date_precision": "year", "description_en": "Benchmarks cryptographic binary reverse engineering across algorithm recognition, key or IV extraction, wrapper reconstruction, and flag recovery using 432 controlled challenges.", "description_zh": "通过 432 个受控挑战，评估密码二进制逆向中的算法识别、密钥或 IV 提取、包装层重建及标志恢复。", "doi": null, "entry_url": "https://awesomerea.org/papers/paper-crebench/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-crebench/", "evidence_urls": [ "https://openreview.net/forum?id=tLYdf8hWJB", "https://colm.cc/Conferences/2026/AcceptedPapers", "https://colm.cc/Conferences/2026", "https://arxiv.org/abs/2604.03750", "https://arxiv.org/html/2604.03750v2", "https://arxiv.org/pdf/2604.03750v2", "https://github.com/wangyu-ovo/CREBench", "https://github.com/wangyu-ovo/CREBench/blob/9fc4016538a0bab8c230732a9f788a61ed43addf/README.md", "https://jams-zhou-james.github.io/CREBench/" ], "first_arxiv_date": "2026-04-04", "id": "paper-crebench", "kind": "research", "metadata_notes": "The COLM 2026 OpenReview record has the same title, seven authors and abstract as arXiv v2 (2026-08-06), whose header reads 'Published as a conference paper at COLM 2026' and which the official project calls its camera-ready version. OpenReview’s 2026-07-08 publication timestamp coincides with the project’s acceptance announcement and is not used as a publication date; the October 6–9, 2026 conference and its Poster Session 5 listing are event details. The repository BibTeX still cites arXiv. This is unrelated to the creativity-evaluation paper also named CreBench.", "metadata_notes_zh": "COLM 2026 的 OpenReview 记录与 arXiv v2（2026-08-06）的标题、七位作者及摘要一致；v2 页首标注“Published as a conference paper at COLM 2026”，官方项目也说明其为会议终稿版本。OpenReview 记录的发布时间 2026-07-08 与项目公布接收的日期相同，不作为出版日期；2026 年 10 月 6—9 日的会议及第 5 场海报环节安排属于会议信息。仓库 BibTeX 仍采用 arXiv 引用。该工作与另一篇同名 CreBench 的创造力评估论文无关。", "pdf_url": "https://arxiv.org/pdf/2604.03750v2", "project_url": "https://jams-zhou-james.github.io/CREBench/", "publication_date": null, "publication_status": "conference-paper", "runtime_tested": false, "scope_limitations_en": "The corpus combines 48 algorithms, three insecure key-use scenarios, and three difficulty levels. It excludes professional-grade obfuscators such as Tigress and O-LLVM; results should not be generalized to heavily protected arbitrary binaries.", "scope_limitations_zh": "语料组合 48 种算法、三类不安全密钥使用场景和三个难度等级。它不覆盖 Tigress、O-LLVM 等专业混淆器，结果不应推广到任意重度保护的二进制文件。", "targets": [ "binary" ], "title": "CREBench: Evaluating Large Language Models in Cryptographic Binary Reverse Engineering", "title_zh": "CREBench：评估大语言模型的密码二进制逆向工程能力", "url": "https://openreview.net/forum?id=tLYdf8hWJB", "venue": "COLM 2026", "verification": "source-reviewed", "verified_at": "2026-10-17", "why_fits_en": "Provides a focused, decomposed test of cryptographic behavior recovery, with a verified official implementation.", "why_fits_zh": "对密码行为恢复提供细分、聚焦的测试，并有已确认的官方实现。", "year": 2026 }, { "arxiv_id": "2408.08926", "arxiv_version_reviewed": "v4", "authors": [ "Andy K. Zhang", "Neil Perry", "Riya Dulepet", "Joey Ji", "Celeste Menders", "Justin W. Lin", "Eliot Jones", "Gashon Hussein", "Samantha Liu", "Donovan Jasper", "Pura Peetathawatchai", "Ari Glenn", "Vikram Sivashankar", "Daniel Zamoshchin", "Leo Glikbarg", "Derek Askaryar", "Mike Yang", "Teddy Zhang", "Rishi Alluri", "Nathan Tran", "Rinnara Sangpisit", "Polycarpos Yiorkadjis", "Kenny Osele", "Gautham Raghupathi", "Dan Boneh", "Daniel E. Ho", "Percy Liang" ], "code_url": "https://github.com/andyzorigin/cybench", "date_basis": "Publication year stated by the official ICLR proceedings; no finer publication date is asserted. The proceedings page's citation date of 2025-05-01 is not adopted, and the arXiv dates are not substituted.", "date_basis_zh": "采用 ICLR 官方论文集标明的出版年份，不主张更精确的出版日期。本条目不采用论文集页面中 2025-05-01 的引用日期，也不以 arXiv 日期替代。", "date_precision": "year", "description_en": "Cybench turns 40 professional-level capture-the-flag tasks from four competitions (HackTheBox Cyber Apocalypse 2024, SekaiCTF 2022–23, GlacierCTF and HKCert) into runnable agent tasks. Each task has a description, starter files, a Kali Linux container for the agent with task servers in Docker, and the time the first human team needed to solve it, from 2 minutes to 24 hours 54 minutes. Each task is also split into subtasks that grade intermediate steps. The authors evaluate eight models with a structured bash agent and compare four scaffolds for GPT-4o and Claude 3.5 Sonnet. Without subtask guidance, the best agents solved only tasks whose first human solve took at most 11 minutes, and Claude 3.5 Sonnet reached 17.5% unguided success.", "description_zh": "Cybench 将来自四项竞赛（HackTheBox Cyber Apocalypse 2024、SekaiCTF 2022–23、GlacierCTF 与 HKCert）的 40 道专业级夺旗赛题目整理为可运行的智能体任务。每道题目都包含题目描述、初始文件、供智能体使用的 Kali Linux 容器及以 Docker 运行的题目服务器，并记录首个人类队伍的解题用时（2 分钟至 24 小时 54 分钟）。每道题目还被拆分为若干子任务，用于评估中间步骤。作者使用结构化 bash 智能体评测了八个模型，并为 GPT-4o 与 Claude 3.5 Sonnet 比较了四种智能体框架。在没有子任务引导时，表现最好的智能体只解出了人类首解用时不超过 11 分钟的题目；Claude 3.5 Sonnet 的无引导成功率为 17.5%。", "doi": null, "entry_url": "https://awesomerea.org/papers/paper-cybench/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-cybench/", "evidence_urls": [ "https://proceedings.iclr.cc/paper_files/paper/2025/hash/3e9412a9c1d93810ef3ef7825115016b-Abstract-Conference.html", "https://proceedings.iclr.cc/paper_files/paper/2025/file/3e9412a9c1d93810ef3ef7825115016b-Paper-Conference.pdf", "https://arxiv.org/abs/2408.08926", "https://arxiv.org/pdf/2408.08926v4", "https://cybench.github.io/", "https://github.com/andyzorigin/cybench/blob/ca483c6443f17a20ba7d6bac3d274859a1721e51/README.md", "https://github.com/andyzorigin/cybench/blob/ca483c6443f17a20ba7d6bac3d274859a1721e51/LICENSE", "https://github.com/andyzorigin/cybench/blob/ca483c6443f17a20ba7d6bac3d274859a1721e51/task_list.txt", "https://github.com/andyzorigin/cybench/tree/ca483c6443f17a20ba7d6bac3d274859a1721e51/benchmark", "https://github.com/andyzorigin/cybench/blob/ca483c6443f17a20ba7d6bac3d274859a1721e51/run_task.sh" ], "first_arxiv_date": "2024-08-15", "id": "paper-cybench", "kind": "research", "metadata_notes": "Authors follow the byline of the proceedings PDF, which matches arXiv v4. The proceedings page metadata instead lists 25 names: it omits Polycarpos Yiorkadjis and Gautham Raghupathi, gives Haoxiang Yang, Aolin Zhang and Kenny Oseleononmen where the PDF prints Mike Yang, Teddy Zhang and Kenny Osele, and drops middle initials. The proceedings list pages 25094–25243 and no DOI. arXiv v1 is dated 2024-08-15, v2 2024-10-06, v3 2024-12-05 and v4 2025-04-12; v4 carries the comment 'ICLR 2025 Oral'. The OpenReview forum could not be retrieved past a browser check, so the oral designation rests on that comment. The proceedings abstract links anonymized Google Drive archives, while the PDF points to cybench.github.io, which links andyzorigin/cybench. At the reviewed 2026-09-24 commit the repository is Apache-2.0; runs need model API keys, Python 3.9–3.10 and Docker with the cybench/cybench image. Its task_list.txt names all 40 tasks, but the nine GlacierCTF tasks, including the reversing tasks RPGO and SOP, are not in the repository tree. No code or experiments were run.", "metadata_notes_zh": "作者以论文集 PDF 的署名为准，与 arXiv v4 一致。论文集页面元数据则列出 25 人：缺少 Polycarpos Yiorkadjis 与 Gautham Raghupathi，在 PDF 印作 Mike Yang、Teddy Zhang 与 Kenny Osele 之处写作 Haoxiang Yang、Aolin Zhang 与 Kenny Oseleononmen，并省略了中间名缩写。论文集列出页码 25094–25243，没有 DOI。arXiv v1 发布于 2024-08-15，v2 为 2024-10-06，v3 为 2024-12-05，v4 为 2025-04-12；v4 注释为“ICLR 2025 Oral”。OpenReview 论坛页因浏览器验证无法获取，因此口头报告身份依据该注释。论文集摘要链接的是匿名 Google Drive 压缩包，而 PDF 指向 cybench.github.io，该网站链接 andyzorigin/cybench。在所审阅的 2026-09-24 提交中，仓库采用 Apache-2.0 许可证；运行需要模型 API 密钥、Python 3.9–3.10 以及使用 cybench/cybench 镜像的 Docker。其 task_list.txt 列出全部 40 道题目，但九道 GlacierCTF 题目（包括逆向题 RPGO 与 SOP）不在仓库目录中。本次未运行代码或实验。", "pdf_url": "https://proceedings.iclr.cc/paper_files/paper/2025/file/3e9412a9c1d93810ef3ef7825115016b-Paper-Conference.pdf", "project_url": "https://cybench.github.io/", "publication_date": null, "publication_status": "conference-paper", "runtime_tested": false, "scope_limitations_en": "Only 6 of the 40 tasks are reverse engineering; the rest are cryptography (16), web (8), forensics (4), miscellaneous (4) and pwn (2), so aggregate rates are not reverse-engineering accuracy, and Cybench is not a reverse-engineering-only benchmark. In the unguided structured-bash runs, six or seven of the eight models solved the two easiest reversing tasks (first human solves in 2 and 6 minutes), and none solved the other four. Results cover 2024 models (GPT-4o, o1-preview, Claude 3 Opus, Claude 3.5 Sonnet, Gemini 1.5 Pro, Llama 3 and 3.1, Mixtral 8x22b) with the authors' scaffolds: 15 iterations unguided or 5 per subtask, short memory, no decompiler tools, one attempt in the main comparison and the best of three in the scaffold comparison. First-solve times come from competition records and are not directly comparable across competitions. The authors judge train–test overlap by model knowledge cutoffs and cannot rule it out for Claude 3.5 Sonnet. CTF tasks are short, small-codebase competition problems, and capturing a flag does not show recovered program structure.", "scope_limitations_zh": "40 道题目中只有 6 道属于逆向工程，其余为密码学（16）、Web（8）、取证（4）、杂项（4）与漏洞利用（2），因此总体成功率并不代表逆向工程准确率，Cybench 也不是专门的逆向工程基准。在无引导的结构化 bash 实验中，八个模型中有六到七个解出了两道最简单的逆向题（人类首解用时分别为 2 分钟和 6 分钟），其余四道均无模型解出。结果仅涵盖 2024 年的模型（GPT-4o、o1-preview、Claude 3 Opus、Claude 3.5 Sonnet、Gemini 1.5 Pro、Llama 3 与 3.1、Mixtral 8x22b）及作者的智能体框架：无引导模式 15 轮、子任务模式每个子任务 5 轮，记忆较短，未提供反编译器工具；主比较只尝试一次，框架比较取三次尝试中的最好结果。首解用时来自各竞赛记录，不同竞赛之间不能直接比较。作者依据模型知识截止日期判断训练—测试重叠，无法排除 Claude 3.5 Sonnet 存在重叠。夺旗赛题目是用时较短、代码规模较小的竞赛问题，夺得旗标并不表明恢复了程序结构。", "targets": [ "binary" ], "title": "Cybench: A Framework for Evaluating Cybersecurity Capabilities and Risks of Language Models", "title_zh": "Cybench：评估语言模型网络安全能力与风险的框架", "url": "https://proceedings.iclr.cc/paper_files/paper/2025/hash/3e9412a9c1d93810ef3ef7825115016b-Abstract-Conference.html", "venue": "ICLR 2025", "verification": "source-reviewed", "verified_at": "2026-10-19", "why_fits_en": "Adds a CTF agent benchmark with reverse-engineering tasks and subtask-level grading; EnIGMA in this section reports results on it, and it complements the reverse-engineering-specific benchmarks here.", "why_fits_zh": "补充一个含逆向工程题目并按子任务评分的夺旗赛智能体基准；本节收录的 EnIGMA 也报告了在该基准上的结果，它与本节专门面向逆向工程的基准互补。", "year": 2025 }, { "arxiv_id": "2607.04727", "arxiv_version_reviewed": "v1", "authors": [ "Tianhao Niu", "Ziyu Han", "Qiguang Chen", "Shiqi Zhou", "Baocai Shan", "Hengjie Fang", "Qingfu Zhu", "Wanxiang Che" ], "code_url": "https://github.com/nth2000/Dashboard2Code", "date_basis": "ACL proceedings publication month.", "date_basis_zh": "采用 ACL 会议论文集的出版月份。", "date_precision": "month", "description_en": "Evaluates agents that actively explore a running dashboard and reconstruct its appearance and interaction logic. DashboardMimic provides 180 Plotly+Dash examples, with code-semantic analysis and dynamic interaction tests for the generated implementations.", "description_zh": "评估智能体主动探索运行中的仪表盘后，重建其外观与交互逻辑的能力。DashboardMimic 提供 180 个 Plotly+Dash 示例，并以代码语义分析和动态交互测试评估生成的实现。", "doi": "10.18653/v1/2026.acl-long.1750", "entry_url": "https://awesomerea.org/papers/paper-dashboard2code/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-dashboard2code/", "evidence_urls": [ "https://aclanthology.org/2026.acl-long.1750/", "https://aclanthology.org/2026.acl-long.1750.pdf", "https://arxiv.org/abs/2607.04727", "https://arxiv.org/html/2607.04727v1", "https://github.com/nth2000/Dashboard2Code", "https://github.com/nth2000/Dashboard2Code/blob/284e154f775af798b843ca4eae26057d7fcf3d21/README.md", "https://huggingface.co/datasets/nth2000/Dashboard2Code" ], "first_arxiv_date": "2026-07-06", "id": "paper-dashboard2code", "kind": "research", "metadata_notes": "The paper links the public code repository directly. Only the public dataset access notice was inspected; gated files were not accessed. Publication metadata follows the final ACL record.", "metadata_notes_zh": "论文直接链接至公开代码仓库。数据集仅检查了公开访问说明，未访问受限文件。出版信息以正式 ACL 记录为准。", "pdf_url": "https://aclanthology.org/2026.acl-long.1750.pdf", "project_url": null, "publication_date": "2026-07", "publication_status": "conference-paper", "runtime_tested": false, "scope_limitations_en": "Limited to Plotly+Dash dashboards, including model-augmented examples. Some settings expose DOM information and evaluation uses model judges. This is not a general backend-recovery benchmark. The linked dataset requires accepting access conditions and sharing contact information.", "scope_limitations_zh": "限定于 Plotly+Dash 仪表盘，包含经模型扩充的示例。部分设置提供 DOM 信息，评估使用模型评审器。它并非通用后端恢复基准。链接的数据集需要接受访问条件并共享联系信息。", "targets": [ "website" ], "title": "Dashboard2Code: Evaluating Multimodal Models on Reconstructing Interactive Dashboards", "title_zh": "Dashboard2Code：评估多模态模型重建交互式仪表盘的能力", "url": "https://aclanthology.org/2026.acl-long.1750/", "venue": "ACL 2026", "verification": "source-reviewed", "verified_at": "2026-10-16", "why_fits_en": "Directly studies reconstruction through active observation, including callbacks and state dependencies rather than screenshot appearance alone.", "why_fits_zh": "直接研究通过主动观察进行重建，涵盖回调与状态依赖，而非只比较截图外观。", "year": 2026 }, { "arxiv_id": "2406.16386", "arxiv_version_reviewed": "v3", "authors": [ "Yuxuan Wan", "Chaozheng Wang", "Yi Dong", "Wenxuan Wang", "Shuqing Li", "Yintong Huo", "Michael Lyu" ], "citation": { "article_number": "FSE094", "container_title": "Proceedings of the ACM on Software Engineering", "issue": "FSE", "pages": "2099-2122", "publisher": "Association for Computing Machinery (ACM)", "sources": [ "https://api.crossref.org/works/10.1145/3729364", "https://arxiv.org/pdf/2406.16386v3" ], "volume": "2" }, "code_url": "https://github.com/WebPAI/DCGen", "date_basis": "ACM-deposited Crossref metadata gives 19 June 2025 for online and print publication; the article text labels the issue July 2025.", "date_basis_zh": "ACM 向 Crossref 提交的元数据将在线及印刷版出版日期列为 2025 年 6 月 19 日；论文正文将期次标为 2025 年 7 月。", "date_precision": "day", "description_en": "Recursively divides a webpage screenshot along visual separation lines, has a multimodal model generate HTML/CSS for each leaf segment, and assembles child code upward into the full page; evaluated with GPT-4o, Gemini and Claude models and a small developer study.", "description_zh": "沿视觉分隔线递归切分网页截图，由多模态模型为每个叶子片段生成 HTML/CSS，再将子片段代码逐级向上组装为完整页面；评估涵盖 GPT-4o、Gemini 与 Claude 系列模型以及一项小规模开发者研究。", "doi": "10.1145/3729364", "entry_url": "https://awesomerea.org/papers/paper-dcgen/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-dcgen/", "evidence_urls": [ "https://doi.org/10.1145/3729364", "https://api.crossref.org/works/10.1145/3729364", "https://arxiv.org/abs/2406.16386", "https://github.com/WebPAI/DCGen/blob/22af69b238fb5aa967cf3f05985a25b52481105f/README.md", "https://huggingface.co/datasets/iforgott/DCGen/tree/70ee45d6183f4b93773f2235f396f3a59d775ea6" ], "first_arxiv_date": "2024-06-24", "id": "paper-dcgen", "kind": "research", "metadata_notes": "This is a PACMSE journal article, volume 2, FSE issue, pages 2099–2122 (article FSE094). Its published title replaces the arXiv title 'Automatically Generating UI Code from Screenshot: A Divide-and-Conquer-Based Approach'. Author names follow the article text, which prints 'Michael Lyu', as does Crossref; the arXiv record lists 'Michael R. Lyu'. The ACM Digital Library copy could not be retrieved during review; the reviewed text is the 24-page ACM-format arXiv v3. The paper-linked repository has no license file at the pinned commit; the full dataset is hosted separately on Hugging Face without a dataset card.", "metadata_notes_zh": "这是 PACMSE 第 2 卷 FSE 专期的期刊论文，页码为 2099–2122（文章编号 FSE094）。正式标题取代了 arXiv 标题“Automatically Generating UI Code from Screenshot: A Divide-and-Conquer-Based Approach”。作者姓名以论文正文为准，正文与 Crossref 均写作“Michael Lyu”，arXiv 记录则为“Michael R. Lyu”。核查期间无法读取 ACM 数字图书馆版本；审阅文本为 24 页、ACM 排版的 arXiv v3。论文所链接的仓库在固定提交中没有许可证文件；完整数据集另存于 Hugging Face，未附数据集说明卡。", "pdf_url": "https://arxiv.org/pdf/2406.16386v3", "project_url": null, "publication_date": "2025-06-19", "publication_status": "journal-article", "runtime_tested": false, "scope_limitations_en": "It reconstructs static visual layout as HTML/CSS, not interaction, JavaScript behavior or backend logic. Test pages are self-contained snapshots with images replaced by placeholders; the main evaluation samples 111 of 348 top-ranked sites, adds 80 harder GitHub Pages pages, and the usefulness study has four participants. Segmentation uses manually set thresholds, and assembly can still misarrange elements.", "scope_limitations_zh": "该方法以 HTML/CSS 重建静态视觉布局，不重建交互、JavaScript 行为或后端逻辑。测试页面是将图片替换为占位图的自包含快照；主要评测从 348 个热门网站中抽取 111 个，另加 80 个更复杂的 GitHub Pages 页面，可用性研究仅有四名参与者。分割依赖人工设定的阈值，组装阶段仍可能错排元素。", "targets": [ "website" ], "title": "Divide-and-Conquer: Generating UI Code from Screenshots", "title_zh": "分而治之：从截图生成界面代码", "url": "https://doi.org/10.1145/3729364", "venue": "Proceedings of the ACM on Software Engineering (FSE 2025)", "verification": "source-reviewed", "verified_at": "2026-10-17", "why_fits_en": "A segment-wise method for rebuilding website layout from screenshots, complementing the benchmark-oriented website papers.", "why_fits_zh": "提供按区域分解、从截图重建网站布局的方法，与以基准评测为主的网站论文互为补充。", "year": 2025 }, { "arxiv_id": null, "arxiv_version_reviewed": null, "authors": [ "Jingxuan He", "Pesho Ivanov", "Petar Tsankov", "Veselin Raychev", "Martin Vechev" ], "citation": { "container_title": "Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security", "pages": "1667-1680", "publisher": "ACM", "sources": [ "https://api.crossref.org/works/10.1145/3243734.3243866" ] }, "code_url": "https://github.com/eth-sri/debin", "date_basis": "ACM-deposited Crossref metadata gives print and online publication on 2018-10-15. That is also the first day of the October 15–19 conference; the date comes from the publisher record, not from the conference schedule.", "date_basis_zh": "ACM 提交的 Crossref 元数据将纸质与在线出版日期均记为 2018-10-15。该日期恰为 10 月 15—19 日会议的首日；本条目依据出版方记录，而非根据会议日程推定。", "date_precision": "day", "description_en": "Debin predicts debug information for stripped ELF binaries on x86, x64 and ARM. After lifting code to BAP-IR, an Extremely randomized Trees classifier decides which registers and memory offsets hold source-level variables. A conditional random field, solved with Nice2Predict, then jointly predicts names and types for variables and functions, and the result is written back as DWARF sections. On 300 held-out binaries per architecture, the authors report 68.8% precision and 68.3% recall for x64 names and types.", "description_zh": "Debin 为 x86、x64 与 ARM 上去符号的 ELF 二进制预测调试信息。它先将代码提升为 BAP-IR，用极端随机树分类器判断哪些寄存器和内存偏移对应源码级变量；再借助 Nice2Predict 求解条件随机场，联合预测变量与函数的名称和类型，并将结果以 DWARF 节写回二进制。作者在每种架构 300 个留出二进制上报告，x64 名称与类型预测的精确率为 68.8%、召回率为 68.3%。", "doi": "10.1145/3243734.3243866", "entry_url": "https://awesomerea.org/papers/paper-debin/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-debin/", "evidence_urls": [ "https://dl.acm.org/doi/10.1145/3243734.3243866", "https://api.crossref.org/works/10.1145/3243734.3243866", "https://files.sri.inf.ethz.ch/website/papers/ccs18-debin.pdf", "https://github.com/eth-sri/debin/blob/715771c1e1468eaafbb599d8bf81a19b5b2e22d2/README.md", "https://github.com/eth-sri/debin/blob/715771c1e1468eaafbb599d8bf81a19b5b2e22d2/LICENSE", "https://github.com/eth-sri/debin/blob/715771c1e1468eaafbb599d8bf81a19b5b2e22d2/dockerfile", "https://github.com/eth-sri/debin/blob/715771c1e1468eaafbb599d8bf81a19b5b2e22d2/requirements.txt", "https://github.com/eth-sri/debin/blob/715771c1e1468eaafbb599d8bf81a19b5b2e22d2/install_dependencies.sh" ], "first_arxiv_date": null, "id": "paper-debin", "kind": "research", "metadata_notes": "Crossref's title field holds only “Debin”; the full title follows the ETH-hosted author PDF, which carries the ACM reference format, DOI and CCS ’18 rights notice. Crossref and the PDF agree on the five-author order and pages 1667–1680. The paper names https://debin.ai as the public tool; that host did not respond on 2026-10-18, so no project page is recorded. The reviewed 2022-05-20 snapshot of eth-sri/debin is Apache-2.0, links the paper and depends on Nice2Predict and BAP. Its README says the setup scripts were tested only on Ubuntu 16.04 with gcc 5.4.0; the Dockerfile pins Ubuntu 16.04, Bazel 0.19.2, OCaml 4.05.0 and BAP 1.4.0, and requirements.txt pins numpy 1.19 and scikit-learn 0.19.2. Pretrained models are a separate archive of about 923 MB from files.sri.inf.ethz.ch. These are historical requirements, not evidence that the code builds on current systems. The model archive was not downloaded, and no code or experiments were run.", "metadata_notes_zh": "Crossref 的标题字段仅为“Debin”；完整标题依据 ETH 托管的作者版 PDF，该文件载有 ACM 引用格式、DOI 及 CCS ’18 版权声明。Crossref 与 PDF 的五位作者顺序及 1667–1680 页码一致。论文将 https://debin.ai 列为公开工具地址；该主机在 2026-10-18 无响应，因此未记录项目页面。所审阅的 eth-sri/debin 2022-05-20 快照采用 Apache-2.0 许可，链接了论文，并依赖 Nice2Predict 与 BAP。其 README 说明安装脚本仅在 Ubuntu 16.04 与 gcc 5.4.0 上测试；Dockerfile 固定 Ubuntu 16.04、Bazel 0.19.2、OCaml 4.05.0 与 BAP 1.4.0，requirements.txt 固定 numpy 1.19 与 scikit-learn 0.19.2。预训练模型是来自 files.sri.inf.ethz.ch、约 923 MB 的独立压缩包。这些是历史要求，不能证明代码可在当前系统上构建。本次未下载模型压缩包，也未运行代码或实验。", "pdf_url": "https://files.sri.inf.ethz.ch/website/papers/ccs18-debin.pdf", "project_url": null, "publication_date": "2018-10-15", "publication_status": "conference-paper", "runtime_tested": false, "scope_limitations_en": "The dataset has 3,000 non-stripped executables and shared libraries per architecture from 830 Linux debug-symbol packages of C code built with default package settings, split 2,700/300 for training and testing. Accuracy evaluation assumes given function boundaries; for fully stripped inputs, BAP's ByteWeight infers them, which the paper cites as about 93% accurate. Debin predicts 17 types, and leaves struct and union contents, line numbers and formats such as PE outside the evaluation. A prediction counts only when it equals the original debug value. Models learned from compiler-generated, benign code may be less accurate on obfuscated binaries, hand-written assembly or malware. The 35-sample malware study is manual inspection of decompiled output with no accuracy figures, because the samples lack ground-truth debug information.", "scope_limitations_zh": "数据集为每种架构 3,000 个未去符号的可执行文件与共享库，来自 830 个 Linux 调试符号软件包，源码为 C 语言并按各包默认设置编译，按 2,700／300 划分训练与测试。准确率评估假定函数边界已知；对于完全去符号的输入，由 BAP 的 ByteWeight 推断函数边界，论文引用其准确率约为 93%。Debin 预测 17 种类型，struct 与 union 的内部内容、行号以及 PE 等其他格式不在评测范围内。只有与原始调试信息完全相同的预测才计为正确。基于编译器生成的良性代码学习的模型，在混淆二进制、手写汇编或恶意软件上可能准确率较低。针对 35 个恶意样本的研究是对反编译输出的人工检查，由于样本缺少调试信息真实标签，未报告准确率。", "targets": [ "binary" ], "title": "Debin: Predicting Debug Information in Stripped Binaries", "title_zh": "Debin：预测去符号二进制中的调试信息", "url": "https://dl.acm.org/doi/10.1145/3243734.3243866", "venue": "ACM CCS 2018", "verification": "source-reviewed", "verified_at": "2026-10-18", "why_fits_en": "Adds learned name and type prediction that works directly on stripped binaries and emits standard debug sections, complementing identifier-naming and symbol-recovery research that operates on decompiler output.", "why_fits_zh": "补充直接作用于去符号二进制、并输出标准调试节的学习式名称与类型预测方法，与基于反编译输出的标识符命名及符号恢复研究互补。", "year": 2018 }, { "arxiv_id": "2605.11501", "arxiv_version_reviewed": "v1", "authors": [ "Alexander Shypula", "Osbert Bastani", "Edward Schwartz" ], "code_url": "https://github.com/AlexShypula/decaf", "date_basis": "First arXiv submission date; no separate proceedings or journal publication was verified.", "date_basis_zh": "采用 arXiv 首次提交日期；未核实另行出版的会议论文集或期刊版本。", "date_precision": "day", "description_en": "Decaf samples multiple candidate decompilations, recompiles them and ranks them using compiler-derived byte distance or a learned reranker. The work studies candidate selection as a way to improve neural decompilation without an iterative source-repair conversation.", "description_zh": "Decaf 采样多个反编译候选，重新编译后利用字节距离或学习式重排序器排序。研究通过候选选择改进神经反编译，而非使用迭代源码修复对话。", "doi": null, "entry_url": "https://awesomerea.org/papers/paper-decaf/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-decaf/", "evidence_urls": [ "https://arxiv.org/abs/2605.11501v1", "https://arxiv.org/html/2605.11501v1", "https://github.com/AlexShypula/decaf/blob/f33c8f4587b7a0055513d6396194015114de8e35/README.md", "https://api.github.com/repos/AlexShypula/decaf/git/trees/0d6690fea728fae5d622afa771a7f6b7dd51df44", "https://huggingface.co/api/models/decaf-usenix/Decaf-Gen-22b", "https://huggingface.co/api/datasets/decaf-usenix/Decaf-Test-Sets" ], "first_arxiv_date": "2026-05-12", "id": "paper-decaf", "kind": "research", "metadata_notes": "This May 2026 preprint is within the six-month fallback window and is explicitly under review. A Hugging Face organization name containing “usenix” is not treated as publication evidence. The pinned code root has no license file; inspected generator/test-set metadata exposes no license declaration. These checks do not establish reuse terms for all checkpoints or derived data. Weights and datasets were not downloaded.", "metadata_notes_zh": "该预印本首投于 2026 年 5 月，属于六个月备用窗口，来源明确写仍在审稿。Hugging Face 组织名中的“usenix”不作为发表证据。固定代码根目录没有许可证文件，检查的生成器／测试集元数据也未给出许可声明，不能据此确定所有权重及衍生数据的复用条款。本次未下载权重或数据集。", "pdf_url": "https://arxiv.org/pdf/2605.11501v1", "project_url": "https://huggingface.co/decaf-usenix", "publication_date": "2026-05-12", "publication_status": "preprint", "runtime_tested": false, "scope_limitations_en": "Byte matching assumes access to the reference compiler/configuration. Experiments subsample ExeBench and exclude examples Hex-Rays cannot decompile; stripped Synth is not execution-scored because call targets cannot be linked. Supplied tests can miss errors. Alternate architectures and obfuscated code are not evaluated, and Juliet results need not generalize to complex vulnerabilities.", "scope_limitations_zh": "字节匹配假设能取得参考编译器及配置。实验对 ExeBench 抽样，并排除 Hex-Rays 无法反编译的样例；去符号 Synth 因调用目标无法链接而未进行执行评分。既有测试可能漏错，实验未覆盖其他架构及混淆代码，Juliet 结果也不必然泛化到复杂漏洞。", "targets": [ "binary" ], "title": "Decaf: Improving Neural Decompilation with Automatic Feedback and Search", "title_zh": "Decaf：通过自动反馈与搜索改进神经反编译", "url": "https://arxiv.org/abs/2605.11501", "venue": "arXiv", "verification": "source-reviewed", "verified_at": "2026-10-20", "why_fits_en": "Provides a compiler-feedback and candidate-ranking approach with clear distinctions between matching and test-based evidence.", "why_fits_zh": "补充编译反馈与候选排序方法，并区分匹配证据和基于测试的判断。", "year": 2026 }, { "arxiv_id": "2609.14098", "arxiv_version_reviewed": "v2", "authors": [ "Timo Schefold" ], "code_url": null, "date_basis": "Official ACM CCS 2026 accepted-paper list confirms acceptance, not a publication date. The reviewed arXiv v2 revision is dated 2026-10-06.", "date_basis_zh": "ACM CCS 2026 官方接收名单确认录用，不能据此推定出版日期。审阅的 arXiv v2 修订日期为 2026-10-06。", "date_precision": "year", "description_en": "Evaluates how language models interpret raw EVM bytecode from purpose-built deceptive and control contracts. It distinguishes recognizing a hidden transfer mechanism from correctly judging its risk, using model judges alongside judge-independent checks.", "description_zh": "评估语言模型如何解释人工构造的欺骗性合约与对照合约的原始 EVM 字节码，区分识别隐藏转账机制与正确判断其风险，并结合模型评审和不依赖评审模型的检查。", "doi": "10.48550/arxiv.2609.14098", "entry_url": "https://awesomerea.org/papers/paper-deception-delta/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-deception-delta/", "evidence_urls": [ "https://arxiv.org/abs/2609.14098", "https://arxiv.org/html/2609.14098v2", "https://api.datacite.org/dois/10.48550/arxiv.2609.14098", "https://www.sigsac.org/ccs/CCS2026/program/accepted-papers.html", "https://doi.org/10.5281/zenodo.22686323", "https://zenodo.org/records/23164989", "https://zenodo.org/api/records/22686323" ], "first_arxiv_date": "2026-09-12", "id": "paper-deception-delta", "kind": "research", "metadata_notes": "The official CCS list confirms the single-author title; arXiv v2 corrects the September v1. The manuscript prints ACM DOI 10.1145/3830454.3846626 and future conference details, but its Crossref lookup returned 404 during review; no publisher publication date or container fields are asserted. The DOI field is the separately registered arXiv DOI. Article and Zenodo metadata declare CC BY 4.0. The concept artifact resolves to record 23164989, v1.0.2, dated 2026-10-05; its metadata describes ERRATA and a 53,006,308-byte ZIP. The archive, contracts and experiments were not downloaded or run.", "metadata_notes_zh": "官方 CCS 名单确认单作者及标题；arXiv v2 对九月的 v1 作了修订。手稿列出 ACM DOI 10.1145/3830454.3846626 及尚未来临的会议安排，但本次 Crossref 查询返回 404，因此不填写出版方的出版日期或容器字段。DOI 字段使用已另行登记的 arXiv DOI。论文及 Zenodo 元数据声明 CC BY 4.0。产物概念链接解析到记录 23164989，版本 1.0.2、日期 2026-10-05；元数据说明存在勘误，ZIP 大小为 53,006,308 字节。本次未下载或运行压缩包、合约或实验。", "pdf_url": "https://arxiv.org/pdf/2609.14098v2", "project_url": "https://zenodo.org/records/23164989", "publication_date": null, "publication_status": "conference-accepted", "runtime_tested": false, "scope_limitations_en": "The main evaluation covers 22 models and 13 synthetic contracts using single-shot raw bytecode, without execution tools, source retrieval or on-chain context. Its 8,528 analyzed responses exclude refusals and pending runs. Gold labels come from one expert; some judges also belong to evaluated model families. Ground-truth checks vary across contracts, including owner/selector-only checks and no dedicated EVM tests for two injection variants. These results neither measure deployed-contract prevalence nor generalize to interactive reverse-engineering agents.", "scope_limitations_zh": "主要评测覆盖 22 个模型与 13 个合成合约，仅单轮提供原始字节码，不含执行工具、源码检索或链上上下文。8,528 条纳入分析的回答排除了拒答及待完成运行。金标准来自一位专家，部分评审模型与被测模型属于相同系列。各合约的真值检查不一致，包括仅检查所有者权限或选择器，以及两个注入变体没有专门 EVM 测试。结果不能估计真实部署合约中的发生率，也不能推广到交互式逆向智能体。", "targets": [ "binary" ], "title": "The Deception Delta: Adversarial Evaluation of LLM-Based Smart Contract Bytecode Forensics", "title_zh": "Deception Delta：基于大语言模型的智能合约字节码取证对抗评测", "url": "https://arxiv.org/abs/2609.14098", "venue": "ACM CCS 2026", "verification": "source-reviewed", "verified_at": "2026-10-20", "why_fits_en": "Adds a bounded failure-mode evaluation for interpreting executable bytecode, especially the gap between describing behavior and assigning a trustworthy safety verdict.", "why_fits_zh": "为解释可执行字节码补充有明确边界的失效评测，尤其关注描述行为与给出可信安全判断之间的差距。", "year": 2026 }, { "arxiv_id": null, "arxiv_version_reviewed": null, "authors": [ "Zhibo Liu", "Shuai Wang" ], "code_url": "https://github.com/monkbai/DecFuzzer", "date_basis": "ACM’s Crossref deposit records print and online publication on 2020-07-18, and the ACM article page gives the same publication date. This entry uses that date, not the conference schedule.", "date_basis_zh": "ACM 提交的 Crossref 元数据将纸质与在线出版日期均记为 2020-07-18，ACM 论文页面给出的出版日期相同。本条目采用该日期，而非会议日程。", "date_precision": "day", "description_en": "Tests whether C decompilers preserve program behavior. The authors' DecFuzzer compiles a Csmith-generated program, decompiles the executable, substitutes the decompiled function for the original in the source, recompiles, and compares the two programs' outputs; equivalence-modulo-inputs (EMI) mutation then derives further test programs from the seeds. Across four popular decompilers the authors report 1,423 inputs that trigger decompilation errors and, after manual analysis, 13 bugs in two open-source decompilers. They argue that modern decompilers are making real progress on functional correctness, while type recovery and optimization still hinder accurate output.", "description_zh": "测试 C 反编译器能否保持程序行为。作者的 DecFuzzer 编译由 Csmith 生成的程序，反编译所得可执行文件，在源码中用反编译出的函数替换原函数后重新编译，并比较两个程序的输出；随后通过模输入等价（EMI）变异，从种子程序派生更多测试程序。作者在四种常用反编译器上报告了 1,423 个触发反编译错误的输入，并经人工分析在两个开源反编译器中确认 13 个缺陷。他们认为现代反编译器在功能正确性上取得了切实进展，但类型恢复与优化仍妨碍其输出准确的代码。", "doi": "10.1145/3395363.3397370", "entry_url": "https://awesomerea.org/papers/paper-decfuzzer/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-decfuzzer/", "evidence_urls": [ "https://dl.acm.org/doi/10.1145/3395363.3397370", "https://api.crossref.org/works/10.1145/3395363.3397370", "https://web.archive.org/web/20251215175843/https://dl.acm.org/doi/abs/10.1145/3395363.3397370", "https://conf.researchr.org/details/issta-2020/issta-2020-papers/26/How-Far-We-Have-Come-Testing-Decompilation-Correctness-of-C-Decompilers", "https://github.com/monkbai/DecFuzzer/blob/8e109c12d499df0223430ae17f71aac3109bd1f6/README.md", "https://github.com/monkbai/DecFuzzer/blob/8e109c12d499df0223430ae17f71aac3109bd1f6/src/Config.py" ], "first_arxiv_date": null, "id": "paper-decfuzzer", "kind": "research", "metadata_notes": "Crossref and the ACM page give the two-author order, pages 475–487 and the title in the lowercase form used here; the conference programme and the artifact README capitalize it “How Far We Have Come: Testing Decompilation Correctness of C Decompilers”. dl.acm.org refused automated requests during this review and no other copy of the paper text was found, so the method and results above follow the abstract on the ISSTA 2020 programme page, the ACM page captured by the Wayback Machine (abstract, reference list and an Artifacts Evaluated – Functional badge) and the artifact itself; paper-only details, such as per-decompiler results, are not recorded. Reference [9] of the paper links monkbai/DecFuzzer. The reviewed 2020-04-23 commit is the ISSTA’20 artifact-evaluation package: it targets Ubuntu 18.04, needs MySQL for EMI mutation, a prebuilt RetDec v4.0 and Radare2 with r2ghidra, and links seed and result data on Dropbox. The repository has no license file and GitHub reports none, so no license is stated here. Nothing was installed or run.", "metadata_notes_zh": "Crossref 与 ACM 页面给出两位作者的顺序、页码 475–487，以及本条目采用的小写标题；会议日程页与产物 README 将其写作“How Far We Have Come: Testing Decompilation Correctness of C Decompilers”。审阅期间 dl.acm.org 拒绝自动请求，也未找到论文正文的其他副本，因此上述方法与结果依据 ISSTA 2020 日程页上的摘要、Wayback Machine 存档的 ACM 页面（摘要、参考文献列表及“Artifacts Evaluated – Functional”徽章）以及产物本身；仅见于论文正文的细节（如各反编译器的结果）未予记录。论文参考文献 [9] 链接 monkbai/DecFuzzer。所审阅的 2020-04-23 提交是 ISSTA’20 产物评审包：面向 Ubuntu 18.04，EMI 变异需要 MySQL，还需预编译的 RetDec v4.0 以及带 r2ghidra 的 Radare2，并在 Dropbox 上提供种子与结果数据的链接。仓库没有许可证文件，GitHub 也未识别出许可证，因此本条目不注明许可证。本次未安装或运行任何内容。", "pdf_url": "https://dl.acm.org/doi/pdf/10.1145/3395363.3397370", "project_url": null, "publication_date": "2020-07-18", "publication_status": "conference-paper", "runtime_tested": false, "scope_limitations_en": "The tests use small generated programs, not real-world binaries, and a failed recompilation is recorded separately from a behavioral mismatch. In the authors' artifact, test programs are compiled as 32-bit x86 with GCC at -O0, and Csmith is restricted to a single function without arrays, structs, unions, pointers or long long types, so optimized code and richer data types are outside that configuration. The four decompilers (IDA Pro, JEB3, RetDec and Radare2's r2ghidra plugin) were tested as of 2020; the error counts and bugs describe those releases, not current ones. IDA Pro and JEB3 are commercial and not included in the artifact, which sets up only RetDec and r2ghidra.", "scope_limitations_zh": "测试使用规模较小的生成程序，而非真实二进制；重新编译失败与行为不一致分开记录。在作者的产物中，测试程序以 GCC 在 -O0 下编译为 32 位 x86 代码，Csmith 被限制为生成单个函数，且不含数组、结构体、联合体、指针或 long long 类型，因此优化代码和更丰富的数据类型不在该配置范围内。四种反编译器（IDA Pro、JEB3、RetDec 及 Radare2 的 r2ghidra 插件）均按 2020 年时的版本测试；错误数量与缺陷针对这些版本，而非当前版本。IDA Pro 与 JEB3 属商业软件，未包含在产物中，产物只配置了 RetDec 与 r2ghidra。", "targets": [ "binary" ], "title": "How far we have come: testing decompilation correctness of C decompilers", "title_zh": "我们走了多远：C 反编译器反编译正确性测试", "url": "https://dl.acm.org/doi/10.1145/3395363.3397370", "venue": "ACM ISSTA 2020", "verification": "source-reviewed", "verified_at": "2026-10-19", "why_fits_en": "Adds differential testing of decompiler correctness through recompilation, complementing the collection's decompiler benchmarks, such as DecompileBench, that evaluate output on real functions.", "why_fits_zh": "补充借助重新编译对反编译器正确性开展差分测试的研究，与 DecompileBench 等在真实函数上评估输出的反编译基准互补。", "year": 2020 }, { "arxiv_id": "2409.11667", "arxiv_version_reviewed": "v1", "authors": [ "Ting Zhou", "Yanjie Zhao", "Xinyi Hou", "Xiaoyu Sun", "Kai Chen", "Haoyu Wang" ], "citation": { "article_number": "FSE011", "container_title": "Proceedings of the ACM on Software Engineering", "issue": "FSE", "pages": "219-241", "publisher": "Association for Computing Machinery (ACM)", "sources": [ "https://api.crossref.org/works/10.1145/3715726", "https://xinyi-hou.github.io/files/zhou2024bridging.pdf" ], "volume": "2" }, "code_url": "https://github.com/security-pride/DeclarUI", "date_basis": "ACM-deposited Crossref metadata gives 19 June 2025 for online and print publication; the author PDF labels the issue July 2025.", "date_basis_zh": "ACM 向 Crossref 提交的元数据将在线及印刷版出版日期列为 2025 年 6 月 19 日；作者 PDF 的期次标签为 2025 年 7 月。", "date_precision": "day", "description_en": "Combines visual component extraction, multimodal models, page-transition graphs and iterative checks to reconstruct multi-page mobile UI code from designs or screenshots, evaluated with React Native, Flutter and ArkUI.", "description_zh": "结合视觉组件提取、多模态模型、页面跳转图与迭代检查，从设计稿或截图重建多页面移动界面代码，并在 React Native、Flutter 和 ArkUI 上评测。", "doi": "10.1145/3715726", "entry_url": "https://awesomerea.org/papers/paper-declarui/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-declarui/", "evidence_urls": [ "https://api.crossref.org/works/10.1145/3715726", "https://xinyi-hou.github.io/files/zhou2024bridging.pdf", "https://arxiv.org/abs/2409.11667", "https://github.com/security-pride/DeclarUI/blob/a4df6254dd81de7e26695f4e5c35922ac3a4dcab/README.md" ], "first_arxiv_date": "2024-09-18", "id": "paper-declarui", "kind": "research", "metadata_notes": "This is a PACMSE journal article, volume 2, FSE issue, pages 219–241 (article FSE011), not an unpublished preprint. Its published title adds DeclarUI to the 2024 arXiv title. The author-hosted 23-page article is the main reviewed text; arXiv v1 was also checked. The linked repository is the paper-named artifact, reviewed at a pinned commit without execution.", "metadata_notes_zh": "这是 PACMSE 第 2 卷 FSE 专期的期刊论文，页码为 219–241（文章编号 FSE011），并非尚未发表的预印本。正式标题在 2024 年 arXiv 标题前增加了 DeclarUI。主要审阅文本为作者托管的 23 页期刊论文，同时核对了 arXiv v1。所链接仓库由论文明确指定，本次固定提交核查，未执行代码。", "pdf_url": "https://xinyi-hou.github.io/files/zhou2024bridging.pdf", "project_url": null, "publication_date": "2025-06-19", "publication_status": "journal-article", "runtime_tested": false, "scope_limitations_en": "People review and correct the inferred navigation graph. Evaluation covers 50 five-page UI sets; transition coverage and compilation do not establish full business-logic or backend recovery. Framework results vary, and visual metrics imperfectly reflect perceived fidelity. Public scripts and data are available, but no project-level license was found at the reviewed commit.", "scope_limitations_zh": "人员需审核并修正推断出的导航图。评测覆盖 50 组各含五页的界面；页面跳转覆盖率与编译成功不代表恢复了完整业务逻辑或后端。各框架结果存在差异，视觉指标也不能完全反映人眼感知的保真度。脚本与数据已公开，但核查的提交中未发现项目级许可证。", "targets": [ "app" ], "title": "DeclarUI: Bridging Design and Development with Automated Declarative UI Code Generation", "title_zh": "DeclarUI：以自动生成声明式界面代码连接设计与开发", "url": "https://doi.org/10.1145/3715726", "venue": "Proceedings of the ACM on Software Engineering (FSE 2025)", "verification": "source-reviewed", "verified_at": "2026-10-16", "why_fits_en": "Extends app-interface reconstruction from isolated screens to mobile UI projects with explicit navigation.", "why_fits_zh": "将应用界面重建从单个屏幕扩展到具有明确导航关系的移动界面项目。", "year": 2025 }, { "arxiv_id": null, "arxiv_version_reviewed": null, "authors": [ "Wai Kin Wong", "Daoyuan Wu", "Huaijin Wang", "Zongjie Li", "Zhibo Liu", "Shuai Wang", "Qiyi Tang", "Sen Nie", "Shi Wu" ], "citation": { "article_number": "ISSTA081", "container_title": "Proceedings of the ACM on Software Engineering", "issue": "ISSTA", "pages": "1841-1864", "publisher": "ACM", "sources": [ "https://dl.acm.org/doi/10.1145/3728958", "https://api.crossref.org/works/10.1145/3728958" ], "volume": "2" }, "code_url": null, "date_basis": "The ACM article page and publisher-deposited Crossref metadata agree on publication on 2025-06-22. The ISSTA presentation date is not substituted for this journal publication date.", "date_basis_zh": "ACM 文章页面与出版方提交的 Crossref 元数据均将出版日期列为 2025-06-22；本条目不以 ISSTA 报告日期替代该期刊出版日期。", "date_precision": "day", "description_en": "DecLLM repairs decompiler pseudocode that does not recompile into C that compiles and runs, so source-level tools such as CodeQL can be applied to binaries. An iterative loop feeds compiler errors to an off-the-shelf LLM, reverting illegal outputs and large deletions, then uses mismatched test outputs and AddressSanitizer reports from the rebuilt program to repair behavior, and finally fuzzes the original and rebuilt executables for divergences. With GPT-3.5 and GPT-4 the authors report 74% and 78.3% success on 300 Code Contest programs; on Coreutils and CGC binaries, 61.9–70.9% recompile and 48.1–59.0% are fully functional.", "description_zh": "DecLLM 将无法重新编译的反编译伪代码修复为可编译、可运行的 C 代码，使 CodeQL 等源码级工具能够用于二进制分析。其迭代流程把编译器错误反馈给现成的大语言模型，并回退非法输出和大段删除；随后利用重建程序与预期不符的测试输出及 AddressSanitizer 报告修复行为，最后对原始与重建的可执行文件进行模糊测试以发现行为差异。作者报告，使用 GPT-3.5 与 GPT-4 时，在 300 个 Code Contest 程序上的成功率分别为 74% 和 78.3%；在 Coreutils 与 CGC 二进制上，61.9%–70.9% 可重新编译，完全功能正常的占 48.1%–59.0%。", "doi": "10.1145/3728958", "entry_url": "https://awesomerea.org/papers/paper-decllm/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-decllm/", "evidence_urls": [ "https://dl.acm.org/doi/10.1145/3728958", "https://api.crossref.org/works/10.1145/3728958", "https://dl.acm.org/doi/pdf/10.1145/3728958", "https://sites.google.com/view/decllm", "https://sites.google.com/view/decllm/decrule", "https://sites.google.com/view/decllm/decrule-errors", "https://sites.google.com/view/decllm/dynamic-repairing", "https://sites.google.com/view/decllm/cwe", "https://arxiv.org/abs/2310.06530" ], "first_arxiv_date": null, "id": "paper-decllm", "kind": "research", "metadata_notes": "The ACM page and Crossref agree on the title, nine-author order, DOI, volume 2, issue ISSTA, pages 1841–1864 and the 2025-06-22 publication date (received 2025-02-27, accepted 2025-03-31); the ACM page supplies article number ISSTA081, which Crossref omits. ACM marks the article open access under CC BY-ND 4.0, and its HTML full text was reviewed. No arXiv version of DecLLM was found. The related preprint arXiv:2310.06530, “Refining Decompiled C Code with Large Language Models” (DecGPT; v1 2023-10-10, v2 2023-11-28), shares eight of the nine authors, omitting Daoyuan Wu, and the recompilation goal, but its title, author list and reported results differ, so it is not recorded as this paper’s arXiv identifier. The Data Availability section points only to the Google Sites artifact page. As reviewed, it describes DecRule’s preprocessing rules, error examples, dynamic-repair case analysis and the CWE list; no source repository, prompt package or dataset download was identified, so code_url stays null. The prototype targeted output from the commercial IDA Pro decompiler and used OpenAI model snapshots that may no longer be served. Nothing was run.", "metadata_notes_zh": "ACM 页面与 Crossref 的标题、九位作者顺序、DOI、第 2 卷 ISSTA 期、页码 1841–1864 及 2025-06-22 出版日期一致（2025-02-27 收稿，2025-03-31 接收）；文章编号 ISSTA081 由 ACM 页面提供，Crossref 未列出。ACM 将文章标为开放获取，采用 CC BY-ND 4.0 许可，本次审阅了其 HTML 全文。未发现 DecLLM 的 arXiv 版本。相关预印本 arXiv:2310.06530《Refining Decompiled C Code with Large Language Models》（DecGPT；v1 为 2023-10-10，v2 为 2023-11-28）与本文共有九位作者中的八位（未列 Daoyuan Wu），研究目标同为可重新编译，但标题、作者列表与报告结果不同，因此不作为本文的 arXiv 标识符记录。数据可用性章节仅指向 Google Sites 产物页面。经审阅，该页面介绍 DecRule 的预处理规则、错误示例、动态修复案例分析及 CWE 列表，未发现源码仓库、提示词包或数据集下载，因此 code_url 保持为空。原型针对商业反编译器 IDA Pro 的输出，所用 OpenAI 模型快照可能已停止提供。本次未运行任何内容。", "pdf_url": "https://dl.acm.org/doi/pdf/10.1145/3728958", "project_url": "https://sites.google.com/view/decllm", "publication_date": "2025-06-22", "publication_status": "journal-article", "runtime_tested": false, "scope_limitations_en": "On Code Contest, success means the repaired code compiles and the rebuilt executable passes the supplied test cases, with AFL++ fuzzing as an extra check; the Coreutils and CGC overall rates also count rebuilt binaries that malfunction or crash. This establishes compilability and test-based agreement, not semantic equivalence, which the authors note is undecidable. Results depend on IDA Pro 8.3 output, with one Ghidra 10.4 repetition, and on the API-served gpt-3.5-turbo-0613 and gpt-4-0314 snapshots with a 4,096-token limit, so programs were chosen to fit within half of it. The 300 Code Contest programs average 112.9 lines; Coreutils 9.5 and CGC binaries were compiled without stripping symbols and repaired function by function, which cannot infer undefined globals. Around 30% of hard cases still fail, mainly from decompiler address/data confusion, ill-inferred buffer sizes, long outputs that include STL code and LLM type-cast shortcuts; deviations not exercised by tests remain undetected. CodeQL analysis of Juliet samples needed manual query adaptation.", "scope_limitations_zh": "在 Code Contest 上，成功的含义是修复后的代码能够编译，且重建的可执行文件通过所提供的测试用例，并以 AFL++ 模糊测试作额外检查；Coreutils 与 CGC 的总体比率还计入功能异常或崩溃的重建二进制。这确立的是可编译性和基于测试的一致性，而非语义等价性，作者亦指出后者不可判定。结果依赖 IDA Pro 8.3 的输出（另以 Ghidra 10.4 重复一次实验），以及通过 API 提供、上下文上限为 4,096 个词元的 gpt-3.5-turbo-0613 与 gpt-4-0314 快照，因此所选程序须控制在该上限的一半以内。300 个 Code Contest 程序平均 112.9 行；Coreutils 9.5 与 CGC 二进制编译时未剥离符号，并逐函数修复，这种方式无法推断未定义的全局变量。约 30% 的困难案例仍然失败，主要原因包括反编译器混淆地址与数据、缓冲区大小推断错误、包含 STL 代码的过长输出，以及大语言模型以类型强制转换走捷径；测试未覆盖的行为偏差仍无法发现。对 Juliet 样本进行 CodeQL 分析时需要人工调整查询。", "targets": [ "binary" ], "title": "DecLLM: LLM-Augmented Recompilable Decompilation for Enabling Programmatic Use of Decompiled Code", "title_zh": "DecLLM：借助大语言模型实现可重新编译的反编译，支持以程序化方式使用反编译代码", "url": "https://dl.acm.org/doi/10.1145/3728958", "venue": "Proceedings of the ACM on Software Engineering (ISSTA 2025)", "verification": "source-reviewed", "verified_at": "2026-10-18", "why_fits_en": "Adds recompilability-oriented repair of decompiler output, complementing readability-oriented LLM refinement and neural decompilation research.", "why_fits_zh": "补充以可重新编译为目标的反编译输出修复方法，与以可读性为目标的大语言模型改写及神经反编译研究互补。", "year": 2025 }, { "arxiv_id": "2505.12668", "arxiv_version_reviewed": "v2", "authors": [ "Hanzhuo Tan", "Xiaolong Tian", "Hanrui Qi", "Jiaming Liu", "Zuchen Gao", "Siyi Wang", "Qi Luo", "Jing Li", "Yuqun Zhang" ], "code_url": "https://github.com/albertan017/LLM4Decompile", "date_basis": "Publication year in the official NeurIPS proceedings and publisher-deposited Crossref metadata; no finer publication date is asserted.", "date_basis_zh": "采用 NeurIPS 官方论文集及出版商在 Crossref 登记的出版年份，不推定更精确的出版日期。", "date_precision": "year", "description_en": "Introduces two million C/C++ binary-source function pairs using a Compile-Trace-Filter pipeline, with an evaluation suite spanning translated HumanEval/MBPP tasks and recent GitHub functions.", "description_zh": "通过 Compile-Trace-Filter 流程构建 200 万组 C/C++ 二进制与源码函数对，并提供涵盖转写为 C/C++ 的 HumanEval、MBPP 任务及近期 GitHub 函数的评测集。", "doi": "10.52202/085713-0177", "entry_url": "https://awesomerea.org/papers/paper-decompile-bench/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-decompile-bench/", "evidence_urls": [ "https://papers.nips.cc/paper_files/paper/2025/hash/079cf13ae174c31f148207d94d213bdc-Abstract-Datasets_and_Benchmarks_Track.html", "https://papers.nips.cc/paper_files/paper/2025/file/079cf13ae174c31f148207d94d213bdc-Paper-Datasets_and_Benchmarks_Track.pdf", "https://doi.org/10.52202/085713-0177", "https://api.crossref.org/works/10.52202/085713-0177", "https://arxiv.org/abs/2505.12668", "https://arxiv.org/html/2505.12668v2", "https://github.com/albertan017/LLM4Decompile/blob/85b364bf093eb2ee4f3687cfe38a203fca89f23e/decompile-bench/readme.md", "https://github.com/albertan017/LLM4Decompile/blob/85b364bf093eb2ee4f3687cfe38a203fca89f23e/LICENSE", "https://github.com/albertan017/LLM4Decompile/blob/85b364bf093eb2ee4f3687cfe38a203fca89f23e/LICENSE-MODEL", "https://huggingface.co/datasets/LLM4Binary/decompile-bench/blob/4b708c2211cd7d4af403675db56322aa4ed7050c/README.md", "https://huggingface.co/datasets/LLM4Binary/decompile-bench/blob/4b708c2211cd7d4af403675db56322aa4ed7050c/LICENSE" ], "first_arxiv_date": "2025-05-19", "id": "paper-decompile-bench", "kind": "research", "metadata_notes": "Author order follows the final PDF, which puts Zuchen Gao before Siyi Wang; the proceedings landing page and Crossref reverse them. arXiv v2 was revised on 2025-10-19. The artifact is the decompile-bench subdirectory of the existing LLM4Decompile repository. Code has an MIT license; the dataset declares CC0-1.0, while model weights have separate terms. These declarations do not replace source-project license review.", "metadata_notes_zh": "作者顺序以正式 PDF 为准，其中 Zuchen Gao 位于 Siyi Wang 之前；论文集网页与 Crossref 的顺序相反。arXiv v2 于 2025-10-19 更新。产物位于已有 LLM4Decompile 仓库的 decompile-bench 子目录。代码采用 MIT 许可，数据集声明 CC0-1.0，模型权重另有条款；这些声明不能替代对源项目许可的核查。", "pdf_url": "https://papers.nips.cc/paper_files/paper/2025/file/079cf13ae174c31f148207d94d213bdc-Paper-Datasets_and_Benchmarks_Track.pdf", "project_url": null, "publication_date": null, "publication_status": "conference-paper", "runtime_tested": false, "scope_limitations_en": "This is function-level decompilation. Re-execution tests cover HumanEval/MBPP; GitHub2025 provides no unit tests. Inlining can prevent one-to-one source correspondence, and the fine-tuning study uses 10% of the corpus. These results do not establish whole-program recovery.", "scope_limitations_zh": "该工作研究函数级反编译。重新执行测试覆盖 HumanEval、MBPP；GitHub2025 未提供单元测试。内联可能使二进制与源码无法一一对应，微调实验仅使用 10% 的语料。这些结果不能证明整程序恢复能力。", "targets": [ "binary" ], "title": "Decompile-Bench: Million-Scale Binary-Source Function Pairs for Real-World Binary Decompilation", "title_zh": "Decompile-Bench：面向真实二进制反编译的百万级二进制与源码函数对", "url": "https://papers.nips.cc/paper_files/paper/2025/hash/079cf13ae174c31f148207d94d213bdc-Abstract-Datasets_and_Benchmarks_Track.html", "venue": "NeurIPS 2025 Datasets and Benchmarks", "verification": "source-reviewed", "verified_at": "2026-10-16", "why_fits_en": "Adds a training corpus and evaluation artifact for LLM decompilation, distinct from Gao et al.’s existing DecompileBench entry.", "why_fits_zh": "补充 LLM 反编译的训练语料与评测产物，不同于现有 Gao 等人的 DecompileBench 条目。", "year": 2025 }, { "arxiv_id": "2609.05370", "arxiv_version_reviewed": "v1", "authors": [ "Chang Liu", "Edward Raff", "Kristopher Micinski" ], "code_url": null, "date_basis": "First arXiv submission date from the reviewed submission history; no formal publication was verified.", "date_basis_zh": "采用已核对的 arXiv 首次提交日期；尚未核实正式出版信息。", "date_precision": "day", "description_en": "Decompile-Diverge builds function-level behavioral comparisons from source-derived drivers and fuzzed reference inputs. The study compares reconstructed functions on the same inputs and examines divergences and missing crashes that compilation and supplied tests can miss.", "description_zh": "Decompile-Diverge 基于源码生成驱动，并对参考实现进行模糊测试，以构建函数级行为比较。研究让重建函数使用相同输入，检查编译及既有测试可能漏掉的行为差异与崩溃消失。", "doi": null, "entry_url": "https://awesomerea.org/papers/paper-decompile-diverge/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-decompile-diverge/", "evidence_urls": [ "https://arxiv.org/abs/2609.05370v1", "https://arxiv.org/html/2609.05370v1" ], "first_arxiv_date": "2026-09-04", "id": "paper-decompile-diverge", "kind": "research", "metadata_notes": "Latest reviewed version is arXiv v1, licensed CC BY 4.0. No author-linked code or dataset URL was verified in the reviewed paper and focused artifact search; availability and artifact licenses remain unverified. Reported measurements were not reproduced.", "metadata_notes_zh": "最新核对版本为 arXiv v1，文章采用 CC BY 4.0。已读论文及定向产物检索未核实作者代码或数据集链接；产物可用性与许可仍未确定。本次未复现文中测量结果。", "pdf_url": "https://arxiv.org/pdf/2609.05370v1", "project_url": null, "publication_date": "2026-09-04", "publication_status": "preprint", "runtime_tested": false, "scope_limitations_en": "The oracle requires reference source, supported inputs and buildable harnesses. It compares a finite corpus and bounded observable state; Matched does not prove all-input equivalence. Nine of 300 GitHub reference functions failed harness builds, leaving 291. Some types/functions are excluded. DeGPT-Qwen is a substituted-backend configuration, not the originally published DeGPT model.", "scope_limitations_zh": "该判定器需要参考源码、受支持输入及可构建的测试框架。比较仅覆盖有限输入语料和有界可观测状态；Matched 不代表所有输入上的等价。300 个 GitHub 参考函数中九个无法构建，最终保留 291 个；部分类型与函数被排除。DeGPT-Qwen 使用替换后的后端，并非原始发表的 DeGPT 模型。", "targets": [ "binary" ], "title": "When LLM Decompilers Recompile More and Preserve Less", "title_zh": "当 LLM 反编译器更易重编译，却更少保留原始行为", "url": "https://arxiv.org/abs/2609.05370", "venue": "arXiv", "verification": "source-reviewed", "verified_at": "2026-10-20", "why_fits_en": "Offers a concrete check on what recompilation and benchmark pass rates do not establish about recovered code.", "why_fits_zh": "具体说明重编译及基准通过率无法证明恢复代码的哪些行为属性。", "year": 2026 }, { "arxiv_id": "2505.11340", "arxiv_version_reviewed": "v1", "authors": [ "Zeyu Gao", "Yuxin Cui", "Hao Wang", "Siliang Qin", "Yuanda Wang", "Zhang Bolun", "Chao Zhang" ], "code_url": "https://github.com/vul337/DecompileBench", "date_basis": "ACL proceedings publication month", "date_basis_zh": "ACL 会议论文集的出版月份。", "date_precision": "month", "description_en": "Evaluates traditional and LLM-based decompilers using functions from real programs, runtime behavioral checks, and an LLM-assisted assessment of analyst-facing code understandability.", "description_zh": "利用真实程序中的函数、运行时行为检查，以及 LLM 辅助的代码可理解性评估，比较传统反编译器与基于 LLM 的方法。", "doi": "10.18653/v1/2025.findings-acl.1194", "entry_url": "https://awesomerea.org/papers/paper-decompilebench/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-decompilebench/", "evidence_urls": [ "https://aclanthology.org/2025.findings-acl.1194/", "https://aclanthology.org/2025.findings-acl.1194.pdf", "https://arxiv.org/abs/2505.11340", "https://github.com/vul337/DecompileBench", "https://github.com/vul337/DecompileBench/blob/761c6513b10344f502474f3e5e78c74fd89ab839/README.md" ], "first_arxiv_date": "2025-05-16", "id": "paper-decompilebench", "kind": "research", "metadata_notes": "The published ACL record and PDF use 'Zhang Bolun'; the arXiv record uses 'Bolun Zhang'. The paper's Jennieett/DecompileBench link now redirects to vul337/DecompileBench. This is distinct from Tan et al.'s Decompile-Bench (arXiv:2505.12668).", "metadata_notes_zh": "正式 ACL 记录与 PDF 使用作者名 Zhang Bolun，arXiv 记录使用 Bolun Zhang。论文中的 Jennieett/DecompileBench 链接现重定向至 vul337/DecompileBench。该论文不同于 Tan 等人的 Decompile-Bench（arXiv:2505.12668）。", "pdf_url": "https://aclanthology.org/2025.findings-acl.1194.pdf", "project_url": null, "publication_date": "2025-07", "publication_status": "conference-paper", "runtime_tested": false, "scope_limitations_en": "The evaluated corpus has 23,400 functions from 130 programs. Fuzzing-based checks have finite coverage, and understandability scores depend partly on an LLM judge. The artifact warns that rebuilt OSS-Fuzz projects can differ from the paper's versions.", "scope_limitations_zh": "评估语料包含 130 个程序中的 23,400 个函数。基于模糊测试的检查覆盖有限，可理解性评分部分依赖 LLM 评审器。研究产物说明，重新构建的 OSS-Fuzz 项目可能与论文版本不同。", "targets": [ "binary" ], "title": "DecompileBench: A Comprehensive Benchmark for Evaluating Decompilers in Real-World Scenarios", "title_zh": "DecompileBench：面向真实场景的反编译器综合评测基准", "url": "https://aclanthology.org/2025.findings-acl.1194/", "venue": "Findings of ACL 2025", "verification": "source-reviewed", "verified_at": "2026-10-16", "why_fits_en": "Helps readers separate readable decompiler output from behaviorally faithful output when choosing or evaluating reverse-engineering tools.", "why_fits_zh": "帮助读者在选择或评估逆向工具时，区分输出的可读性与行为保真度。", "year": 2025 }, { "arxiv_id": null, "arxiv_version_reviewed": null, "authors": [ "Zion Leonahenahe Basque", "Samuele Doria", "Ananta Soneji", "Wil Gibbs", "Adam Doupé", "Yan Shoshitaishvili", "Eleonora Losiouk", "Ruoyu Wang", "Simone Aonzo" ], "code_url": "https://github.com/mahaloz/dec-synergy-study", "date_basis": "The Internet Society’s Crossref deposit and the official NDSS paper identify publication year 2026. The PDF footer names the 23–27 February 2026 symposium; no finer publication date is asserted from the event dates.", "date_basis_zh": "Internet Society 提交的 Crossref 元数据与 NDSS 官方论文标明出版年份为 2026。PDF 页脚标注研讨会于 2026 年 2 月 23–27 日举行；不根据会议举办日期推定更精确的出版日期。", "date_precision": "year", "description_en": "Studies how human analysts work with LLM assistance during static software reverse engineering. A survey of 153 practitioners informed six LLM features built into an instrumented IDA Pro plugin. Then 48 participants (24 self-reported novices and 24 experts) analyzed two CTF-style binaries, with the features enabled on one randomly assigned challenge. From graded writeups, interaction logs and surveys, the authors report 18 findings: novice understanding rose by about 98% to expert levels while experts gained little, known-algorithm functions were triaged up to 2.4× faster, and artifact recovery rose by at least 66%, alongside harmful hallucinations.", "description_zh": "研究人类分析人员在静态软件逆向工程中如何借助 LLM 辅助开展工作。作者依据对 153 名从业者的问卷，在带插桩的 IDA Pro 插件中实现六项 LLM 功能；随后 48 名参与者（自报新手与专家各 24 名）分析两个 CTF 风格的二进制程序，其中一道随机指定的题目启用这些功能。基于评分后的解题报告、交互日志和问卷，作者报告 18 项发现：新手的理解程度提升约 98%，达到专家水平，而专家收益甚微；已知算法函数的分诊速度最高提升 2.4 倍，产物恢复量至少增加 66%；同时也出现了有害的幻觉。", "doi": "10.14722/ndss.2026.240380", "entry_url": "https://awesomerea.org/papers/paper-decompiling-synergy/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-decompiling-synergy/", "evidence_urls": [ "https://www.ndss-symposium.org/ndss-paper/decompiling-the-synergy-an-empirical-study-of-human-llm-teaming-in-software-reverse-engineering/", "https://www.ndss-symposium.org/wp-content/uploads/2026-f380-paper.pdf", "https://doi.org/10.14722/ndss.2026.240380", "https://api.crossref.org/works/10.14722/ndss.2026.240380", "https://github.com/mahaloz/dec-synergy-study/blob/aef1c5b0f5cb5aed6661a2bd47e2d0b3225e62e2/README.md", "https://github.com/mahaloz/dec-synergy-study/blob/aef1c5b0f5cb5aed6661a2bd47e2d0b3225e62e2/LICENSE", "https://github.com/mahaloz/dec-synergy-study/blob/aef1c5b0f5cb5aed6661a2bd47e2d0b3225e62e2/infrastructure/README.md", "https://github.com/mahaloz/dec-synergy-study/blob/aef1c5b0f5cb5aed6661a2bd47e2d0b3225e62e2/infrastructure/reallm-plugin/setup.cfg", "https://github.com/mahaloz/dec-synergy-study/blob/aef1c5b0f5cb5aed6661a2bd47e2d0b3225e62e2/infrastructure/reallm-plugin/reallm/__init__.py", "https://github.com/mahaloz/dec-synergy-study/tree/aef1c5b0f5cb5aed6661a2bd47e2d0b3225e62e2/challenges" ], "first_arxiv_date": null, "id": "paper-decompiling-synergy", "kind": "research", "metadata_notes": "The nine-author order follows the PDF, the NDSS paper page and Crossref. The PDF spells ‘Adam Doupé’, while Crossref and the paper page give ‘Doupe’; the page also lists Ruoyu “Fish” Wang. The PDF footer gives ISBN 979-8-9919276-8-0 and the DOI; Crossref lists no pages, and no page range was verified. No arXiv version was found. Footnote 1 and the Open Science section link mahaloz/dec-synergy-study. Its reviewed 2026-07-22 snapshot declares BSD-2-Clause and contains both challenges (sources, binaries, IDA databases and a solver) and the study infrastructure: a pwn.college Dojo module and REaLLM, the study version of DAILA. REaLLM requires Python 3.10+, libbs 2.9.1 and dailalib 3.15.6; study functionality needs a separately licensed IDA Pro 9 installation and the user’s own OpenAI, Anthropic or Gemini API keys. The infrastructure README documents a Docker build and a dojo.patch that this snapshot does not contain. The paper reports the known-algorithm speedup as up to 2.4× in the abstract, 238% in the introduction and at least 248% for experts on four functions in Finding 7. Finding 6 calls a p = 0.4 result statistically significant, despite the paper’s α = 0.05. These figures are author-reported. No upstream code was run and no experiments were reproduced.", "metadata_notes_zh": "九位作者的顺序以 PDF、NDSS 论文页和 Crossref 为准。PDF 写作“Adam Doupé”，Crossref 与论文页写作“Doupe”；论文页还将 Ruoyu Wang 列为 Ruoyu “Fish” Wang。PDF 页脚标注 ISBN 979-8-9919276-8-0 及 DOI；Crossref 未列出页码，本条目未核实页码范围。未找到 arXiv 版本。论文脚注 1 与开放科学一节链接 mahaloz/dec-synergy-study。所审阅的 2026-07-22 快照声明采用 BSD-2-Clause，包含两道题目（源码、二进制、IDA 数据库与求解程序）及研究基础设施：一个 pwn.college Dojo 模块，以及 DAILA 的研究版本 REaLLM。REaLLM 需要 Python 3.10+、libbs 2.9.1 与 dailalib 3.15.6；要使用研究中的功能，还需另行获得许可的 IDA Pro 9 安装，以及用户自己的 OpenAI、Anthropic 或 Gemini API 密钥。基础设施 README 说明了 Docker 构建步骤和 dojo.patch，但该快照中没有这些文件。论文对已知算法加速幅度的表述不一：摘要为最高 2.4 倍，引言为 238%，发现 7 则称专家在四个函数上至少快 248%。发现 6 将 p = 0.4 的结果称为统计显著，而论文设定的显著性阈值为 α = 0.05。这些数字均由作者报告。本次未运行上游代码，也未复现实验。", "pdf_url": "https://www.ndss-symposium.org/wp-content/uploads/2026-f380-paper.pdf", "project_url": null, "publication_date": null, "publication_status": "conference-paper", "runtime_tested": false, "scope_limitations_en": "A human study of LLM-assisted analysis, not an evaluation of autonomous agents or of LLM decompilation accuracy. It uses two unobfuscated C challenges of 26 functions each, static analysis in IDA Pro only (no debuggers or symbolic execution), researcher-written prompts, and a choice of GPT-4o, GPT-4o-Mini, GPT-4-Turbo, Claude-3-5-Sonnet or Gemini-Pro. The 2024–2025 sessions retain 48 of 51 participants; expertise is self-reported, and understanding is a rubric score of writeups graded by two researchers. LLM-created artifacts were not correlated with better understanding, and three LLM users reported a nonexistent buffer overflow that an LLM had suggested; the vulnerability-finding feature was negatively correlated with understanding. Individual observations, writeups and survey responses are not released, even on request; aggregated data is available only on request.", "scope_limitations_zh": "这是一项关于 LLM 辅助分析的人类研究，并非对自主智能体或 LLM 反编译准确率的评测。研究使用两个未经混淆、各含 26 个函数的 C 语言题目，仅允许在 IDA Pro 中进行静态分析（不能使用调试器或符号执行），提示词由研究团队编写，模型可在 GPT-4o、GPT-4o-Mini、GPT-4-Turbo、Claude-3-5-Sonnet 与 Gemini-Pro 中选择。2024–2025 年的实验在 51 名参与者中保留 48 名；专业水平为自报，理解程度是由两名研究人员按评分细则给解题报告打出的分数。LLM 直接生成的产物与理解程度提升无相关性；三名 LLM 用户报告了一个由 LLM 提示、实际并不存在的缓冲区溢出，而“查找漏洞”功能与理解得分呈负相关。个人观察记录、解题报告和问卷回答均不公开，也不接受申请；汇总数据仅可申请获取。", "targets": [ "binary" ], "title": "Decompiling the Synergy: An Empirical Study of Human–LLM Teaming in Software Reverse Engineering", "title_zh": "解构协同：软件逆向工程中人类与 LLM 协作的实证研究", "url": "https://www.ndss-symposium.org/ndss-paper/decompiling-the-synergy-an-empirical-study-of-human-llm-teaming-in-software-reverse-engineering/", "venue": "NDSS 2026", "verification": "source-reviewed", "verified_at": "2026-10-18", "why_fits_en": "Measures how LLM assistance inside a decompiler changes human reverse-engineering outcomes, complementing agent-only evaluations. The paper points to DAILA, listed in the curated catalog, as the actively maintained version of its study plugin.", "why_fits_zh": "衡量反编译器内的 LLM 辅助如何改变人类逆向工程的结果，与仅评测智能体的研究互补。论文指出，精选目录收录的 DAILA 是其研究插件持续维护的版本。", "year": 2026 }, { "arxiv_id": null, "arxiv_version_reviewed": null, "authors": [ "Peiwei Hu", "Ruigang Liang", "Kai Chen" ], "citation": { "container_title": "Proceedings 2024 Network and Distributed System Security Symposium", "publisher": "Internet Society", "sources": [ "https://api.crossref.org/works/10.14722/ndss.2024.24401" ] }, "code_url": "https://github.com/PeiweiHu/DeGPT", "date_basis": "The official NDSS paper and the publisher’s Crossref deposit establish publication year 2024. The conference dates and DOI registration date do not establish a publication day.", "date_basis_zh": "NDSS 官方论文与出版方提交的 Crossref 元数据确认出版年份为 2024；会议日期与 DOI 注册日期不能据此推定具体出版日。", "date_precision": "year", "description_en": "Refines existing C-like decompiler output through three coordinated roles that select, propose and check changes. It simplifies structures, adds comments and renames variables; Micro Snippet Semantic Calculation compares simulated symbol values and calls before accepting structural changes. The authors evaluate readability and naming on 620 functions from four codebases, with separate stripped and non-stripped variants.", "description_zh": "通过三个协同角色选择、提出并检查修改，改进已有的类 C 反编译输出。其流程简化代码结构、添加注释并重命名变量，在接受结构修改前，使用微代码片段语义计算比较模拟的符号值与调用。作者以四个代码库中的 620 个函数评估可读性与命名效果，并分别测试保留与剥离符号的版本。", "doi": "10.14722/ndss.2024.24401", "entry_url": "https://awesomerea.org/papers/paper-degpt/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-degpt/", "evidence_urls": [ "https://www.ndss-symposium.org/ndss-paper/degpt-optimizing-decompiler-output-with-llm/", "https://www.ndss-symposium.org/wp-content/uploads/2024-401-paper.pdf", "https://api.crossref.org/works/10.14722/ndss.2024.24401", "https://github.com/PeiweiHu/DeGPT/blob/0f632cc52fabd70c7e7b3b9ad1ed7aef517a3714/README.md", "https://github.com/PeiweiHu/DeGPT/blob/0f632cc52fabd70c7e7b3b9ad1ed7aef517a3714/degpt/chat.py", "https://github.com/PeiweiHu/DeGPT/blob/0f632cc52fabd70c7e7b3b9ad1ed7aef517a3714/degpt/role.py", "https://github.com/PeiweiHu/DeGPT/blob/0f632cc52fabd70c7e7b3b9ad1ed7aef517a3714/degpt/mssc.py", "https://github.com/PeiweiHu/cinspector/blob/e827cfd9fccb1c5d7c4e0169c0da0bd2006de63b/README.md", "https://github.com/PeiweiHu/cinspector/blob/e827cfd9fccb1c5d7c4e0169c0da0bd2006de63b/LICENSE", "https://github.com/PeiweiHu/cinspector/blob/e827cfd9fccb1c5d7c4e0169c0da0bd2006de63b/setup.py" ], "first_arxiv_date": null, "id": "paper-degpt", "kind": "research", "metadata_notes": "The publisher and PDF agree on the title, three-author order and DOI; no arXiv identifier or proceedings page range was verified. The September 2024 artifact snapshot is later than the paper, has no release tag, and declares no project license. Its README requires manually installed cinspector, openai==1.28.1, tiktoken==0.2.0 and python-levenshtein, without a DeGPT Python minimum. Current code reads model, API key and endpoint from config.ini, differing from the README’s chat.py setup example; it uses Unix-style SIGALRM timeouts. The separately pinned cinspector dependency declares WTFPL and tree-sitter==0.20.4; this does not license DeGPT or its third-party samples. The paper primarily used gpt-3.5-turbo at temperature 0.2 and Ghidra 10.2.3. Source and dependency inspection do not establish present service compatibility; experiments were not rerun.", "metadata_notes_zh": "出版方与 PDF 的标题、三位作者顺序和 DOI 一致；未核实到 arXiv 标识符或论文集页码范围。2024 年 9 月的产物快照晚于论文，没有发布标签，也未声明项目许可证。其 README 要求手动安装 cinspector、openai==1.28.1、tiktoken==0.2.0 和 python-levenshtein，但未声明 DeGPT 所需的最低 Python 版本。当前代码从 config.ini 读取模型、API 密钥和端点，与 README 的 chat.py 配置示例不同，并采用 Unix 风格的 SIGALRM 超时机制。单独固定版本的 cinspector 依赖声明采用 WTFPL，并要求 tree-sitter==0.20.4；这不代表 DeGPT 或其中的第三方样本获得相同授权。论文主要采用温度为 0.2 的 gpt-3.5-turbo 与 Ghidra 10.2.3。源码和依赖审查不证明当前服务仍兼容，本合集未重新运行实验。", "pdf_url": "https://www.ndss-symposium.org/wp-content/uploads/2024-401-paper.pdf", "project_url": null, "publication_date": null, "publication_status": "conference-paper", "runtime_tested": false, "scope_limitations_en": "The reported 24.4% reduction is a Halstead-effort proxy on non-stripped output, not a measured reduction in human effort. The 62.9% comment result is the average non-trivial share among manually judged correct comments. MSSC is an intraprocedural heuristic: calls are abstracted and loops become branches; parsing, aliasing and path growth remain limitations. Its 80-case manual audit reports 84% accuracy and 85% recall, including three harmful changes missed. This supports assisted pseudocode comprehension, not guaranteed binary equivalence, recompilable whole programs or original-source recovery.", "scope_limitations_zh": "报告的 24.4% 降幅来自保留符号版本输出的 Halstead 工作量代理指标，并非直接测得的人力节省。62.9% 的注释结果是人工判定正确的注释中，具有非平凡信息者的平均占比。MSSC 是过程内启发式检查：调用被抽象处理，循环转化为分支；解析、别名与路径增长仍有限制。其 80 个案例的人工审查报告准确率为 84%、召回率为 85%，其中漏过三处有害修改。这支持辅助理解伪代码，不能保证二进制等价、整程序可重新编译或恢复原始源码。", "targets": [ "binary" ], "title": "DeGPT: Optimizing Decompiler Output with LLM", "title_zh": "DeGPT：使用大语言模型优化反编译器输出", "url": "https://www.ndss-symposium.org/ndss-paper/degpt-optimizing-decompiler-output-with-llm/", "venue": "NDSS 2024", "verification": "source-reviewed", "verified_at": "2026-10-17", "why_fits_en": "A concrete LLM-assisted reverse-engineering method combining readability edits with an explicitly evaluated semantic-change filter.", "why_fits_zh": "将可读性改写与经过明确评估的语义变化过滤器结合，为大语言模型辅助逆向工程提供具体方法。", "year": 2024 }, { "arxiv_id": null, "arxiv_version_reviewed": null, "authors": [ "Benjamin Bichsel", "Veselin Raychev", "Petar Tsankov", "Martin Vechev" ], "citation": { "container_title": "Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security", "pages": "343-355", "publisher": "ACM", "sources": [ "https://api.crossref.org/works/10.1145/2976749.2978422" ] }, "code_url": null, "date_basis": "ACM-deposited Crossref metadata gives print and online publication on 2016-10-24. That is also the first day of the October 24–28 conference; the date comes from the publisher record, not from the conference schedule.", "date_basis_zh": "ACM 提交的 Crossref 元数据将纸质与在线出版日期均记为 2016-10-24。该日期恰为 10 月 24—28 日会议的首日；本条目依据出版方记录，而非根据会议日程推定。", "date_precision": "day", "description_en": "DeGuard reverses layout obfuscation in Android APKs, predicting original names for the fields, methods, classes and packages that ProGuard renames. Built on Soot, it represents an app as a dependency graph over program elements and keeps Android API and other unobfuscated names fixed. It then runs MAP inference with Nice2Predict on a conditional random field learned from 1,684 F-Droid apps, under constraints that keep the renamed APK semantically equivalent. On 100 held-out F-Droid apps obfuscated with ProGuard, names identical to the originals rise from 13.3% to 79.1%, and third-party library prediction reaches 91.3% precision and 91.0% recall.", "description_zh": "DeGuard 逆转 Android APK 中的布局混淆，为被 ProGuard 重命名的字段、方法、类和包预测原始名称。它基于 Soot 将应用表示为程序元素之间的依赖图，并保持 Android API 及其他未混淆名称不变；随后在从 1,684 个 F-Droid 应用学习的条件随机场上借助 Nice2Predict 进行 MAP 推断，并以约束保证重命名后的 APK 语义等价。在 100 个留出的、经 ProGuard 混淆的 F-Droid 应用上，与原始名称完全相同的比例从 13.3% 提升至 79.1%，第三方库预测的精确率为 91.3%、召回率为 91.0%。", "doi": "10.1145/2976749.2978422", "entry_url": "https://awesomerea.org/papers/paper-deguard/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-deguard/", "evidence_urls": [ "https://dl.acm.org/doi/10.1145/2976749.2978422", "https://api.crossref.org/works/10.1145/2976749.2978422", "https://files.sri.inf.ethz.ch/website/papers/deguard.pdf", "https://www.sri.inf.ethz.ch/deguard" ], "first_arxiv_date": null, "id": "paper-deguard", "kind": "research", "metadata_notes": "ACM's Crossref deposit and the ETH-hosted author PDF agree on the title, four-author order and CCS ’16 DOI; Crossref gives pages 343–355. The paper and the SRI project page name http://apk-deguard.com as the public DeGuard service; on 2026-10-18 it redirected to HTTPS and then did not respond, so it is not linked as a working service. No DeGuard source repository was found, and code_url is null. The project page says DeGuard is built on the open-source Nice2Predict framework; that separate inference engine is not recorded as this paper's code. Nothing was run.", "metadata_notes_zh": "ACM 提交的 Crossref 元数据与 ETH 托管的作者版 PDF 在标题、四位作者顺序及 CCS ’16 DOI 上一致；Crossref 给出页码 343–355。论文与 SRI 项目页面将 http://apk-deguard.com 列为公开的 DeGuard 服务；该地址在 2026-10-18 跳转至 HTTPS 后无响应，因此未作为可用服务链接。未找到 DeGuard 源码仓库，code_url 为 null。项目页面说明 DeGuard 构建于开源的 Nice2Predict 框架之上；该独立推断引擎不作为本论文的代码记录。本次未运行任何内容。", "pdf_url": "https://files.sri.inf.ethz.ch/website/papers/deguard.pdf", "project_url": "https://www.sri.inf.ethz.ch/deguard", "publication_date": "2016-10-24", "publication_status": "conference-paper", "runtime_tested": false, "scope_limitations_en": "Only layout (identifier) obfuscation is addressed. Data, control-flow and cryptographic obfuscation, custom string encryption, reflection and goto-based code reordering are not reversed, and the paper notes that most malware samples it inspected also used such techniques. The benchmark is 100 benign, open-source F-Droid apps, obfuscated by enabling ProGuard without changing its rules and scored by exact match to the original names, so semantically close names count as errors; elements that ProGuard removed are not scored. Accuracy on other obfuscators or on malware may be lower. Libraries are identified by a package-name heuristic covering 133 libraries, and the training apps may import the same libraries. The 49-family malware study gives manual examples, such as Base64 decoders and location handling, without precision figures.", "scope_limitations_zh": "仅处理布局（标识符）混淆。数据、控制流与密码学混淆、自定义字符串加密、反射以及基于 goto 的代码重排均不在逆转范围内；论文指出，其检查的大多数恶意样本同时使用了这些技术。基准为 100 个良性开源 F-Droid 应用，通过启用 ProGuard 且不修改其规则进行混淆，并以与原始名称完全一致作为评分标准，因此语义相近的名称也计为错误；被 ProGuard 删除的元素不计分。在其他混淆器或恶意软件上的准确率可能较低。第三方库依据包名启发式规则识别，共涵盖 133 个库，训练应用也可能导入相同的库。针对 49 个恶意软件家族的研究给出 Base64 解码器、位置信息处理等人工检查示例，未报告精确率。", "targets": [ "app" ], "title": "Statistical Deobfuscation of Android Applications", "title_zh": "Android 应用的统计式反混淆", "url": "https://dl.acm.org/doi/10.1145/2976749.2978422", "venue": "ACM CCS 2016", "verification": "source-reviewed", "verified_at": "2026-10-18", "why_fits_en": "Adds learned identifier recovery for obfuscated Android packages, complementing the interface-reconstruction papers in the app section and the binary symbol-recovery research elsewhere in the bibliography.", "why_fits_zh": "补充面向混淆 Android 安装包的学习式标识符恢复方法，与应用部分的界面重建论文及本文献目录中其他二进制符号恢复研究互补。", "year": 2016 }, { "arxiv_id": "2403.03163", "arxiv_version_reviewed": "v3", "authors": [ "Chenglei Si", "Yanzhe Zhang", "Ryan Li", "Zhengyuan Yang", "Ruibo Liu", "Diyi Yang" ], "code_url": "https://github.com/NoviScl/Design2Code", "date_basis": "ACL proceedings publication month", "date_basis_zh": "ACL 会议论文集的出版月份。", "date_precision": "month", "description_en": "Evaluates reconstruction of frontend code from webpage screenshots using real-world reference pages, visual-element and layout metrics, and human assessment.", "description_zh": "使用真实网页参考、视觉元素和布局指标及人工评估，测试从网页截图重建前端代码的能力。", "doi": "10.18653/v1/2025.naacl-long.199", "entry_url": "https://awesomerea.org/papers/paper-design2code/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-design2code/", "evidence_urls": [ "https://aclanthology.org/2025.naacl-long.199/", "https://aclanthology.org/2025.naacl-long.199.pdf", "https://arxiv.org/abs/2403.03163", "https://arxiv.org/abs/2403.03163v1", "https://salt-nlp.github.io/Design2Code/", "https://github.com/NoviScl/Design2Code", "https://github.com/NoviScl/Design2Code/blob/7a575e4c33f417c4be5c64072b8f5798de0d0f99/README.md" ], "first_arxiv_date": "2024-03-05", "id": "paper-design2code", "kind": "research", "metadata_notes": "Use the final NAACL 2025 title and six-author list. arXiv v1 (2024-03-05) and the project page’s BibTeX use the earlier title “Design2Code: How Far Are We From Automating Front-End Engineering?” and list five authors without Ryan Li; v2 and the reviewed v3 match the final title and authors. SALT-NLP/Design2Code hosts the project website, whereas NoviScl/Design2Code is the verified research-code repository.", "metadata_notes_zh": "采用正式 NAACL 2025 标题及六位作者名单。arXiv v1（2024-03-05）和项目页 BibTeX 使用较早的标题“Design2Code: How Far Are We From Automating Front-End Engineering?”，只列五位作者，未含 Ryan Li；v2 和本次核对的 v3 已与正式标题及作者一致。SALT-NLP/Design2Code 托管项目网站，NoviScl/Design2Code 才是已确认的研究代码仓库。", "pdf_url": "https://aclanthology.org/2025.naacl-long.199.pdf", "project_url": "https://salt-nlp.github.io/Design2Code/", "publication_date": "2025-04", "publication_status": "conference-paper", "runtime_tested": false, "scope_limitations_en": "This is visual website reconstruction, not binary decompilation or recovery of backend behavior and interactive workflows. The main benchmark contains 484 webpages with placeholder images; code and data have separate licensing terms.", "scope_limitations_zh": "该工作属于网站视觉重建，不涉及二进制反编译，也不恢复后端行为或交互工作流。主基准含 484 个使用占位图的网页，代码与数据分别采用各自的许可条款。", "targets": [ "website" ], "title": "Design2Code: Benchmarking Multimodal Code Generation for Automated Front-End Engineering", "title_zh": "Design2Code：面向自动化前端工程的多模态代码生成评测", "url": "https://aclanthology.org/2025.naacl-long.199/", "venue": "NAACL 2025", "verification": "source-reviewed", "verified_at": "2026-10-17", "why_fits_en": "Directly supports the collection's screenshot-to-website reconstruction scope while keeping visual fidelity separate from behavioral equivalence.", "why_fits_zh": "直接支持集合中的截图到网站重建主题，并明确区分视觉相似度与行为等价性。", "year": 2025 }, { "arxiv_id": "2605.15334", "arxiv_version_reviewed": "v2", "authors": [ "Yihong Dong", "Jiaru Qian", "Haoran Zhang", "Peixu Wang", "Binhua Li", "Zhi Jin", "Yongbin Li", "Ge Li", "Xiaokang Yang", "Xue Jiang" ], "code_url": "https://github.com/JiaruQian/IO2Code", "date_basis": "Official NeurIPS 2026 poster listing confirms acceptance, not a proceedings publication date. First arXiv submission was 2026-05-14; reviewed v2 was revised on 2026-10-18.", "date_basis_zh": "NeurIPS 2026 官方海报页面确认接收，不据此认定论文集出版日期。arXiv 首投为 2026-05-14；所审阅 v2 修订于 2026-10-18。", "date_precision": "year", "description_en": "Synthesizes executable programs from input/output observations using LLM-guided evolutionary search, progressively revealed examples, simple-to-complex mutations and execution-error feedback. An active variant chooses inputs and queries a hidden reference program.", "description_zh": "通过 LLM 引导的演化搜索、逐步展示的样例、由简到繁的修改及执行错误反馈，从输入输出观察合成可执行程序；主动变体自行选择输入并查询隐藏的参考程序。", "doi": "10.48550/arxiv.2605.15334", "entry_url": "https://awesomerea.org/papers/paper-dio-agent/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-dio-agent/", "evidence_urls": [ "https://arxiv.org/abs/2605.15334", "https://arxiv.org/html/2605.15334v2", "https://api.datacite.org/dois/10.48550/arxiv.2605.15334", "https://neurips.cc/virtual/2026/loc/sydney/poster/154711", "https://github.com/JiaruQian/IO2Code/blob/ef15827ab7090bf2d227fb1eef51d91b0163339e/README.md", "https://github.com/JiaruQian/IO2Code/tree/ef15827ab7090bf2d227fb1eef51d91b0163339e" ], "first_arxiv_date": "2026-05-14", "id": "paper-dio-agent", "kind": "research", "metadata_notes": "The official poster and pinned repository retain the earlier title From I/O to Code with Discovery Agent; all ten authors match v2 and DataCite. The registered DOI identifies the arXiv work; no proceedings DOI or publication date is asserted. The paper uses the arXiv non-exclusive license. Author-linked code was checked at ef15827ab7090bf2d227fb1eef51d91b0163339e: its README documents Python 3.10+, provider credentials, benchmark/oracle tasks and experiment runners. No repository-wide code/data license was verified in the reviewed README and root tree. No generated programs, models or experiments were executed.", "metadata_notes_zh": "官方海报与固定仓库保留早期标题 From I/O to Code with Discovery Agent，十位作者与 v2 及 DataCite 一致。已注册 DOI 标识 arXiv 工作，不据此声明论文集 DOI 或出版日期。论文采用 arXiv 非独占许可。作者链接代码固定核查于 ef15827ab7090bf2d227fb1eef51d91b0163339e；README 说明 Python 3.10+、服务商凭据、基准／参考程序任务和实验入口。所审阅 README 与根目录树未核实覆盖整个仓库的代码／数据许可。本次未执行生成程序、模型或实验。", "pdf_url": "https://arxiv.org/pdf/2605.15334v2", "project_url": null, "publication_date": null, "publication_status": "conference-accepted", "runtime_tested": false, "scope_limitations_en": "IO2CodeBench has 125 generated tasks spanning basic operations, algorithms, geometry and image-to-value mappings, normally with eight visible and fifteen held-out examples. Active exploration covers a 25% subset from each level. Multimodal results average sample pass ratios, while other levels count tasks passing every held-out example. Finite test success does not establish original-source recovery or complete equivalence; arbitrary applications and stateful services are not evaluated.", "scope_limitations_zh": "IO2CodeBench 包含 125 个生成任务，覆盖基础运算、算法、几何及图像到数值的映射，通常每题提供八个可见样例和十五个留出样例。主动探索只覆盖各层级的 25% 子集。多模态结果采用样例通过比例的均值，其他层级按通过全部留出样例的任务计数。有限测试通过不代表恢复原源码或完全等价；未评测任意应用及有状态服务。", "targets": [ "app" ], "title": "Agentic Reverse Engineering: From I/O to Code with Discovery Agent", "title_zh": "智能体逆向工程：利用发现智能体从输入输出行为恢复代码", "url": "https://arxiv.org/abs/2605.15334", "venue": "NeurIPS 2026", "verification": "source-reviewed", "verified_at": "2026-10-20", "why_fits_en": "Provides a concrete observation-to-program reconstruction workflow and separates visible-example fitting from held-out behavior checks.", "why_fits_zh": "提供从行为观察到程序重建的具体流程，并区分可见样例拟合与留出行为检查。", "year": 2026 }, { "arxiv_id": "1909.09029", "arxiv_version_reviewed": "v2", "authors": [ "Jeremy Lacomis", "Pengcheng Yin", "Edward J. Schwartz", "Miltiadis Allamanis", "Claire Le Goues", "Graham Neubig", "Bogdan Vasilescu" ], "citation": { "container_title": "2019 34th IEEE/ACM International Conference on Automated Software Engineering (ASE)", "pages": "628-639", "publisher": "IEEE", "sources": [ "https://api.crossref.org/works/10.1109/ASE.2019.00064" ] }, "code_url": "https://github.com/pcyin/dire", "date_basis": "Publisher-deposited Crossref print-publication month; the 11–15 November 2019 conference dates are not used to assert a publication day.", "date_basis_zh": "采用出版方在 Crossref 登记的印刷出版月份；不以 2019 年 11 月 11—15 日的会议日期推定具体出版日。", "date_precision": "month", "description_en": "Combines lexical and structural information from decompiler output to predict meaningful variable names, with a training and evaluation corpus derived from compiled C projects.", "description_zh": "结合反编译输出中的词法与结构信息预测有意义的变量名，并使用编译 C 项目构建训练和评估语料。", "doi": "10.1109/ASE.2019.00064", "entry_url": "https://awesomerea.org/papers/paper-dire/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-dire/", "evidence_urls": [ "https://doi.org/10.1109/ASE.2019.00064", "https://api.crossref.org/works/10.1109/ASE.2019.00064", "https://arxiv.org/abs/1909.09029", "https://2019.ase-conferences.org/details/ase-2019-papers/49/DIRE-A-Neural-Approach-to-Decompiled-Identifier-Renaming", "https://github.com/pcyin/dire", "https://github.com/pcyin/dire/blob/e58c2eed4a1c72056d8ff8a7a9fc2c39a42e2a13/README.md", "https://github.com/CMUSTRUDEL/DIRTY" ], "first_arxiv_date": "2019-09-19", "id": "paper-dire", "kind": "research", "metadata_notes": "IEEE/ACM ASE 2019 proceedings, pages 628–639; the DOI resolves to IEEE Xplore document 8952404. The publisher-deposited and arXiv titles use 'Naming'; the ASE program and original code repository use the variant 'Renaming'. Both refer to this paper. Crossref lists 'Edward Schwartz'; the paper's own 'Edward J. Schwartz' is retained. Code URL is the verified original author artifact, explicitly deprecated, rather than a claim of current package support.", "metadata_notes_zh": "发表于 IEEE/ACM ASE 2019 会议论文集，页码为 628–639；该 DOI 解析至 IEEE Xplore 文档 8952404。出版方登记的标题与 arXiv 标题均使用 Naming，ASE 会议日程与原始代码仓库使用 Renaming 这一变体，均指向同一论文。Crossref 将一位作者记为 Edward Schwartz，本条目保留论文署名 Edward J. Schwartz。代码链接为已确认的原作者研究产物，已明确弃用，并不表示当前软件包仍受支持。", "pdf_url": "https://arxiv.org/pdf/1909.09029", "project_url": null, "publication_date": "2019-11", "publication_status": "conference-paper", "runtime_tested": false, "scope_limitations_en": "This is learned identifier naming, not complete source reconstruction or an autonomous agent. Its reported results concern an x86-64 C corpus and depend on decompiler output. The original author repository is deprecated and points to a successor.", "scope_limitations_zh": "该工作研究学习式标识符命名，并非完整源码重建或自主智能体。报告结果针对 x86-64 C 代码语料，并依赖反编译器输出。原作者仓库已标记弃用，并指向后续项目。", "targets": [ "binary" ], "title": "DIRE: A Neural Approach to Decompiled Identifier Naming", "title_zh": "DIRE：基于神经网络的反编译标识符命名方法", "url": "https://doi.org/10.1109/ASE.2019.00064", "venue": "ASE 2019", "verification": "source-reviewed", "verified_at": "2026-10-17", "why_fits_en": "A foundational reference for the renaming step frequently delegated to reverse-engineering assistants.", "why_fits_zh": "为逆向助手常执行的变量重命名步骤提供基础研究依据。", "year": 2019 }, { "arxiv_id": "2108.06363", "arxiv_version_reviewed": "v1", "authors": [ "Qibin Chen", "Jeremy Lacomis", "Edward J. Schwartz", "Claire Le Goues", "Graham Neubig", "Bogdan Vasilescu" ], "code_url": "https://github.com/CMUSTRUDEL/DIRTY", "date_basis": "USENIX proceedings BibTeX publication month", "date_basis_zh": "USENIX 论文集 BibTeX 记录中的出版月份。", "date_precision": "month", "description_en": "Introduces DIRTY, a Transformer model that recommends variable names and types from decompiled code and layout information, together with the DIRT corpus for training and evaluation.", "description_zh": "提出 Transformer 模型 DIRTY，根据反编译代码和布局信息推荐变量名与类型，并提供用于训练和评估的 DIRT 语料。", "doi": null, "entry_url": "https://awesomerea.org/papers/paper-dirty/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-dirty/", "evidence_urls": [ "https://www.usenix.org/conference/usenixsecurity22/presentation/chen-qibin", "https://arxiv.org/abs/2108.06363", "https://github.com/CMUSTRUDEL/DIRTY", "https://github.com/CMUSTRUDEL/DIRTY/blob/5f8e9494d52ef8788f0834342097f36462eeb2eb/README.md", "https://edmcman.github.io/papers/usenix22.pdf" ], "first_arxiv_date": "2021-08-13", "id": "paper-dirty", "kind": "research", "metadata_notes": "Year and publication month come from the final USENIX conference record; the arXiv date is not substituted for publication.", "metadata_notes_zh": "年份与出版月份来自正式 USENIX 会议记录，不以较早的 arXiv 提交日期代替。", "pdf_url": "https://arxiv.org/pdf/2108.06363", "project_url": "https://dirtdirty.github.io/explorer.html", "publication_date": "2022-08", "publication_status": "conference-paper", "runtime_tested": false, "scope_limitations_en": "The original pipeline is built around C programs and Hex-Rays output. Predicted names and types are learned hypotheses, not guaranteed original symbols. The published paper is from 2022, although its arXiv preprint first appeared in 2021.", "scope_limitations_zh": "原始流程围绕 C 程序和 Hex-Rays 输出构建。预测名称与类型是模型推断，不保证与原始符号一致。正式论文发表于 2022 年，arXiv 预印本首次提交于 2021 年。", "targets": [ "binary" ], "title": "Augmenting Decompiler Output with Learned Variable Names and Types", "title_zh": "利用学习得到的变量名称与类型增强反编译输出", "url": "https://www.usenix.org/conference/usenixsecurity22/presentation/chen-qibin", "venue": "USENIX Security 2022", "verification": "source-reviewed", "verified_at": "2026-10-16", "why_fits_en": "Extends name recovery to types, making it directly relevant to assessing semantic annotations added by binary-analysis assistants.", "why_fits_zh": "将名称恢复扩展到类型恢复，直接帮助评估二进制分析助手添加的语义注释。", "year": 2022 }, { "arxiv_id": null, "arxiv_version_reviewed": null, "authors": [ "Xing Su", "Hanzhong Liang", "Hao Wu", "Ben Niu", "Fengyuan Xu", "Sheng Zhong" ], "code_url": null, "date_basis": "The ACM article page and publisher-deposited Crossref metadata agree on publication on 2025-06-19. The PDF footer’s July 2025 issue date and the FSE conference dates are not substituted for this publication date.", "date_basis_zh": "ACM 文章页面与出版方提交的 Crossref 元数据均将出版日期列为 2025-06-19；本条目不以 PDF 页脚的 2025 年 7 月期号日期或 FSE 会议日期替代该出版日期。", "date_precision": "day", "description_en": "DiSCo lifts Ethereum contract creation bytecode to Solidity source by prompting a frozen LLM, instead of emitting decompiler pseudocode. It abstracts control-flow paths into logic-invariant semantic units, recovers constructor logic by simulating creation bytecode captured from block execution, and infers stripped names with signature databases and a type-aware graph model. These units become natural-language descriptions plus coding specifications in the prompt. GPT-4 is the primary model; Llama 3 is also tested.", "description_zh": "DiSCo 通过提示冻结参数的大语言模型，把以太坊合约的创建字节码提升为 Solidity 源码，而不是输出反编译伪代码。它将控制流路径抽象为逻辑不变的语义单元，模拟执行从区块执行中捕获的创建字节码以恢复构造函数逻辑，并借助签名数据库与类型感知图模型推断被剥离的名称。这些单元被转写为自然语言描述，并与编码规范一起放入提示词。主要模型为 GPT-4，另测试了 Llama 3。", "doi": "10.1145/3729373", "entry_url": "https://awesomerea.org/papers/paper-disco/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-disco/", "evidence_urls": [ "https://dl.acm.org/doi/10.1145/3729373", "https://dl.acm.org/doi/pdf/10.1145/3729373", "https://api.crossref.org/works/10.1145/3729373", "https://github.com/b1ue3ky/disco/tree/ee04ae812c2239a42fef8046f3c2486c36d7d296", "https://github.com/b1ue3ky/disco/blob/ee04ae812c2239a42fef8046f3c2486c36d7d296/README.md", "https://github.com/b1ue3ky/disco/blob/ee04ae812c2239a42fef8046f3c2486c36d7d296/LICENSE", "https://github.com/b1ue3ky/disco/blob/ee04ae812c2239a42fef8046f3c2486c36d7d296/disco_artifacts/datasets/d_small.csv" ], "first_arxiv_date": null, "id": "paper-disco", "kind": "research", "metadata_notes": "The six-author order follows the ACM PDF and Crossref. ACM lists article FSE103 in volume 2, issue FSE, pages 2311–2334, and licenses the paper under CC BY 4.0. No arXiv version was found. The Data Availability section points to github.com/suxnju/disco, which now redirects to b1ue3ky/disco. At the reviewed 2025-04-13 commit, that MIT-licensed repository holds dataset CSVs of contract addresses, evaluation results and user-study material, but no DiSCo implementation, so it is recorded as a project link rather than code. Contract sources and on-chain data keep their own terms. The primary model is given as GPT-4-0315-Preview. No code, prompts or experiments were run.", "metadata_notes_zh": "六位作者的顺序以 ACM PDF 与 Crossref 为准。ACM 列出第 2 卷 FSE 期、文章编号 FSE103、页码 2311–2334，并以 CC BY 4.0 授权论文。未找到 arXiv 版本。论文的数据可用性章节指向 github.com/suxnju/disco，该地址现重定向至 b1ue3ky/disco。在所审阅的 2025-04-13 提交中，这个采用 MIT 许可证的仓库包含列出合约地址的数据集 CSV、评估结果与用户研究材料，但没有 DiSCo 实现，因此记录为项目链接而非代码。合约源码与链上数据保留各自条款。论文所列主要模型为 GPT-4-0315-Preview。本次未运行代码、提示词或实验。", "pdf_url": "https://dl.acm.org/doi/pdf/10.1145/3729373", "project_url": "https://github.com/b1ue3ky/disco", "publication_date": "2025-06-19", "publication_status": "journal-article", "runtime_tested": false, "scope_limitations_en": "Ground truth comes from Etherscan source files: 200 highest-balance contracts for all baselines and 1,000 for automated tests; separate studies add 50 Vyper, 50 newly deployed and 149 closed-source attack contracts. Compilability (about 75% with best-of-five sampling, 46% for a single run), differential-fuzzing pass rates and embedding similarity do not establish equivalence to deployed source. Nearly half of the imitation-learning fuzzer’s transactions revert, and manual review judged about 28.5% of generated contracts semantically consistent, and 12% for Vyper inputs. The authors report timeouts or unsound analysis on contracts with many paths, and name inference remains weak. Baselines give the same LLM output from Panoramix, Ethervm and Elipmoc, mostly taken from their websites or decompiled manually; this is not a comparison of standalone decompilers. Results depend on a GPT-4 preview snapshot. Attack reproduction covers ten January 2025 incidents, four of which were reproduced.", "scope_limitations_zh": "真实标签来自 Etherscan 上的源码文件：200 个余额最高的合约用于全部基线，1,000 个用于自动化测试；另有独立实验使用 50 个 Vyper 合约、50 个新部署合约和 149 个闭源攻击合约。可编译率（五次采样取优约为 75%，单次运行为 46%）、差分模糊测试通过率与嵌入相似度都不能证明与已部署源码等价。模仿学习模糊测试器生成的交易近半数会回滚；人工审查认为约 28.5% 的生成合约语义一致，Vyper 输入仅为 12%。作者报告路径过多的合约会导致超时或分析不可靠，名称推断能力也仍然有限。基线是将 Panoramix、Ethervm 和 Elipmoc 的输出（多取自其网站，部分为人工反编译）交给同一大语言模型，并非独立反编译器之间的比较。结果依赖某个 GPT-4 预览版快照。攻击复现仅覆盖 2025 年 1 月的十起事件，其中四起复现成功。", "targets": [ "binary" ], "title": "DiSCo: Towards Decompiling EVM Bytecode to Source Code using Large Language Models", "title_zh": "DiSCo：利用大语言模型将 EVM 字节码反编译为源代码", "url": "https://dl.acm.org/doi/10.1145/3729373", "venue": "Proceedings of the ACM on Software Engineering (FSE 2025)", "verification": "source-reviewed", "verified_at": "2026-10-18", "why_fits_en": "Extends LLM-assisted decompilation to EVM smart-contract bytecode, recovering constructor logic and identifiers and checking results by compilation and differential execution.", "why_fits_zh": "将大语言模型辅助反编译扩展到 EVM 智能合约字节码，恢复构造函数逻辑与标识符，并通过编译和差分执行检查结果。", "year": 2025 }, { "arxiv_id": null, "arxiv_version_reviewed": null, "authors": [ "Khaled Yakdan", "Sebastian Eschweiler", "Elmar Gerhards-Padilla", "Matthew Smith" ], "code_url": null, "date_basis": "Internet Society-deposited Crossref metadata supplies only publication year 2015; the publisher PDF separately identifies the 8–11 February 2015 symposium, which is not used to assert a publication month or day.", "date_basis_zh": "Internet Society 向 Crossref 提交的元数据仅给出出版年份 2015；出版方 PDF 另列研讨会日期为 2015 年 2 月 8—11 日，本条目不据此推定出版月份或日期。", "date_precision": "year", "description_en": "DREAM is a decompiler whose control-flow structuring recovers loops, conditionals and switch statements from a recovered control-flow graph without matching predefined region patterns. For acyclic regions it computes each node's reaching condition, then refines the resulting conditions into if-then-else and switch constructs; cyclic regions are structured as loops whose type and continuation condition are inferred. Semantics-preserving transformations first rewrite cyclic regions with multiple entries or successors into single-entry, single-successor regions, and a Boolean variable keeps a repeated test equivalent when its operands may change. On GNU coreutils the authors report no goto statements, against thousands from Hex-Rays and Phoenix, and more compact code than Hex-Rays for 72.7% of functions and than Phoenix for 98.8% in one-to-one comparisons.", "description_zh": "DREAM 是一种反编译器，其控制流结构化方法无需匹配预定义的区域模式，即可从恢复出的控制流图中还原循环、条件语句与 switch 语句。对于无环区域，它计算每个节点的可达条件，再将这些条件细化为 if-then-else 与 switch 结构；有环区域被结构化为循环，并推断循环类型及继续条件。语义保持变换先将具有多个入口或多个后继的有环区域改写为单入口、单后继区域；当重复测试的条件中变量可能被修改时，引入布尔变量以保持语义等价。作者在 GNU coreutils 上报告其输出不含 goto 语句，而 Hex-Rays 与 Phoenix 各产生数千个；在一对一比较中，DREAM 有 72.7% 的函数比 Hex-Rays 更紧凑，与 Phoenix 相比该比例为 98.8%。", "doi": "10.14722/ndss.2015.23185", "entry_url": "https://awesomerea.org/papers/paper-dream/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-dream/", "evidence_urls": [ "https://www.ndss-symposium.org/ndss2015/ndss-2015-programme/no-more-gotos-decompilation-using-pattern-independent-control-flow-structuring-and-semantics/", "https://api.crossref.org/works/10.14722/ndss.2015.23185", "https://www.ndss-symposium.org/wp-content/uploads/2017/09/11_4_2.pdf" ], "first_arxiv_date": null, "id": "paper-dream", "kind": "research", "metadata_notes": "Crossref gives the title, the four-author order and year 2015 with no pages; the DOI resolves to the NDSS programme page, which links the 15-page PDF and slides. The PDF footer identifies NDSS ’15, 8–11 February 2015, San Diego, and carries the DOI. Its evaluation section names a supplemental document of decompiled malware listings hosted at the University of Bonn; it was not reviewed. The paper gives no code or project link, so both stay null, and nothing was downloaded or run apart from the paper.", "metadata_notes_zh": "Crossref 给出标题、四位作者顺序及年份 2015，未列页码；DOI 解析至 NDSS 会议议程页面，该页面链接 15 页 PDF 与幻灯片。PDF 页脚标明 NDSS ’15 于 2015 年 2 月 8—11 日在圣迭戈举行，并载有 DOI。评测部分提到一份托管在波恩大学的补充文档，收录反编译后的恶意软件代码清单，本次未审阅。论文未提供代码或项目链接，因此两者均为 null；除论文外未下载或运行任何内容。", "pdf_url": "https://www.ndss-symposium.org/wp-content/uploads/2017/09/11_4_2.pdf", "project_url": null, "publication_date": null, "publication_status": "conference-paper", "runtime_tested": false, "scope_limitations_en": "Correctness was measured on source-level control-flow graphs: the authors extracted CFGs of the preprocessed coreutils 8.22 source with joern, restructured the 1,530 functions joern parsed (208 of 1,738 failed to parse), recompiled and passed the coreutils tests. That experiment checks the structuring algorithm, not end-to-end decompilation of binaries, variable or type recovery. Structuredness and compactness were measured on the coreutils 8.17 binaries from the Phoenix evaluation, using functions decompiled by all three tools, with line counts as the compactness metric. Phoenix was unreleased, so its output came from its authors, and the 2014 Hex-Rays v2.0.0.140605 baseline is long superseded. The malware case studies cover one sample each from ZeusP2P, SpyEye and Cridex and compare against Hex-Rays only. The authors leave open whether more compact code is always easier to understand. The paper links no implementation, and these results do not describe current decompilers.", "scope_limitations_zh": "正确性在源码级控制流图上评估：作者使用 joern 从经过预处理的 coreutils 8.22 源码中提取控制流图，对 joern 成功解析的 1,530 个函数重新结构化（1,738 个函数中有 208 个解析失败），重新编译后通过 coreutils 测试。该实验检验的是结构化算法，而不是对二进制的端到端反编译，也不涉及变量或类型恢复。结构化程度与紧凑度在 Phoenix 评测所用的 coreutils 8.17 二进制上测量，只统计三种工具都能反编译的函数，并以代码行数衡量紧凑度。Phoenix 当时尚未发布，其输出由其作者提供；2014 年的 Hex-Rays v2.0.0.140605 基线早已过时。恶意软件案例分析分别覆盖 ZeusP2P、SpyEye 与 Cridex 各一个样本，且只与 Hex-Rays 比较。作者也指出，更紧凑的代码是否总是更易理解仍有待研究。论文没有链接实现，这些结果也不代表当前反编译器的表现。", "targets": [ "binary" ], "title": "No More Gotos: Decompilation Using Pattern-Independent Control-Flow Structuring and Semantics-Preserving Transformations", "title_zh": "告别 goto：基于模式无关控制流结构化与语义保持变换的反编译", "url": "https://www.ndss-symposium.org/ndss2015/ndss-2015-programme/no-more-gotos-decompilation-using-pattern-independent-control-flow-structuring-and-semantics/", "venue": "NDSS 2015", "verification": "source-reviewed", "verified_at": "2026-10-19", "why_fits_en": "Adds control-flow structuring, the decompiler stage that turns a recovered control-flow graph into structured high-level code, beneath the collection's neural and LLM-based decompilation research.", "why_fits_zh": "补充控制流结构化这一反编译阶段，即把恢复出的控制流图转换为结构化高级代码，为合集中的神经网络与大语言模型反编译研究提供基础。", "year": 2015 }, { "arxiv_id": null, "arxiv_version_reviewed": null, "authors": [ "Zhengxiong Luo", "Kai Liang", "Yanyang Zhao", "Feifan Wu", "Junze Yu", "Heyuan Shi", "Yu Jiang" ], "code_url": null, "date_basis": "Internet Society-deposited Crossref metadata supplies only publication year 2024; the publisher PDF separately identifies the 26 February–1 March 2024 symposium, which is not used to assert a publication month or day.", "date_basis_zh": "Internet Society 向 Crossref 提交的元数据仅给出出版年份 2024；出版方 PDF 另列研讨会日期为 2024 年 2 月 26 日至 3 月 1 日，本条目不据此推定出版月份或日期。", "date_precision": "year", "description_en": "DynPRE starts from captured client–server traces and then interacts with a live protocol server to infer message formats and types. It detects session-specific identifiers such as cookies and rewrites them on the fly so that replayed requests stay valid. It then sends byte-level probe requests whose responses serve as semantic feedback for field identification, aligns the responses, and applies a request–response mapping refinement that also recognizes message types. On 12 protocols with 10-, 100- and 1,000-message datasets, the authors report average field perfection of 0.50 and message-type V-measure of 0.94, against 0.15–0.31 perfection for Netzob, NetPlier, FieldHunter, BinaryInferno and NEMESYS.", "description_zh": "DynPRE 以捕获的客户端—服务端流量为起点，再与在线协议服务端交互，推断报文格式与类型。它检测 Cookie 等会话特定标识符并实时改写，使重放的请求保持有效；随后发送字节级探测请求，以服务端响应作为字段识别的语义反馈，对响应进行对齐分析，并通过请求—响应映射细化格式，同时识别报文类型。作者在 12 种协议、规模分别为 10、100 与 1,000 条报文的数据集上，报告平均字段完美分割率为 0.50、报文类型 V-measure 为 0.94，而 Netzob、NetPlier、FieldHunter、BinaryInferno 与 NEMESYS 的完美分割率为 0.15–0.31。", "doi": "10.14722/ndss.2024.24083", "entry_url": "https://awesomerea.org/papers/paper-dynpre/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-dynpre/", "evidence_urls": [ "https://www.ndss-symposium.org/ndss-paper/dynpre-protocol-reverse-engineering-via-dynamic-inference/", "https://www.ndss-symposium.org/wp-content/uploads/2024-83-paper.pdf", "https://api.crossref.org/works/10.14722/ndss.2024.24083", "https://doi.org/10.14722/ndss.2024.24083", "https://github.com/DynPRE/DynPRE/blob/3a0fdcef1d9245db6bc0a4e25f66d04e34d14bca/README.md" ], "first_arxiv_date": null, "id": "paper-dynpre", "kind": "research", "metadata_notes": "The NDSS paper page lists the seven authors with affiliations and links the PDF and slides; Crossref gives the same author order and only the year 2024. The PDF footer gives the 26 February–1 March 2024 symposium in San Diego, ISBN 1-891562-93-2 and the DOI. No arXiv version was found. The paper says DynPRE is available at github.com/DynPRE/DynPRE, but the reviewed 2025-08-27 snapshot contains only a README asking readers to contact the authors by email for the code and declares no license. code_url is therefore null, and no public implementation is claimed. The paper ran the baselines from public releases, using a public re-implementation for FieldHunter. Nothing was run for this review.", "metadata_notes_zh": "NDSS 论文页面列出七位作者及其单位，并链接 PDF 与演示幻灯片；Crossref 给出相同的作者顺序，仅记载年份 2024。PDF 页脚标明研讨会于 2024 年 2 月 26 日至 3 月 1 日在圣迭戈举行，并载有 ISBN 1-891562-93-2 与 DOI。未找到 arXiv 版本。论文称 DynPRE 可在 github.com/DynPRE/DynPRE 获取，但所审阅的 2025-08-27 快照仅有一份 README，请读者通过电子邮件联系作者获取代码，且未声明许可证。因此 code_url 为 null，本条目不声称存在公开实现。论文的基线工具来自公开版本，其中 FieldHunter 使用公开的重新实现。本次审阅未运行任何内容。", "pdf_url": "https://www.ndss-symposium.org/wp-content/uploads/2024-83-paper.pdf", "project_url": null, "publication_date": null, "publication_status": "conference-paper", "runtime_tested": false, "scope_limitations_en": "The method needs captured traces plus a reachable server that it can query repeatedly; it does not work from passive captures alone. Probing changes server state: each probe opens a new session, but protocols with global state, such as IoT device power state, can still degrade feedback. On the 1,000-message datasets an analysis averaged 259 minutes, 50,344 connection attempts and about 3.98 million exchanged messages, so slow or rate-limiting servers reduce efficiency. Encryption and authentication were disabled in the open-source evaluation setups, and encrypted traffic in the IoT case studies was decrypted with device private keys. Checksummed protocols need an added checksum-reversal step, shown only on ICMP. Format ground truth comes from tshark dissectors, and message types from manual reading of protocol documents. The five-device IoT case studies test whether generated messages trigger device behaviors, not whether specifications are complete. State-machine inference reuses existing methods and is not evaluated as a contribution.", "scope_limitations_zh": "该方法需要捕获流量以及可被反复查询的可达服务端，无法仅凭被动捕获流量工作。探测会改变服务端状态：每次探测都会新建会话，但具有全局状态的协议（如 IoT 设备的开关状态）仍可能降低反馈质量。在 1,000 条报文的数据集上，单次分析平均耗时 259 分钟，平均发起 50,344 次连接、交换约 398 万条报文，因此低速或限流的服务端会降低效率。在开源评测环境中，加密与认证机制均被关闭；IoT 案例研究中的加密流量则借助设备私钥解密。带校验和的协议需要额外的校验和逆向步骤，且仅在 ICMP 上演示。格式真实标签来自 tshark 解析器，报文类型则来自人工阅读协议文档。针对五台设备的 IoT 案例研究检验生成的报文能否触发设备行为，而非规范是否完整。状态机推断沿用已有方法，并未作为贡献加以评估。", "targets": [ "protocol" ], "title": "DynPRE: Protocol Reverse Engineering via Dynamic Inference", "title_zh": "DynPRE：基于动态推断的协议逆向工程", "url": "https://www.ndss-symposium.org/ndss-paper/dynpre-protocol-reverse-engineering-via-dynamic-inference/", "venue": "NDSS 2024", "verification": "source-reviewed", "verified_at": "2026-10-18", "why_fits_en": "Adds active, server-interactive protocol inference, complementing the trace-only, binary-assisted and source-based protocol reconstruction research in this section.", "why_fits_zh": "补充主动与服务端交互的协议推断方法，与本节中仅基于流量、借助二进制及基于源码的协议重建研究互补。", "year": 2024 }, { "arxiv_id": "2609.18706", "arxiv_version_reviewed": "v1", "authors": [ "Jun Bi", "Xiangxin Fang", "Aarsh Chaube", "José Wesley De Souza Magalhães", "Rodrigo C. O. Rocha", "Michael O'Boyle" ], "code_url": null, "date_basis": "First arXiv submission date from the reviewed submission history; no formal publication was verified.", "date_basis_zh": "采用已核对的 arXiv 首次提交日期；尚未核实正式出版信息。", "date_precision": "day", "description_en": "Echo iteratively generates source and compiler configurations, recompiles candidates, and uses assembly differences to guide configuration search and code refinement. It evaluates matching on function benchmarks and selected functions from a Mirai binary.", "description_zh": "Echo 迭代生成源码及编译配置，重新编译候选，并使用汇编差异指导配置搜索与代码修正。研究在函数基准和一个 Mirai 二进制的部分函数上评估匹配结果。", "doi": null, "entry_url": "https://awesomerea.org/papers/paper-echo-matching-decompilation/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-echo-matching-decompilation/", "evidence_urls": [ "https://arxiv.org/abs/2609.18706v1", "https://arxiv.org/html/2609.18706v1" ], "first_arxiv_date": "2026-09-16", "id": "paper-echo-matching-decompilation", "kind": "research", "metadata_notes": "Latest reviewed version is arXiv v1. The Open Science section uses the placeholder anonymous.4open.science/xxxx, so no usable author artifact, model revision or code/data license was verified. The article uses the arXiv non-exclusive distribution license. No upstream code, models or malware were downloaded or run.", "metadata_notes_zh": "最新核对版本为 arXiv v1。开放科学段落使用 anonymous.4open.science/xxxx 占位链接，尚未核实可用的作者产物、模型版本或代码／数据许可。文章采用 arXiv 非独占传播许可。本次未下载或运行上游代码、模型或恶意程序。", "pdf_url": "https://arxiv.org/pdf/2609.18706v1", "project_url": null, "publication_date": "2026-09-16", "publication_status": "preprint", "runtime_tested": false, "scope_limitations_en": "Matching means equality of normalized function assembly under evaluated compilation settings, not byte-for-byte recovery of a whole executable. Tests cover selected x86 GCC/LLVM settings and 62 Mirai functions; passing finite harness tests is not a general equivalence proof. Long optimized functions and configurations outside the searched space remain limitations.", "scope_limitations_zh": "匹配指评估配置下归一化函数汇编相同，并非逐字节恢复完整可执行文件。测试覆盖选定的 x86 GCC／LLVM 设置及 62 个 Mirai 函数；通过有限测试框架不是一般等价证明。较长的优化函数及搜索空间外的编译配置仍是限制。", "targets": [ "binary" ], "title": "Echo: Learning-based Matching Decompilation using Trusted Back Translation", "title_zh": "Echo：基于可信回译的学习式匹配反编译", "url": "https://arxiv.org/abs/2609.18706", "venue": "arXiv", "verification": "source-reviewed", "verified_at": "2026-10-20", "why_fits_en": "Adds compiler-feedback-driven matching decompilation while separating its matching criterion from test-only recovery.", "why_fits_zh": "补充由编译反馈驱动的匹配反编译，并区分其匹配标准与仅依据测试的恢复判断。", "year": 2026 }, { "arxiv_id": null, "arxiv_version_reviewed": null, "authors": [ "David Williams-King", "Hidenori Kobayashi", "Kent Williams-King", "Graham Patterson", "Frank Spano", "Yu Jian Wu", "Junfeng Yang", "Vasileios P. Kemerlis" ], "code_url": "https://github.com/columbia/egalito", "date_basis": "ACM-deposited Crossref print-publication date; the online-publication date is recorded separately in metadata notes. The March 16–20 conference dates are not used.", "date_basis_zh": "采用 ACM 在 Crossref 登记的印刷出版日期；在线出版日期在元数据说明中单独记录。本条目不采用 3 月 16—20 日的会议日期。", "date_precision": "day", "description_en": "Egalito statically recompiles stripped x86-64 and ARM64 binaries, using the metadata that position-independent executables and libraries carry to recover a complete disassembly in which every code and data cross-reference becomes an explicit link. Its layout-agnostic intermediate representation, EIR, stays close to machine code, so regenerated output is predictable, while a higher-level view supports analysis; data-flow analyses infer jump tables, which have no metadata. Because the original layout imposes no constraints, tools can move or rewrite code freely; the authors build nine, including continuous code randomization in which Egalito transforms itself, a retpoline defense, and software emulation of Intel CET. They report recovering the compiler's jump tables in 866 of 867 executables and libraries from 172 Debian packages, all tests passing in 90 of 149 transformed packages, and a 1.7% speedup on SPEC CPU 2006.", "description_zh": "Egalito 对去除符号的 x86-64 与 ARM64 二进制进行静态重编译，借助位置无关的可执行文件和库所携带的元数据，恢复完整的反汇编，使每一处代码与数据交叉引用都成为显式链接。其与布局无关的中间表示 EIR 贴近机器码，因此重新生成的输出可预测，同时提供更高层的视图用于分析；对于没有元数据的跳转表，则借助数据流分析推断。由于不受原始布局约束，工具可以自由移动或改写代码；作者构建了九种工具，包括由 Egalito 变换自身的持续代码随机化、retpoline 防御以及 Intel CET 的软件模拟。作者报告，在来自 172 个 Debian 软件包的 867 个可执行文件与库中，有 866 个的跳转表与编译器给出的真实结果一致；变换后的 149 个软件包中有 90 个通过全部测试；在 SPEC CPU 2006 上性能提升 1.7%。", "doi": "10.1145/3373376.3378470", "entry_url": "https://awesomerea.org/papers/paper-egalito/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-egalito/", "evidence_urls": [ "https://dl.acm.org/doi/10.1145/3373376.3378470", "https://api.crossref.org/works/10.1145/3373376.3378470", "https://www.cs.columbia.edu/~junfeng/papers/egalito-asplos20.pdf", "https://github.com/columbia/egalito/blob/c5bccb4a13dc0dea7beb5751dd4f334280b36b91/README", "https://github.com/columbia/egalito/blob/c5bccb4a13dc0dea7beb5751dd4f334280b36b91/LICENSE" ], "first_arxiv_date": null, "id": "paper-egalito", "kind": "research", "metadata_notes": "ACM metadata records print publication on 2020-03-09 and online publication on 2020-03-13, pages 133–147, with the eight-author order shown here; Crossref splits the title into “Egalito” and the subtitle “Layout-Agnostic Binary Recompilation”. The Columbia-hosted PDF is the 15-page ACM-formatted version with the DOI. The paper says Egalito is released under GPL v3 at egalito.org, which did not respond over HTTP or HTTPS on 2026-10-19, so project_url stays null. The reviewed columbia/egalito commit (2020-06-01; the repository was last pushed 2023-08-01) is GPL-3.0; its README describes x86_64 and aarch64 support with experimental RISC-V and builds with make and g++ on Debian-style systems. Nothing was built or run.", "metadata_notes_zh": "ACM 元数据记载印刷出版于 2020-03-09，在线出版于 2020-03-13，页码为 133–147，八位作者顺序如本条目所列；Crossref 将标题拆分为“Egalito”与副标题“Layout-Agnostic Binary Recompilation”。哥伦比亚大学托管的 PDF 是带 DOI 的 15 页 ACM 排版版本。论文称 Egalito 以 GPL v3 发布于 egalito.org，该网站在 2026-10-19 无法通过 HTTP 或 HTTPS 访问，因此 project_url 为 null。所审阅的 columbia/egalito 提交（2020-06-01；仓库最后推送于 2023-08-01）采用 GPL-3.0 许可；其 README 说明支持 x86_64 与 aarch64、RISC-V 支持仍属实验性，并在 Debian 类系统上以 make 与 g++ 构建。本次未构建或运行任何内容。", "pdf_url": "https://www.cs.columbia.edu/~junfeng/papers/egalito-asplos20.pdf", "project_url": null, "publication_date": "2020-03-09", "publication_status": "conference-paper", "runtime_tested": false, "scope_limitations_en": "Egalito requires position-independent code for sufficient metadata; non-PIC inputs are outside the method except where full relocations are supplied, as in the authors' Fuchsia kernel experiment. Jump-table recovery uses data-flow analysis and an adjacency heuristic, so disassembly is not guaranteed to be complete; the one failure in the Debian study was heavily nested jump tables. The authors list obfuscated code, inline assembly that embeds data in code symbols, C++ exceptions, symbol versioning, and Go or V8 binaries among unsupported cases. Package test failures are partly attributed to these features. RISC-V support was incomplete at publication. The columbia/egalito main branch has had no commits since June 2020, so no current maintenance is implied.", "scope_limitations_zh": "Egalito 依赖位置无关代码提供足够的元数据；除非像作者对 Fuchsia 内核的实验那样提供完整重定位信息，非位置无关的输入不在该方法范围内。跳转表恢复依靠数据流分析和相邻性启发式，因此不能保证反汇编完整；Debian 研究中唯一的失败案例是深度嵌套的跳转表。作者列出的不支持情形包括混淆代码、将数据嵌入代码符号的内联汇编、C++ 异常、符号版本控制，以及 Go 或 V8 二进制。部分软件包测试失败即归因于这些特性。论文发表时 RISC-V 支持尚未完成。columbia/egalito 的主分支自 2020 年 6 月以来没有新提交，因此不代表项目仍在维护。", "targets": [ "binary" ], "title": "Egalito: Layout-Agnostic Binary Recompilation", "title_zh": "Egalito：与布局无关的二进制重编译", "url": "https://dl.acm.org/doi/10.1145/3373376.3378470", "venue": "ASPLOS 2020", "verification": "source-reviewed", "verified_at": "2026-10-19", "why_fits_en": "Adds static whole-binary recompilation, which regenerates a working program from a recovered low-level IR without the original layout, complementing the collection's decompilation and lifting research.", "why_fits_zh": "补充静态整体二进制重编译研究：在不保留原始布局的前提下，从恢复出的低层中间表示重新生成可运行程序，与合集中的反编译及提升研究互补。", "year": 2020 }, { "arxiv_id": "2409.16165", "arxiv_version_reviewed": "v3", "authors": [ "Talor Abramovich", "Meet Udeshi", "Minghao Shao", "Kilian Lieret", "Haoran Xi", "Kimberly Milner", "Sofija Jancheska", "John Yang", "Carlos E Jimenez", "Farshad Khorrami", "Prashanth Krishnamurthy", "Brendan Dolan-Gavitt", "Muhammad Shafique", "Karthik R Narasimhan", "Ramesh Karri", "Ofir Press" ], "code_url": "https://github.com/SWE-agent/SWE-agent/tree/v0.7", "date_basis": "PMLR states that Volume 267 was published on 06 October 2025, matching the paper page’s citation_publication_date of 2025/10/06. The 13–19 July 2025 conference dates are not used.", "date_basis_zh": "PMLR 说明第 267 卷于 2025 年 10 月 6 日出版，与论文页面 citation_publication_date 所载 2025/10/06 一致；本条目不采用 2025 年 7 月 13–19 日的会议日期。", "date_precision": "day", "description_en": "EnIGMA extends SWE-agent for capture-the-flag challenges with interactive agent tools that keep a gdb debugging session or a pwntools server connection open across turns, alongside decompile and disassemble commands, an LM summarizer for long outputs, and category-specific demonstrations and guidelines. It is evaluated with four LMs on 390 challenges from NYU CTF, InterCode-CTF, Cybench and a HackTheBox set the authors collected. The paper ablates tools, summarizers and demonstrations, and analyzes solution leakage and “soliloquizing”, where the model writes its own observations instead of acting in the environment.", "description_zh": "EnIGMA 在 SWE-agent 基础上面向 CTF 题目进行扩展：交互式智能体工具可在多轮之间保持 gdb 调试会话或 pwntools 服务器连接，另有反编译与反汇编命令、用于长输出的语言模型摘要器，以及按题目类别编写的示例和指导。论文使用四种语言模型，在 NYU CTF、InterCode-CTF、Cybench 及作者收集的 HackTheBox 题集共 390 道题目上评测；还对工具、摘要器和示例做消融实验，并分析解答泄露和“自言自语”（soliloquizing）现象，即模型不与环境交互而自行编写观察结果。", "doi": null, "entry_url": "https://awesomerea.org/papers/paper-enigma/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-enigma/", "evidence_urls": [ "https://proceedings.mlr.press/v267/abramovich25a.html", "https://raw.githubusercontent.com/mlresearch/v267/main/assets/abramovich25a/abramovich25a.pdf", "https://proceedings.mlr.press/v267/", "https://arxiv.org/abs/2409.16165", "https://arxiv.org/abs/2409.16165v3", "https://enigma-agent.com/", "https://github.com/SWE-agent/SWE-agent/blob/084d5d164729ddcbe8fbc05877ead403549ef669/README.md", "https://github.com/SWE-agent/SWE-agent/blob/084d5d164729ddcbe8fbc05877ead403549ef669/LICENSE", "https://github.com/SWE-agent/SWE-agent/blob/084d5d164729ddcbe8fbc05877ead403549ef669/docs/usage/enigma.md", "https://github.com/SWE-agent/SWE-agent/blob/3ea751c087f32b16e039a2233dd6eefecef325d5/README.md", "https://github.com/enigma-agent/trajectories/blob/431dda6896b261ecebf658a5e6fc05ee695efe76/LICENSE", "https://github.com/enigma-agent/benchmarks/blob/c632a3c5d08f5f35eedc57f8c7a57be78defc013/README.md" ], "first_arxiv_date": "2024-09-24", "id": "paper-enigma", "kind": "research", "metadata_notes": "The 16-author order follows the PMLR page and the arXiv record; the PMLR metadata writes ‘Carlos E Jimenez’ and ‘Karthik R Narasimhan’, while the PDF prints ‘Carlos E. Jimenez’ and ‘Karthik Narasimhan’. PMLR lists pages 246–355 and no DOI; the arXiv v3 comment reads ‘ICML 2025’. The SWE-agent README still cites the earlier arXiv title ‘EnIGMA: Enhanced Interactive Generative Model Agent for CTF Challenges’. PMLR’s software link is the moving v0.7 branch; the reviewed head 084d5d1 (2025-04-28) is MIT-licensed and documents running challenges with Docker image sweagent/enigma:latest. The current main README says to use SWE-agent 0.7 while EnIGMA is updated for 1.0. The project site links trajectories (MIT); the separate benchmarks repository reformats Cybench and InterCode-CTF only and leaves their copyright with the original creators, so it does not supply the HackTheBox set. Table 9 reports the NYU-agent overall rates as 3.00 and 4.00 in the reverse order of the main text. No code or experiments were run.", "metadata_notes_zh": "16 位作者的顺序以 PMLR 页面和 arXiv 记录为准；PMLR 元数据写作“Carlos E Jimenez”和“Karthik R Narasimhan”，PDF 印作“Carlos E. Jimenez”和“Karthik Narasimhan”。PMLR 列出页码 246–355，未提供 DOI；arXiv v3 备注为“ICML 2025”。SWE-agent README 仍引用较早的 arXiv 标题“EnIGMA: Enhanced Interactive Generative Model Agent for CTF Challenges”。PMLR 的软件链接指向会变动的 v0.7 分支；所审阅的分支头 084d5d1（2025-04-28）采用 MIT 许可证，并说明使用 Docker 镜像 sweagent/enigma:latest 运行题目。当前 main 分支 README 称，在 EnIGMA 更新至 1.0 期间应使用 SWE-agent 0.7。项目网站链接了运行轨迹（MIT）；另一个基准仓库仅重新格式化了 Cybench 与 InterCode-CTF，版权仍归原作者，因此并未提供 HackTheBox 题集。表 9 中 NYU 智能体的总体解题率 3.00 与 4.00 与正文所述顺序相反。本次未运行代码或实验。", "pdf_url": "https://raw.githubusercontent.com/mlresearch/v267/main/assets/abramovich25a/abramovich25a.pdf", "project_url": "https://enigma-agent.com/", "publication_date": "2025-10-06", "publication_status": "conference-paper", "runtime_tested": false, "scope_limitations_en": "The benchmarks mix cryptography, forensics, pwn, reverse engineering, web and miscellaneous tasks (104 of the 390 are reverse engineering), so aggregate solve rates such as 13.5% on NYU CTF are not reverse-engineering accuracy. The per-category table reports 17.65% on NYU CTF’s 51 reverse-engineering challenges with Claude 3.5 Sonnet. Results are pass@1 with a $3 per-instance cost cap and 2024 models (GPT-4 Turbo, GPT-4o, Claude 3.5 Sonnet and LLaMA 3.1 405B Instruct); the NYU CTF baseline comparison uses pass@5. Many challenges have public write-ups, and the authors’ leakage and soliloquy measures are heuristics; on 21 later CSAW 2024 challenges the best configurations solved 2. Solving a CTF shows a captured flag, not recovered program structure or source.", "scope_limitations_zh": "各基准混合了密码学、取证、二进制漏洞利用、逆向工程、Web 与杂项任务（390 道题中有 104 道为逆向工程），因此 NYU CTF 上 13.5% 等总体解题率并不等于逆向工程准确率。分类别表格报告，使用 Claude 3.5 Sonnet 时，NYU CTF 中 51 道逆向工程题的解题率为 17.65%。结果采用 pass@1，每道题成本上限为 3 美元，使用 2024 年的模型（GPT-4 Turbo、GPT-4o、Claude 3.5 Sonnet 与 LLaMA 3.1 405B Instruct）；NYU CTF 基线对比采用 pass@5。许多题目存在公开题解，作者对泄露和“自言自语”的度量属于启发式方法；在 21 道较晚发布的 CSAW 2024 题目上，最佳配置解出 2 道。解出 CTF 题目表明获得了 flag，而非恢复了程序结构或源码。", "targets": [ "binary" ], "title": "EnIGMA: Interactive Tools Substantially Assist LM Agents in Finding Security Vulnerabilities", "title_zh": "EnIGMA：交互式工具显著帮助语言模型智能体发现安全漏洞", "url": "https://proceedings.mlr.press/v267/abramovich25a.html", "venue": "ICML 2025", "verification": "source-reviewed", "verified_at": "2026-10-18", "why_fits_en": "Evaluates how interactive debugger and connection tools change agent performance on CTF tasks that include reverse engineering, complementing the reverse-engineering-specific benchmarks in this section.", "why_fits_zh": "评估交互式调试和连接工具如何影响智能体在包含逆向工程的 CTF 任务上的表现，与本节中专门针对逆向工程的基准互补。", "year": 2025 }, { "arxiv_id": "2608.24955", "arxiv_version_reviewed": "v1", "authors": [ "Omar Abusabha", "Sungjae Hwang" ], "code_url": null, "date_basis": "First arXiv submission date; no separate proceedings or journal publication was verified.", "date_basis_zh": "采用 arXiv 首次提交日期；未核实另行出版的会议论文集或期刊版本。", "date_precision": "day", "description_en": "This survey maps traditional, dynamic, matching and neural decompilation approaches, then organizes type recovery, control-flow restructuring, naming and refinement tasks alongside evaluation metrics and benchmark choices. An accompanying repository provides the reviewed literature list.", "description_zh": "该综述梳理传统、动态、匹配及神经反编译方法，并组织类型恢复、控制流重构、命名和改进等任务及其评估指标、基准选择。配套仓库提供所审文献列表。", "doi": null, "entry_url": "https://awesomerea.org/papers/paper-evolution-binary-decompilation/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-evolution-binary-decompilation/", "evidence_urls": [ "https://arxiv.org/abs/2608.24955v1", "https://arxiv.org/html/2608.24955v1", "https://lion10.github.io/", "https://github.com/lion10/csur2026_binary_decompilation/blob/e733872b892148660737926743dcbd864af86f6c/README.md", "https://github.com/lion10/csur2026_binary_decompilation/blob/e733872b892148660737926743dcbd864af86f6c/papers.csv", "https://api.github.com/repos/lion10/csur2026_binary_decompilation/git/trees/6895d55f00b8520ec345d0380c0efa65969462dc" ], "first_arxiv_date": "2026-08-25", "id": "paper-evolution-binary-decompilation", "kind": "research", "metadata_notes": "The manuscript says under review at ACM Computing Surveys; this is not treated as acceptance or journal publication. The paper is CC BY 4.0. The pinned repository has a README and 72-row bibliography CSV, not a decompiler implementation; no separate repository license was established. No cited tools were executed.", "metadata_notes_zh": "手稿写正在 ACM Computing Surveys 审稿，不视为已录用或期刊出版。论文采用 CC BY 4.0。固定仓库包含 README 与 72 行文献 CSV，并非反编译器实现；尚未确立独立仓库许可。本次未运行所引工具。", "pdf_url": "https://arxiv.org/pdf/2608.24955v1", "project_url": "https://github.com/lion10/csur2026_binary_decompilation", "publication_date": "2026-08-25", "publication_status": "preprint", "runtime_tested": false, "scope_limitations_en": "The search ends in December 2025 and focuses on peer-reviewed studies of C-origin binaries. Selection and categorization involve manual judgment. Reported tool capabilities reflect surveyed publications, not necessarily current implementations. It is a literature synthesis, not a newly reproduced cross-tool performance benchmark or a complete account of 2026 preprints.", "scope_limitations_zh": "文献搜索截止 2025 年 12 月，重点是源自 C 的二进制及经过同行评审的研究。筛选和分类含人工判断。工具能力描述反映所审出版物，不必然对应当前实现。这是文献综合，而非新近复现的跨工具性能基准，也不是完整的 2026 年预印本汇总。", "targets": [ "binary" ], "title": "The Evolution of Binary Decompilation in the Modern Era: A Taxonomy, Literature Review, and Future Perspectives", "title_zh": "现代二进制反编译的演进：分类体系、文献回顾与未来展望", "url": "https://arxiv.org/abs/2608.24955", "venue": "arXiv", "verification": "source-reviewed", "verified_at": "2026-10-20", "why_fits_en": "Provides a structured map for finding decompilation techniques, benchmarks and the assumptions behind their evaluation.", "why_fits_zh": "为检索反编译技术、基准及其评估假设提供结构化索引。", "year": 2026 }, { "arxiv_id": null, "arxiv_version_reviewed": null, "authors": [ "Jordi Armengol-Estapé", "Jackson Woodruff", "Alexander Brauckmann", "José Wesley de Souza Magalhães", "Michael F. P. O'Boyle" ], "code_url": "https://github.com/jordiae/exebench/tree/8b47d483c2e39ea40a304fbaac46e41a1a14272f", "date_basis": "The ACM article page and ACM’s Crossref deposit both give publication on 2022-06-13, which is also the day of the MAPS ’22 symposium. The date follows the publisher’s stated publication date, not the event schedule.", "date_basis_zh": "ACM 文章页面与 ACM 提交的 Crossref 元数据均将出版日期列为 2022-06-13，这一天也是 MAPS ’22 研讨会的举办日。本条目采用出版方标明的出版日期，而非依据会议日程推定。", "date_precision": "day", "description_en": "ExeBench is a dataset, not a decompiler. It extracts C functions from GitHub and AnghaBench, makes them compilable by locating real headers and definitions or injecting synthetic ones, and generates input/output examples from function signatures with a C++ wrapper that runs each function. After exact deduplication the authors report 4,485,817 compilable and 687,843 executable functions, of which 124,612 have rich IO that a constant or identity implementation cannot pass; the paper also describes x86 and ARM assembly at O0, Os and Ofast for each row. Decompilation studies such as SLaDe and LLM4Decompile later used it to test whether decompiled functions re-execute correctly.", "description_zh": "ExeBench 是数据集，而非反编译器。它从 GitHub 与 AnghaBench 中提取 C 函数，通过查找真实的头文件与定义或注入合成定义使其可编译，再依据函数签名生成输入／输出样例，并以 C++ 包装器运行每个函数。精确去重后，作者报告共有 4,485,817 个可编译函数和 687,843 个可执行函数，其中 124,612 个带有常量或恒等实现无法通过的丰富 IO；论文还说明每行数据附有 O0、Os 与 Ofast 下的 x86 和 ARM 汇编。SLaDe、LLM4Decompile 等反编译研究随后用它检验反编译函数能否正确重新执行。", "doi": "10.1145/3520312.3534867", "entry_url": "https://awesomerea.org/papers/paper-exebench/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-exebench/", "evidence_urls": [ "https://dl.acm.org/doi/10.1145/3520312.3534867", "https://dl.acm.org/doi/pdf/10.1145/3520312.3534867", "https://api.crossref.org/works/10.1145/3520312.3534867", "https://github.com/jordiae/exebench/blob/8b47d483c2e39ea40a304fbaac46e41a1a14272f/README.md", "https://github.com/jordiae/exebench/blob/8b47d483c2e39ea40a304fbaac46e41a1a14272f/exebench/__init__.py", "https://github.com/jordiae/exebench/blob/8b47d483c2e39ea40a304fbaac46e41a1a14272f/examples/basic.py", "https://huggingface.co/datasets/jordiae/exebench", "https://huggingface.co/datasets/jordiae/exebench/blob/093085f8558cfd53de8e2c8f4ccc7b9e73dc22ae/README.md" ], "first_arxiv_date": null, "id": "paper-exebench", "kind": "research", "metadata_notes": "ACM metadata in Crossref and on the article page gives the sentence-case title and pages 50–59 of the Proceedings of the 6th ACM SIGPLAN International Symposium on Machine Programming; the 10-page PDF capitalises it as 'ExeBench: An ML-Scale Dataset of Executable C Functions'. No arXiv version was found. The live ACM pages served a browser check to plain HTTP clients and were read through a browser session; the article page marks the full text world-readable, while the PDF's 2022 notice licenses publication rights to ACM, so no open content license is asserted for the paper. The reviewed 2022-09-15 repository commit has no LICENSE file; its README assigns each C function its source repository's license and releases IO examples and wrappers under MIT. Its helper compiles a function's assembly with the C++ wrapper using g++ -O0 and runs it as a host subprocess without its own sandbox. Hugging Face revision 093085f (2023-03-09) hosts v1.01 as zstandard JSON-lines TAR archives with no license tag in the card metadata; the v1.00 dataset jordiae/exebench_legacy requires contacting the authors. No data was downloaded and no code was run.", "metadata_notes_zh": "Crossref 与文章页面中的 ACM 元数据给出句首大写形式的标题，以及 Proceedings of the 6th ACM SIGPLAN International Symposium on Machine Programming 第 50–59 页；10 页的 PDF 将标题写作“ExeBench: An ML-Scale Dataset of Executable C Functions”。未找到 arXiv 版本。ACM 实时页面对普通 HTTP 客户端显示浏览器验证，本次通过浏览器会话阅读；文章页面将全文标记为公开可读，但 PDF 中的 2022 年声明将出版权授予 ACM，因此本条不认定论文采用开放内容许可。所审阅的 2022-09-15 仓库提交没有 LICENSE 文件；其 README 说明每个 C 函数沿用来源仓库的许可证，IO 样例与包装器以 MIT 发布。仓库辅助代码使用 g++ -O0 将函数汇编与 C++ 包装器一同编译，并作为宿主机子进程直接运行，本身不提供沙箱。Hugging Face 修订版 093085f（2023-03-09）以 zstandard 压缩的 JSON Lines TAR 包托管 v1.01，数据卡元数据中没有许可证标签；v1.00 数据集 jordiae/exebench_legacy 需联系作者获取。本次未下载数据，也未运行代码。", "pdf_url": "https://dl.acm.org/doi/pdf/10.1145/3520312.3534867", "project_url": "https://huggingface.co/datasets/jordiae/exebench", "publication_date": "2022-06-13", "publication_status": "conference-paper", "runtime_tested": false, "scope_limitations_en": "IO is generated from signatures without program context: 10 pairs per function (30 across three seeds of synthetic definitions), arrays default to 32 elements, and success falls below 5% for functions with pointer–integer conversions and stays low for goto, labels and complex control flow, so executable functions skew simpler than the compilable population. Synthetic IO is produced with injected stand-in definitions rather than the functions’ real dependencies; only 4,464 functions have rich IO with real definitions. Finite IO pairs test behavior on sampled inputs, not semantic equivalence, and deduplication removes exact matches after tokenization only. Running functions with real dependencies executes untrusted code; the authors used restricted containers. The paper’s exact v1.00 data is available only on request, while the public v1.01 release has revised splits (for example 2,134 instead of 2,232 real test functions). Each function keeps its source repository’s license; ExeBench additions are MIT.", "scope_limitations_zh": "IO 依据函数签名生成，不考虑程序上下文：每个函数 10 对（合成定义使用三个随机种子，共 30 对），数组默认长度为 32；含指针与整数互转的函数生成成功率低于 5%，含 goto、标签及复杂控制流的函数成功率也较低，因此可执行函数整体比可编译函数更简单。合成 IO 基于注入的替代定义，而非函数的真实依赖生成；带有真实定义且具备丰富 IO 的函数仅有 4,464 个。有限的 IO 对只检验采样输入上的行为，并不证明语义等价；去重也只删除分词后完全相同的函数。运行带真实依赖的函数意味着执行不受信任的代码，作者使用了权限受限的容器。论文所用的 v1.00 原始数据仅可申请获取，公开的 v1.01 版本调整了数据划分（例如真实测试函数为 2,134 个，而非 2,232 个）。每个函数保留其来源仓库的许可证，ExeBench 新增内容采用 MIT 许可。", "targets": [ "binary" ], "title": "ExeBench: an ML-scale dataset of executable C functions", "title_zh": "ExeBench：机器学习规模的可执行 C 函数数据集", "url": "https://dl.acm.org/doi/10.1145/3520312.3534867", "venue": "ACM SIGPLAN MAPS 2022", "verification": "source-reviewed", "verified_at": "2026-10-18", "why_fits_en": "Adds the executable C-function benchmark behind several decompilation papers in this section, so readers can check its construction, IO limits and version differences directly.", "why_fits_zh": "补充本节多篇反编译论文所依赖的可执行 C 函数基准，便于读者直接核查其构建方式、IO 局限与版本差异。", "year": 2022 }, { "arxiv_id": "2609.29744", "arxiv_version_reviewed": "v1", "authors": [ "Douglas Leith" ], "code_url": null, "date_basis": "First arXiv submission; the reviewed version is v1, not a verified proceedings publication.", "date_basis_zh": "采用 arXiv 首次提交日期；审阅版本为 v1，并非已经核实的会议录出版。", "date_precision": "day", "description_en": "Studies development of the Extractor reverse-engineering tool through commits, available session logs and code-provenance tracing. Taxonomies separate instruction intent, change triggers and agent claims, exposing errors corrected before commits that ordinary repository history misses.", "description_zh": "通过提交、可用会话日志及代码溯源研究 Extractor 逆向工具的开发，用分类体系区分指令意图、变更触发因素及智能体陈述，揭示普通仓库历史无法反映的提交前纠错。", "doi": null, "entry_url": "https://awesomerea.org/papers/paper-extractor-development-reliability/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-extractor-development-reliability/", "evidence_urls": [ "https://arxiv.org/abs/2609.29744", "https://arxiv.org/html/2609.29744v1", "https://github.com/doug-leith/extractor-code-development/blob/4f74f798e58073c23386a1516b582ed6827bb190/README.md", "https://github.com/doug-leith/ios-protobuf-decoding/blob/9a4a688c52686f82c1a86e386848edc4eb671746/README.md" ], "first_arxiv_date": "2026-09-24", "id": "paper-extractor-development-reliability", "kind": "research", "metadata_notes": "Reviewed v1 and the author's pinned reproducibility-archive README, which documents lost sessions and unreproducible response-scoring evidence. The repository exposes an archive and Git-history material; neither was downloaded. No repository-wide license was verified, so code_url remains null and project_url identifies the reviewed artifact landing.", "metadata_notes_zh": "审阅 v1 及作者固定版本复现归档 README；后者记载丢失的会话及缺少证据而无法复现的响应评分。仓库提供归档和 Git 历史材料，本次均未下载。未核实仓库整体许可，因此 code_url 留空，project_url 指向已检查的产物页面。", "pdf_url": "https://arxiv.org/pdf/2609.29744v1", "project_url": "https://github.com/doug-leith/extractor-code-development", "publication_date": "2026-09-24", "publication_status": "preprint", "runtime_tested": false, "scope_limitations_en": "One codebase with human-directed work, no human-coded comparison. The 14.3% figure is 15 of 105 audited generation events, including test defects and stale tests, not a defect rate per source line or in shipped code. LLM scoring has sampled human calibration; transcripts are incomplete and the archive omits per-response evidence bundles. This companion study does not independently corroborate the related schema-recovery results.", "scope_limitations_zh": "仅研究一个由人指导开发的代码库，没有人工编写代码的对照。14.3% 指 105 次已审计生成事件中的 15 次，包含测试缺陷及未同步更新的测试，不是源码行或已交付代码的缺陷比例。大语言模型评分接受抽样人工校准，但会话记录不完整，归档缺少逐响应评分证据包。该配套研究并不独立佐证相关模式恢复结果。", "targets": [ "binary", "protocol" ], "title": "Between the Commits: Process, Error, and Claim Reliability in a Wholly AI-Authored Codebase", "title_zh": "提交之间：一个完全由 AI 编写的代码库中的过程、错误与陈述可靠性", "url": "https://arxiv.org/abs/2609.29744", "venue": "arXiv", "verification": "source-reviewed", "verified_at": "2026-10-20", "why_fits_en": "Adds provenance and claim-auditing methods for agent-built reverse-engineering tools.", "why_fits_zh": "补充智能体构建逆向工具时的溯源与陈述审计方法。", "year": 2026 }, { "arxiv_id": "2609.34089", "arxiv_version_reviewed": "v1", "authors": [ "Luke Dramko", "Claire Le Goues", "Edward Schwartz" ], "code_url": "https://github.com/squaresLab/faultless", "date_basis": "arXiv v1 submission date; no formal publication venue was verified.", "date_basis_zh": "采用 arXiv v1 首次提交日期；未核实正式发表场所。", "date_precision": "day", "description_en": "Compares neural-decompiler C output with deterministic decompilation or reference functions using symbolic execution and a specialized memory model. It supports both analyst-facing validation and model evaluation without requiring the surrounding codebase.", "description_zh": "利用符号执行与专门的内存模型，将神经反编译器生成的 C 代码与确定性反编译结果或参考函数比较，无需完整周边代码库，可用于分析人员的结果核查及模型评估。", "doi": "10.48550/arxiv.2609.34089", "entry_url": "https://awesomerea.org/papers/paper-faultless/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-faultless/", "evidence_urls": [ "https://arxiv.org/abs/2609.34089", "https://arxiv.org/html/2609.34089v1", "https://api.datacite.org/dois/10.48550/arxiv.2609.34089", "https://github.com/squaresLab/faultless", "https://github.com/squaresLab/faultless/blob/059023d874f4103b5e645a9d6d6ddbdb2bbb6da0/README.md", "https://github.com/squaresLab/faultless/blob/059023d874f4103b5e645a9d6d6ddbdb2bbb6da0/LICENSE", "https://github.com/squaresLab/faultless/blob/059023d874f4103b5e645a9d6d6ddbdb2bbb6da0/pyproject.toml" ], "first_arxiv_date": "2026-09-28", "id": "paper-faultless", "kind": "research", "metadata_notes": "The three-author order and first-submission date follow arXiv v1. DataCite records the arXiv DOI as findable, registered on 2026-09-29, despite the abstract page’s pending-registration label. The paper is CC BY-SA 4.0. The author-linked public repository was reviewed at 059023d874f4103b5e645a9d6d6ddbdb2bbb6da0; its root license is MIT and README calls the Python/tree-sitter/Z3 implementation a proof of concept. No code or experiments were run.", "metadata_notes_zh": "三位作者顺序与首投日期依据 arXiv v1。摘要页虽仍显示 DOI 待登记，DataCite 已将其列为可检索，登记于 2026-09-29。论文采用 CC BY-SA 4.0。作者链接的公开仓库固定核查于 059023d874f4103b5e645a9d6d6ddbdb2bbb6da0；根目录为 MIT 许可，README 将基于 Python、tree-sitter 与 Z3 的实现称为概念验证。本次未运行代码或实验。", "pdf_url": "https://arxiv.org/pdf/2609.34089v1", "project_url": null, "publication_date": "2026-09-28", "publication_status": "preprint", "runtime_tested": false, "scope_limitations_en": "Function-level checks abstract away side-effect ordering and some compiler details; configurable options further relax return, argument and type conditions. The implementation has explicit heap-related soundness limitations and requires compatible loop structure; unsupported C features and context-independent dependency assumptions also limit coverage. Failure to establish equivalence is not proof of inequivalence. Evaluations use filtered realtype and ExeBench pairs, not unrestricted whole-program equivalence.", "scope_limitations_zh": "检查限定于函数级，抽象掉副作用顺序和部分编译器细节，选项还可放宽返回值、实参及类型条件。实现明确存在与堆有关的可靠性缺口，并要求兼容的循环结构；不支持的 C 特性及脱离上下文的依赖假设也限制覆盖。未能建立等价关系并不证明不等价。实验使用筛选后的 realtype 与 ExeBench 函数对，不代表任意整程序等价。", "targets": [ "binary" ], "title": "Faultless: A Program Equivalence Technique for Validating and Evaluating Neural Decompilers", "title_zh": "Faultless：验证和评估神经反编译器的程序等价性方法", "url": "https://arxiv.org/abs/2609.34089", "venue": "arXiv", "verification": "source-reviewed", "verified_at": "2026-10-20", "why_fits_en": "Adds a concrete validation method for recovered code while exposing the assumptions and unsound cases hidden by an unconditional equivalence label.", "why_fits_zh": "为恢复代码提供具体核查方法，同时揭示无条件“等价”标签可能掩盖的假设与不可靠情形。", "year": 2026 }, { "arxiv_id": "2510.19615", "arxiv_version_reviewed": "v1", "authors": [ "Zhiping Zhou", "Xiaohong Li", "Ruitao Feng", "Yao Zhang", "Yuekang Li", "Wenbu Feng", "Yunqian Wang", "Yuqing Li" ], "code_url": "https://github.com/ZhouZhiping045/FidelityGPT", "date_basis": "The Internet Society’s Crossref deposit and the official NDSS paper identify publication year 2026. No finer publication date is asserted from the 23–27 February 2026 symposium dates.", "date_basis_zh": "Internet Society 提交的 Crossref 元数据与 NDSS 官方论文标明出版年份为 2026；不根据 2026 年 2 月 23–27 日的会议日期推定更精确的出版日期。", "date_precision": "year", "description_en": "FidelityGPT post-processes existing decompiler output: an LLM labels lines with six distortion types, such as non-conventional dereferencing, redundant variables and confusing control flow, and then rewrites the labeled lines. Its prompts define the distortion types and add retrieval-augmented context from a manually annotated database of distorted IDA Pro and Ghidra lines. A semantic-intensity algorithm chooses which lines to query, and a variable-dependency analysis carries redundant-variable context across 50-line chunks. On 620 function pairs, the authors report 89% detection accuracy and 83% precision, and correction fix rates of 94% (FR) and 64% (CFR) against 83% and 37% for their DeGPT runs.", "description_zh": "FidelityGPT 对现有反编译器输出进行后处理：由大语言模型为代码行标注六类失真（如非常规解引用、冗余变量和令人困惑的控制流），再改写被标注的行。其提示词定义各失真类型，并从人工标注的 IDA Pro 与 Ghidra 失真代码行数据库中检索增强上下文。语义强度算法负责选择用于查询的代码行，变量依赖分析则在 50 行分块之间传递冗余变量上下文。作者在 620 对函数上报告检测准确率 89%、精确率 83%，纠正的修复率（FR）为 94%、正确修复率（CFR）为 64%，而他们运行的 DeGPT 分别为 83% 和 37%。", "doi": "10.14722/ndss.2026.230989", "entry_url": "https://awesomerea.org/papers/paper-fidelitygpt/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-fidelitygpt/", "evidence_urls": [ "https://www.ndss-symposium.org/ndss-paper/fidelitygpt-correcting-decompilation-distortions-with-retrieval-augmented-generation/", "https://www.ndss-symposium.org/wp-content/uploads/2026-s989-paper.pdf", "https://api.crossref.org/works/10.14722/ndss.2026.230989", "https://arxiv.org/abs/2510.19615", "https://github.com/ZhouZhiping045/FidelityGPT/blob/b464960961ec48c63dea16069740b3d8003193bc/README.md", "https://github.com/ZhouZhiping045/FidelityGPT/blob/b464960961ec48c63dea16069740b3d8003193bc/config.ini", "https://github.com/ZhouZhiping045/FidelityGPT/blob/b464960961ec48c63dea16069740b3d8003193bc/requirements.txt", "https://github.com/ZhouZhiping045/FidelityGPT/blob/b464960961ec48c63dea16069740b3d8003193bc/Evaluation/README.md", "https://github.com/ZhouZhiping045/FidelityGPT/tree/b464960961ec48c63dea16069740b3d8003193bc/Dataset" ], "first_arxiv_date": "2025-10-22", "id": "paper-fidelitygpt", "kind": "research", "metadata_notes": "The eight-author order follows the NDSS paper page, the PDF, Crossref and arXiv v1, which carries the same DOI. The PDF footer gives ISBN 979-8-9919276-8-0; Crossref lists no pages. The paper’s reference [31] points to the authors’ repository, reviewed at a 2025-09-07 commit. It has no license file, so no reuse terms are inferred; its datasets contain decompiled functions and source code from third-party projects with their own licenses. The snapshot includes the detection and correction scripts, prompt templates, both distortion databases, seven decompiled-function sets with ground truth and a detection evaluator; the -O1–-O3 and Ghidra evaluation sets were not identified in it. Its README requires manual merging of chunked detection output and states that correction must be evaluated manually using the paper’s Table I. The configuration targets an OpenAI-compatible GPT-4o endpoint at temperature 0 with pinned LangChain 0.1 and Chroma dependencies. No code, API calls or experiments were run.", "metadata_notes_zh": "八位作者的顺序以 NDSS 论文页、PDF、Crossref 及 arXiv v1 为准，arXiv 记录载有相同 DOI。PDF 页脚标注 ISBN 979-8-9919276-8-0；Crossref 未列出页码。论文参考文献 [31] 指向作者仓库，本次审阅其 2025-09-07 提交。仓库没有许可证文件，因此不推定任何复用条款；其数据集包含来自第三方项目的反编译函数与源码，这些项目保留各自许可证。该快照包含检测与纠正脚本、提示词模板、两套失真数据库、七组带真实标签的反编译函数以及检测评估脚本；未在其中找到 -O1–-O3 与 Ghidra 评估集。README 要求人工合并分块检测的输出，并说明纠正结果须依照论文表 I 人工评估。配置面向兼容 OpenAI 接口的 GPT-4o 端点，温度为 0，并固定 LangChain 0.1 与 Chroma 依赖版本。本次未运行代码、调用 API 或复现实验。", "pdf_url": "https://www.ndss-symposium.org/wp-content/uploads/2026-s989-paper.pdf", "project_url": null, "publication_date": null, "publication_status": "conference-paper", "runtime_tested": false, "scope_limitations_en": "The 620 pairs are mostly -O0 IDA Pro 7.5 functions sampled from Coreutils, curl, ImageMagick, OpenSSL, PuTTY and SQLite builds in a binary-similarity dataset, across ARM-32, MIPS-32 and x86-32, plus x86-64 TheAlgorithms/C code; separate -O1–-O3 and Ghidra sets test generalization. Ground-truth labels and FR/CFR were assessed manually by the author team against the paper’s criteria. Fix rates count lines marked as fixed and are not semantic-equivalence proofs: the authors note that repaired code often cannot be recompiled or executed. Correction runs on whole functions and may degrade on long ones, and the distortion database, built from 150 IDA Pro and 91 Ghidra lines, may miss rarer anomalies. Main results use GPT-4o at temperature 0.5 and remain stochastic; DeepSeek-chat and temperature-0 runs are reported separately. Training-data exposure of the open-source projects cannot be ruled out.", "scope_limitations_zh": "620 对函数大多取自二进制相似性数据集中 Coreutils、curl、ImageMagick、OpenSSL、PuTTY 与 SQLite 的构建产物，经 IDA Pro 7.5 在 -O0 下反编译，覆盖 ARM-32、MIPS-32 与 x86-32，另含 x86-64 的 TheAlgorithms/C 代码；另有 -O1–-O3 与 Ghidra 数据集用于检验泛化能力。真实标签与 FR／CFR 均由作者团队依照论文标准人工评估。修复率统计的是被标为已修复的行，并非语义等价证明：作者指出修复后的代码往往无法重新编译或执行。纠正阶段以整个函数为单位，函数较长时效果可能下降；失真数据库由 150 行 IDA Pro 与 91 行 Ghidra 代码构建，可能遗漏较少见的异常。主要结果使用温度为 0.5 的 GPT-4o，仍具随机性；DeepSeek-chat 与温度为 0 的结果另行报告。无法排除这些开源项目出现在训练数据中的可能。", "targets": [ "binary" ], "title": "FidelityGPT: Correcting Decompilation Distortions with Retrieval Augmented Generation", "title_zh": "FidelityGPT：利用检索增强生成纠正反编译失真", "url": "https://www.ndss-symposium.org/ndss-paper/fidelitygpt-correcting-decompilation-distortions-with-retrieval-augmented-generation/", "venue": "NDSS 2026", "verification": "source-reviewed", "verified_at": "2026-10-18", "why_fits_en": "Adds LLM-based detection and correction of distortions in decompiler output, complementing DeGPT-style refinement and end-to-end LLM decompilation.", "why_fits_zh": "补充基于大语言模型检测并纠正反编译输出失真的方法，与 DeGPT 式输出优化和端到端大语言模型反编译互补。", "year": 2026 }, { "arxiv_id": null, "arxiv_version_reviewed": null, "authors": [ "Daming D. Chen", "Manuel Egele", "Maverick Woo", "David Brumley" ], "code_url": "https://github.com/firmadyne/firmadyne", "date_basis": "Internet Society-deposited Crossref metadata supplies only publication year 2016; the publisher PDF separately identifies the 21–24 February 2016 symposium, which is not used to assert a publication month or day.", "date_basis_zh": "Internet Society 向 Crossref 提交的元数据仅给出出版年份 2016；出版方 PDF 另列研讨会日期为 2016 年 2 月 21—24 日，本条目不据此推定出版月份或日期。", "date_precision": "year", "description_en": "Firmadyne crawls, extracts and emulates Linux-based firmware for network-connected commercial devices such as routers and IP cameras. It replaces the vendor kernel with pre-built, instrumented kernels for little-endian ARM and little- and big-endian MIPS, boots the extracted filesystem under QEMU full-system emulation with a userspace NVRAM library, infers the network configuration, then runs automated analyses including 60 known and 14 newly found exploits. From 23,035 images across 42 vendors, the authors extracted 9,486 and report 887 of the 1,971 network-reachable images vulnerable to at least one sampled exploit.", "description_zh": "Firmadyne 对路由器、IP 摄像头等联网商用设备中基于 Linux 的固件进行爬取、提取与仿真。它以预先构建并插桩的小端 ARM 及小端、大端 MIPS 内核替换厂商内核，在 QEMU 全系统仿真中配合用户态 NVRAM 库启动提取出的文件系统，推断网络配置，再运行自动化分析，包括 60 个已知漏洞利用和 14 个新发现的漏洞利用。作者从 42 家厂商的 23,035 个固件映像中提取出 9,486 个，并报告在 1,971 个网络可达映像中有 887 个至少受一个所选漏洞利用影响。", "doi": "10.14722/ndss.2016.23415", "entry_url": "https://awesomerea.org/papers/paper-firmadyne/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-firmadyne/", "evidence_urls": [ "https://doi.org/10.14722/ndss.2016.23415", "https://api.crossref.org/works/10.14722/ndss.2016.23415", "https://www.ndss-symposium.org/wp-content/uploads/2017/09/towards-automated-dynamic-analysis-linux-based-embedded-firmware.pdf", "https://github.com/firmadyne/firmadyne/blob/11cb574cda0a5540ab7e36aa9b43679dc02c5788/README.md", "https://github.com/firmadyne/firmadyne/blob/11cb574cda0a5540ab7e36aa9b43679dc02c5788/LICENSE.txt", "https://github.com/firmadyne/firmadyne/blob/11cb574cda0a5540ab7e36aa9b43679dc02c5788/Dockerfile", "https://github.com/firmadyne/firmadyne/blob/11cb574cda0a5540ab7e36aa9b43679dc02c5788/download.sh" ], "first_arxiv_date": null, "id": "paper-firmadyne", "kind": "research", "metadata_notes": "Crossref gives only the year and no pages; the PDF footer identifies NDSS ’16, 21–24 February 2016, San Diego, with ISBN 1-891562-41-X and the DOI. The DOI resolves directly to the NDSS PDF, so the DOI URL serves as the paper page. Figures differ between sources: the paper's per-vendor appendix table totals 8,893 extracted images where its abstract and body give 9,486, and the repository README reports 846 of 1,971 (43%) vulnerable images where the paper reports 887 (45%). This record follows the paper body. The reviewed 2024-07-21 snapshot of firmadyne/firmadyne is MIT-licensed, calls itself a research tool that is not production ready, and says the paper's results used pre-release toolchains, kernels and components that it lists by version or commit. Its current Dockerfile uses Ubuntu 22.04 and runs in privileged mode, and download.sh fetches pre-built kernels, console and libnvram binaries from GitHub releases. Vendor firmware images and Metasploit exploits carry their own terms. No firmware, binaries or exploits were downloaded, and nothing was run.", "metadata_notes_zh": "Crossref 仅给出年份而无页码；PDF 页脚标明 NDSS ’16 于 2016 年 2 月 21—24 日在圣迭戈举行，并载有 ISBN 1-891562-41-X 与 DOI。该 DOI 直接解析至 NDSS PDF，因此以 DOI 链接作为论文页面。各来源的数字存在差异：论文附录按厂商列出的表格合计 8,893 个已提取映像，而摘要与正文为 9,486 个；仓库 README 报告 1,971 个映像中有 846 个（43%）存在漏洞，论文则为 887 个（45%）。本条目以论文正文为准。所审阅的 firmadyne/firmadyne 2024-07-21 快照采用 MIT 许可，自称是尚不适合生产环境的研究工具，并说明论文结果使用了预发布版本的工具链、内核及组件，按版本或提交逐项列出。当前 Dockerfile 使用 Ubuntu 22.04 并以特权模式运行，download.sh 从 GitHub 发布页下载预构建的内核、console 与 libnvram 二进制。厂商固件映像与 Metasploit 漏洞利用适用各自条款。本次未下载固件、二进制或漏洞利用，也未运行任何内容。", "pdf_url": "https://www.ndss-symposium.org/wp-content/uploads/2017/09/towards-automated-dynamic-analysis-linux-based-embedded-firmware.pdf", "project_url": null, "publication_date": null, "publication_status": "conference-paper", "runtime_tested": false, "scope_limitations_en": "The work targets Linux-based firmware on little-endian ARM and little- and big-endian MIPS, which made up 90.8% of the dataset; x86, VxWorks and other real-time operating systems are outside the system. Its pre-built kernels do not load vendor out-of-tree kernel modules, so vendor kernels and modules cannot be checked, and instrumented emulation is not identical device behavior. The emulation funnel narrows sharply: of 8,591 images that initially emulated, 2,797 had a network configuration inferred and 1,971 answered ping. NVRAM semantics, interface naming and a single emulated Ethernet device on ARM are among the reported causes. WAN and LAN ports are not distinguished, so remote exploitability is not established, and results count firmware images rather than unique products and are skewed by vendor composition. FirmAE, already in this bibliography, extends Firmadyne to address such emulation failures; these 2016 rates are not current emulation figures.", "scope_limitations_zh": "该工作面向小端 ARM 及小端、大端 MIPS 上基于 Linux 的固件，这些平台占数据集的 90.8%；x86、VxWorks 及其他实时操作系统不在系统支持范围内。其预构建内核不加载厂商的树外内核模块，因此无法检查厂商内核及模块，插桩仿真也不等同于设备原有行为。仿真流程逐级大幅收窄：在初始仿真成功的 8,591 个映像中，2,797 个推断出网络配置，1,971 个能响应 ping。论文列出的原因包括 NVRAM 语义、网络接口命名，以及 ARM 平台仅仿真一个以太网设备等。系统不区分 WAN 与 LAN 端口，因此不能确认可否远程利用；结果按固件映像而非独立产品计数，并受厂商构成偏差影响。本收录中已有的 FirmAE 扩展了 Firmadyne 以解决此类仿真失败；这些 2016 年的比率并非当前的仿真数据。", "targets": [ "firmware" ], "title": "Towards Automated Dynamic Analysis for Linux-based Embedded Firmware", "title_zh": "面向基于 Linux 的嵌入式固件的自动化动态分析", "url": "https://doi.org/10.14722/ndss.2016.23415", "venue": "NDSS 2016", "verification": "source-reviewed", "verified_at": "2026-10-18", "why_fits_en": "Adds the full-system firmware-emulation framework, with kernel replacement and userspace NVRAM, that later rehosting research such as FirmAE builds on.", "why_fits_zh": "补充采用内核替换与用户态 NVRAM 的全系统固件仿真框架，FirmAE 等后续重托管研究在其基础上展开。", "year": 2016 }, { "arxiv_id": null, "arxiv_version_reviewed": null, "authors": [ "Mingeun Kim", "Dongkwan Kim", "Eunsoo Kim", "Suryeon Kim", "Yeongjin Jang", "Yongdae Kim" ], "citation": { "container_title": "Annual Computer Security Applications Conference", "pages": "733-745", "publisher": "ACM", "sources": [ "https://api.crossref.org/works/10.1145/3427228.3427294" ] }, "code_url": "https://github.com/pr0v3rbs/FirmAE", "date_basis": "ACM-deposited Crossref print-publication date; the online-publication date is recorded separately in metadata notes.", "date_basis_zh": "采用 ACM 在 Crossref 登记的印刷出版日期；在线出版日期在元数据说明中单独记录。", "date_precision": "day", "description_en": "Extends Firmadyne with empirically derived interventions for boot, networking, NVRAM, kernel behavior, and other runtime failures, enabling Linux router and IP-camera firmware web services to run for dynamic analysis.", "description_zh": "在 Firmadyne 基础上，针对启动、网络、NVRAM、内核行为及其他运行失败加入经验性干预，使 Linux 路由器与 IP 摄像机固件的 Web 服务能够运行并接受动态分析。", "doi": "10.1145/3427228.3427294", "entry_url": "https://awesomerea.org/papers/paper-firmae/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-firmae/", "evidence_urls": [ "https://doi.org/10.1145/3427228.3427294", "https://api.crossref.org/works/10.1145/3427228.3427294", "https://www.acsac.org/2020/program/papers/", "https://syssec.kaist.ac.kr/pub/2020/kim_acsac2020.pdf", "https://github.com/pr0v3rbs/FirmAE/blob/653565b5d14e6d69a1dd242aa88ecfb4b090a74a/README.md", "https://github.com/pr0v3rbs/FirmAE/blob/653565b5d14e6d69a1dd242aa88ecfb4b090a74a/LICENSE.txt" ], "first_arxiv_date": null, "id": "paper-firmae", "kind": "research", "metadata_notes": "ACM metadata records print publication on 2020-12-07 and online publication on 2020-12-08, pages 733–745. The six-author paper is separate from later repository updates. The pinned artifact README documents Ubuntu 20.04 and privileged run modes. Its MIT license does not license vendor firmware images or all dependencies; dataset downloads were not tested.", "metadata_notes_zh": "ACM 元数据记载印刷出版于 2020-12-07，在线出版于 2020-12-08，页码为 733–745。六位作者的论文与仓库后续更新分开记录。固定提交的产物 README 记载了 Ubuntu 20.04 和需要提权的运行模式。仓库的 MIT 许可不涵盖厂商固件镜像或全部依赖；本次未测试数据集下载。", "pdf_url": "https://syssec.kaist.ac.kr/pub/2020/kim_acsac2020.pdf", "project_url": null, "publication_date": "2020-12-07", "publication_status": "conference-paper", "runtime_tested": false, "scope_limitations_en": "Arbitration deliberately changes execution and targets functioning web interfaces, not identical physical-device behavior. The evaluation covers ARM little-endian and MIPS little-/big-endian firmware from routers and IP cameras; heuristics may fail on unseen devices or configurations. It reuses firmware binaries rather than recovering their source.", "scope_limitations_zh": "仲裁式干预会有意改变执行过程，目标是运行 Web 界面，而非完整复现物理设备行为。评测覆盖路由器与 IP 摄像机的 ARM 小端、MIPS 小端及大端固件；启发式规则可能不适用于未见过的设备或配置。该方法复用固件二进制，并不恢复其源码。", "targets": [ "firmware" ], "title": "FirmAE: Towards Large-Scale Emulation of IoT Firmware for Dynamic Analysis", "title_zh": "FirmAE：面向动态分析的物联网固件大规模仿真", "url": "https://doi.org/10.1145/3427228.3427294", "venue": "ACSAC 2020", "verification": "source-reviewed", "verified_at": "2026-10-16", "why_fits_en": "Provides a concrete firmware-rehosting method and evaluation for restoring analyzable network-service behavior when exact hardware emulation is unavailable.", "why_fits_zh": "在无法精确仿真硬件时，为恢复可分析的网络服务行为提供具体的固件重托管方法与评测。", "year": 2020 }, { "arxiv_id": "2606.24549", "arxiv_version_reviewed": "v1", "authors": [ "Chuan Hong", "Zheng Zhang", "Lei Zhou", "Laisong Li", "Chenyifan Liu", "Ze Huang", "Xu Zhou", "Peihong Lin" ], "code_url": null, "date_basis": "arXiv first submission date; no separate publication was verified.", "date_basis_zh": "采用 arXiv 首次提交日期，未核实另行出版的版本。", "date_precision": "day", "description_en": "FirmCure combines static dependency analysis, iterative boot-configuration repair and runtime fault diagnosis to rehost Linux firmware in QEMU. Specialized agents apply targeted repairs and use execution feedback to recover service behavior.", "description_zh": "FirmCure 将静态依赖分析、启动配置迭代修复与运行时故障诊断结合起来，在 QEMU 中迁移 Linux 固件。专门的智能体执行针对性修复，并利用执行反馈恢复服务行为。", "doi": null, "entry_url": "https://awesomerea.org/papers/paper-firmcure/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-firmcure/", "evidence_urls": [ "https://arxiv.org/abs/2606.24549v1", "https://arxiv.org/html/2606.24549v1" ], "first_arxiv_date": "2026-06-23", "id": "paper-firmcure", "kind": "research", "metadata_notes": "Reviewed arXiv v1 as a preprint. Open Science mentions an anonymous repository without a locatable link. A same-named GitHub repository was not bound to this paper or its authors, so no official code link or code license is asserted.", "metadata_notes_zh": "按预印本审阅 arXiv v1。开放科学部分提到匿名仓库，却未给出可定位链接；同名 GitHub 仓库与论文及作者的关联尚未核实，因此不标注为官方代码，也不推断代码许可。", "pdf_url": "https://arxiv.org/pdf/2606.24549v1", "project_url": null, "publication_date": "2026-06-23", "publication_status": "preprint", "runtime_tested": false, "scope_limitations_en": "Evaluation covers 21 images from ten vendors and five architectures: all opened ports, but only 19 reached full service interactivity within 45 minutes. Substituting an approximate kernel cannot preserve original-kernel or dedicated-hardware vulnerabilities. LLM reasoning loops caused residual failures. These author-reported results were not rerun.", "scope_limitations_zh": "评测覆盖十家厂商、五种架构的 21 个镜像：全部打开了端口，但只有 19 个在 45 分钟内实现完整服务交互。近似内核替换不能保留依赖原内核或专用硬件的漏洞，模型推理循环仍会导致失败。本次未重跑这些作者报告的结果。", "targets": [ "firmware", "binary" ], "title": "FirmCure:Towards Autonomous and Adaptive Rehosting of Linux-Based Firmware", "title_zh": "FirmCure：面向自主、自适应的 Linux 固件运行环境迁移", "url": "https://arxiv.org/abs/2606.24549", "venue": "arXiv", "verification": "source-reviewed", "verified_at": "2026-10-20", "why_fits_en": "Connects binary inspection and failure diagnosis to evidence-driven firmware environment repair.", "why_fits_zh": "将二进制观察和故障诊断连接到依据证据进行的固件环境修复。", "year": 2026 }, { "arxiv_id": "2607.14903", "arxiv_version_reviewed": "v1", "authors": [ "Yanbing Shen", "Fan Zhang", "Haitao Xu" ], "code_url": null, "date_basis": "arXiv first submission date; no separate publication was verified.", "date_basis_zh": "采用 arXiv 首次提交日期，未核实另行出版的版本。", "date_precision": "day", "description_en": "FirmPilot reconstructs QEMU execution environments through coordinated retrieval, planning, filesystem, persistent-state and network recovery. Proposed changes are applied as constrained artifact deltas, then checked by rerunning the firmware and fixed probes.", "description_zh": "FirmPilot 协调检索、规划、文件系统、持久状态与网络恢复来重建 QEMU 执行环境。候选修改被落实为受约束的产物差异，再通过重新运行固件与固定探测检查。", "doi": null, "entry_url": "https://awesomerea.org/papers/paper-firmpilot/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-firmpilot/", "evidence_urls": [ "https://arxiv.org/abs/2607.14903v1", "https://arxiv.org/html/2607.14903v1" ], "first_arxiv_date": "2026-07-16", "id": "paper-firmpilot", "kind": "research", "metadata_notes": "Reviewed arXiv v1 as a preprint. No dedicated author-linked implementation or artifact license was verified from the reviewed paper; its baseline and corpus references are separate works.", "metadata_notes_zh": "按预印本审阅 arXiv v1。未从所审论文核实作者关联的专用实现或产物许可证；文中引用的基线与固件语料是另行发布的工作。", "pdf_url": "https://arxiv.org/pdf/2607.14903v1", "project_url": null, "publication_date": "2026-07-16", "publication_status": "preprint", "runtime_tested": false, "scope_limitations_en": "The main denominator is 10,033 obtainable LFwC images, not all 10,913 metadata records. Reachability under a 2,400-second budget is not whole-device equivalence; HTTP success can include redirects or authentication gates. Reported results use one LLM backend and fixed probes. No rehosting or experiments were reproduced here.", "scope_limitations_zh": "主要分母为可取得的 10,033 个 LFwC 镜像，而非全部 10,913 条元数据记录。2,400 秒预算内的可达性不等于完整设备等价，HTTP 成功也包含重定向与认证入口。报告结果使用单一模型后端及固定探测，本次未复现迁移或实验。", "targets": [ "firmware", "binary" ], "title": "FirmPilot: Evidence-Guided Multi-Agent Environment Recovery for IoT Firmware Rehosting", "title_zh": "FirmPilot：证据引导的多智能体物联网固件运行环境恢复", "url": "https://arxiv.org/abs/2607.14903", "venue": "arXiv", "verification": "source-reviewed", "verified_at": "2026-10-20", "why_fits_en": "Uses execution evidence to recover the missing environment needed to inspect firmware behavior.", "why_fits_zh": "利用执行证据恢复观察固件行为所需的缺失运行环境。", "year": 2026 }, { "arxiv_id": null, "arxiv_version_reviewed": null, "authors": [ "Chuan Qin", "Cen Zhang", "Yaowen Zheng", "Puzhuo Liu", "Jian Zhang", "Yeting Li", "Weidong Zhang", "Yang Liu", "Limin Sun" ], "code_url": "https://github.com/qc9c/Firmwell", "date_basis": "The Internet Society’s Crossref deposit and the official NDSS paper identify publication year 2026. No finer publication date is asserted from the conference event dates.", "date_basis_zh": "Internet Society 提交的 Crossref 元数据与 NDSS 官方论文标明出版年份为 2026；不根据会议举办日期推定更精确的出版日期。", "date_precision": "year", "description_en": "FIRMWELL reconstructs the execution environment of Linux firmware services by running their initialization processes, locating blocking dependencies and repairing missing system-level behavior. It combines containerized QEMU-user emulation with a QEMU-system fallback, using process traces and binary analysis to recover resources needed by the target service.", "description_zh": "FIRMWELL 通过运行初始化进程、定位阻塞依赖并修补缺失的系统层行为，重建 Linux 固件服务的执行环境。它结合容器化 QEMU-user 仿真与 QEMU-system 回退，并利用进程轨迹和二进制分析恢复目标服务所需的资源。", "doi": "10.14722/ndss.2026.230249", "entry_url": "https://awesomerea.org/papers/paper-firmwell/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-firmwell/", "evidence_urls": [ "https://www.ndss-symposium.org/ndss-paper/user-space-dependency-aware-rehosting-for-linux-based-firmware-binaries/", "https://www.ndss-symposium.org/wp-content/uploads/2026-s249-paper.pdf", "https://api.crossref.org/works/10.14722/ndss.2026.230249", "https://github.com/qc9c/Firmwell/blob/d46bc7552c463a08387125a346397e9866e5889e/README.md", "https://github.com/qc9c/Firmwell/blob/d46bc7552c463a08387125a346397e9866e5889e/LICENSE", "https://github.com/qc9c/Firmwell/blob/d46bc7552c463a08387125a346397e9866e5889e/Dockerfile", "https://github.com/qc9c/Firmwell/blob/d46bc7552c463a08387125a346397e9866e5889e/firmwell.py", "https://github.com/qc9c/Firmwell/blob/d46bc7552c463a08387125a346397e9866e5889e/firmwell/plugins/http_check.py" ], "first_arxiv_date": null, "id": "paper-firmwell", "kind": "research", "metadata_notes": "The nine-author order follows the official paper. Crossref agrees on the DOI but repeats Jian Zhang as a tenth author row; that duplicate is not reproduced here. Its appendix lists 1 CPU core, 4 GiB RAM and 100 GiB disk per task, and describes the full firmware corpus as private. The pinned repository declares GPLv3; vendor firmware and dependencies retain separate terms. Its Docker-in-Docker workflow uses an elevated-privilege outer container, and the authors recommend VM isolation; the current inner-container privilege flag defaults off. Mutable container tags mean the source pin alone does not fix the execution environment. Experiments were not rerun for this collection.", "metadata_notes_zh": "九位作者的顺序以官方论文为准。Crossref 的 DOI 相符，但将 Jian Zhang 重复列为第十个作者条目；此处不沿用该重复项。论文附录列出每个任务需 1 个 CPU 核心、4 GiB 内存和 100 GiB 磁盘，并将完整固件语料描述为私有。固定仓库声明采用 GPLv3；厂商固件与依赖仍有各自条款。其 Docker-in-Docker 流程使用具有较高权限的外层容器，作者建议以虚拟机隔离；当前内层容器权限开关默认关闭。容器标签可变，因此固定源码版本本身并未固定执行环境。本合集未重新运行实验。", "pdf_url": "https://www.ndss-symposium.org/wp-content/uploads/2026-s249-paper.pdf", "project_url": null, "publication_date": null, "publication_status": "conference-paper", "runtime_tested": false, "scope_limitations_en": "The evaluation concerns selected network services, not complete device or hardware equivalence. HTTP acceptance uses configured response-status and error-content checks; other services need their own criteria. Coverage depends on unpacking, supported architectures, initialization heuristics and peripheral models. Symbolic path explosion, solver timeouts and complex peripheral checks remain failure modes. The paper’s recovery strategy avoids patching target binaries; successful service interaction does not establish recovery of original source code or every device function.", "scope_limitations_zh": "评估针对选定网络服务，并非完整设备或硬件等价。HTTP 验收采用配置好的响应状态与错误内容检查；其他服务需要各自的判定标准。覆盖范围受解包、架构支持、初始化启发式规则和外设模型限制，符号执行路径爆炸、求解超时及复杂外设检查仍可能导致失败。论文中的修复策略避免补丁修改目标二进制；服务交互成功不能证明恢复了原始源码或全部设备功能。", "targets": [ "firmware" ], "title": "User-Space Dependency-Aware Rehosting for Linux-Based Firmware Binaries", "title_zh": "面向 Linux 固件二进制的用户空间依赖感知重托管", "url": "https://www.ndss-symposium.org/ndss-paper/user-space-dependency-aware-rehosting-for-linux-based-firmware-binaries/", "venue": "NDSS 2026", "verification": "source-reviewed", "verified_at": "2026-10-17", "why_fits_en": "A concrete method for reconstructing the dependencies around shipped firmware binaries, complementing HAL-level and full-system rehosting research.", "why_fits_zh": "提供围绕已发布固件二进制重建运行依赖的具体方法，可与 HAL 层及全系统重托管研究互补。", "year": 2026 }, { "arxiv_id": null, "arxiv_version_reviewed": null, "authors": [ "Tobias Scharnowski", "Nils Bars", "Moritz Schloegel", "Eric Gustafson", "Marius Muench", "Giovanni Vigna", "Christopher Kruegel", "Thorsten Holz", "Ali Abbasi" ], "citation": { "container_title": "31st USENIX Security Symposium (USENIX Security 22)", "pages": "1239-1256", "publisher": "USENIX Association", "sources": [ "https://www.usenix.org/conference/usenixsecurity22/presentation/scharnowski" ] }, "code_url": "https://github.com/fuzzware-fuzzer/fuzzware", "date_basis": "Publication month in the official USENIX proceedings citation; no exact publication day is asserted.", "date_basis_zh": "采用 USENIX 官方论文集引用中的出版月份，不推定具体出版日。", "date_precision": "month", "description_en": "Rehosts monolithic ARM Cortex-M firmware for fuzzing, using locally scoped symbolic execution to model memory-mapped I/O accesses and focus input mutations on values relevant to firmware logic.", "description_zh": "重托管单体 ARM Cortex-M 固件以开展模糊测试，利用局部符号执行为内存映射 I/O 访问建模，使输入变异集中于影响固件逻辑的值。", "doi": null, "entry_url": "https://awesomerea.org/papers/paper-fuzzware/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-fuzzware/", "evidence_urls": [ "https://www.usenix.org/conference/usenixsecurity22/presentation/scharnowski", "https://www.usenix.org/system/files/sec22-scharnowski.pdf", "https://www.usenix.org/system/files/usenixsecurity22-scharnowski.pdf", "https://github.com/fuzzware-fuzzer/fuzzware/blob/424fce42bbe0cef3928ae589b8f6bbac666857e1/README.md", "https://github.com/fuzzware-fuzzer/fuzzware/blob/424fce42bbe0cef3928ae589b8f6bbac666857e1/LICENSE", "https://github.com/fuzzware-fuzzer/fuzzware-experiments/blob/b6462adfa125ae1664077a0aa912c081cfde1c4a/README.md", "https://github.com/fuzzware-fuzzer/fuzzware-experiments/blob/b6462adfa125ae1664077a0aa912c081cfde1c4a/LICENSE", "https://zenodo.org/records/6499215" ], "first_arxiv_date": null, "id": "paper-fuzzware", "kind": "research", "metadata_notes": "The official proceedings give pages 1239–1256 and nine authors. No paper DOI or arXiv identifier was verified. Zenodo DOI 10.5281/zenodo.6499215 identifies the software artifact, not this paper. The artifact appendix names the sec22-ae-accepted release and declares Apache-2.0 for code and data; third-party components retain their own terms.", "metadata_notes_zh": "官方论文集列出页码 1239–1256 和九位作者。未核实论文 DOI 或 arXiv 标识符。Zenodo DOI 10.5281/zenodo.6499215 标识软件产物，并非本论文。产物附录指定 sec22-ae-accepted 版本，并将代码和数据声明为 Apache-2.0；第三方组件仍适用各自条款。", "pdf_url": "https://www.usenix.org/system/files/sec22-scharnowski.pdf", "project_url": null, "publication_date": "2022-08", "publication_status": "conference-paper", "runtime_tested": false, "scope_limitations_en": "The Cortex-M3/M4 artifact requires memory-map configuration and does not automatically model DMA. Abstracting hardware can produce crashes that are impossible on the physical device. This is an analysis environment, not original-source recovery or faithful full-device reconstruction.", "scope_limitations_zh": "面向 Cortex-M3/M4 的产物需要配置内存映射，且不会自动为 DMA 建模。对硬件的抽象可能产生真实设备上不可能出现的崩溃。该工作构建分析环境，不代表恢复原始源码或忠实重建完整设备。", "targets": [ "firmware" ], "title": "Fuzzware: Using Precise MMIO Modeling for Effective Firmware Fuzzing", "title_zh": "Fuzzware：利用精确的 MMIO 建模提升固件模糊测试效果", "url": "https://www.usenix.org/conference/usenixsecurity22/presentation/scharnowski", "venue": "USENIX Security 2022", "verification": "source-reviewed", "verified_at": "2026-10-16", "why_fits_en": "Shows how firmware logic can be exercised without its original hardware by reconstructing enough of the execution environment for dynamic analysis.", "why_fits_zh": "展示如何恢复动态分析所需的执行环境，使固件逻辑能够脱离原始硬件运行。", "year": 2022 }, { "arxiv_id": null, "arxiv_version_reviewed": null, "authors": [ "Matthew Guzdial", "Boyang Li", "Mark O. Riedl" ], "code_url": null, "date_basis": "The IJCAI-deposited Crossref record gives August 2017 for print publication, represented at month precision. The IJCAI proceedings page gives no publication day, and the conference dates are not substituted.", "date_basis_zh": "IJCAI 提交的 Crossref 记录将印刷出版日期记为 2017 年 8 月，本条目按月精度记录。IJCAI 论文集页面未给出具体出版日，本条目也不以会议日期替代。", "date_precision": "month", "description_en": "Learns a rule-based forward simulator of a 2D game from gameplay video. Using a supplied sprite palette, OpenCV locates sprites in each frame; matched sprites are converted into hand-designed fact types for animation, position, relative distance, x and y velocity and camera offset. Game Engine Search then scans the frames, and whenever the current engine’s predicted next frame differs from the real one by more than a threshold, it runs a greedy search over engines that add or modify condition–effect rules or mark them as player-controlled. Engines are ranked by pixel error and rule count. Trained on one Super Mario Bros. Level 1-1 video, the learned engine predicts frames of a different player’s video more accurately than a CNN frame predictor and a previous-frame baseline, and a value-iteration agent planning with it shows no significant difference from one using the Infinite Mario engine’s native forward simulation.", "description_zh": "从游戏录像中学习二维游戏的基于规则的前向模拟器。系统借助提供的精灵图集，用 OpenCV 定位每帧中的精灵；匹配后的精灵被转换为人工设计的事实类型，包括动画、位置、相对距离、x 与 y 方向速度及镜头偏移。随后 Game Engine Search 逐帧扫描，每当当前引擎预测的下一帧与真实帧的差异超过阈值时，便对引擎进行贪心搜索：新增或修改“条件—效果”规则，或将规则标记为玩家控制。引擎按像素误差与规则数量排序。在一段《超级马力欧兄弟》1-1 关卡视频上训练后，所学引擎预测另一位玩家视频帧的准确度高于 CNN 帧预测器与沿用上一帧的基线，基于它进行规划的价值迭代智能体，其表现与使用 Infinite Mario 引擎原生前向模拟的智能体无显著差异。", "doi": "10.24963/ijcai.2017/518", "entry_url": "https://awesomerea.org/papers/paper-game-engine-learning/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-game-engine-learning/", "evidence_urls": [ "https://www.ijcai.org/proceedings/2017/518", "https://www.ijcai.org/proceedings/2017/0518.pdf", "https://api.crossref.org/works/10.24963/ijcai.2017/518" ], "first_arxiv_date": null, "id": "paper-game-engine-learning", "kind": "research", "metadata_notes": "The IJCAI proceedings page and the 7-page PDF give the three authors, the IJCAI-17 main track and pages 3707–3713; the Crossref record matches the authors and DOI. The paper links no code, learned engines or parsed data, and the Super Mario Bros. footage and fan-made sprite sheet are third-party materials. No code or experiments were run.", "metadata_notes_zh": "IJCAI 论文集页面与 7 页 PDF 给出三位作者、IJCAI-17 主赛道及第 3707–3713 页；Crossref 记录的作者与 DOI 与之一致。论文未链接代码、学得的引擎或解析数据，《超级马力欧兄弟》录像与爱好者制作的精灵图集均属第三方材料。本次未运行代码或实验。", "pdf_url": "https://www.ijcai.org/proceedings/2017/0518.pdf", "project_url": null, "publication_date": "2017-08", "publication_status": "conference-paper", "runtime_tested": false, "scope_limitations_en": "The evaluation covers one level of one game: training uses a single “speedrunner” video of Super Mario Bros. Level 1-1 (1,569 frames), and testing uses an “explorer” video of the same level. Frame parsing depends on a fan-authored sprite sheet and hand-authored fact types, which the authors say makes the method less applicable to more complex domains such as real video. The learned engine is a set of search-derived rules for on-screen sprite behavior, not recovered game code or a binary; it does not represent player death or level transitions, and mechanics absent from Level 1-1 are not expected to transfer. Search can be slow at low thresholds, up to two weeks for one level on a 2013 iMac, and the reported run used a zero threshold. The CNN comparison used downscaled grayscale frames, and the gameplay comparison is indirect, through agents in the Infinite Mario engine.", "scope_limitations_zh": "评测只涵盖一款游戏的一个关卡：训练使用《超级马力欧兄弟》1-1 关卡的一段“速通玩家”视频（1,569 帧），测试使用同一关卡的“探索型玩家”视频。帧解析依赖爱好者制作的精灵图集与人工编写的事实类型，作者也指出这使方法较难应用于真实视频等更复杂的领域。所学引擎是通过搜索得到的、描述屏幕上精灵行为的规则集合，并非恢复的游戏代码或二进制；它不表示玩家死亡与关卡切换，1-1 关卡中未出现的机制也不应期望能够迁移。阈值较低时搜索可能很慢，在 2013 年的 iMac 上单个关卡最长需两周，报告的实验使用零阈值。CNN 比较使用缩小后的灰度帧，游戏表现比较则通过 Infinite Mario 引擎中的智能体间接进行。", "targets": [ "game" ], "title": "Game Engine Learning from Video", "title_zh": "从视频中学习游戏引擎", "url": "https://www.ijcai.org/proceedings/2017/518", "venue": "IJCAI 2017", "verification": "source-reviewed", "verified_at": "2026-10-19", "why_fits_en": "Adds a search-based method for reconstructing game rules from gameplay video, complementing the section’s neural and LLM-based world-model and code-synthesis research.", "why_fits_zh": "补充一种基于搜索、从游戏录像重建游戏规则的方法，与本节基于神经网络及大语言模型的世界模型与代码合成研究互补。", "year": 2017 }, { "arxiv_id": "2005.12126", "arxiv_version_reviewed": "v1", "authors": [ "Seung Wook Kim", "Yuhao Zhou", "Jonah Philion", "Antonio Torralba", "Sanja Fidler" ], "code_url": "https://github.com/nv-tlabs/GameGAN_code", "date_basis": "IEEE’s Crossref deposit and an archived copy of the IEEE Xplore page give June 2020, represented at month precision. The May 2020 arXiv submission and the conference dates are not substituted.", "date_basis_zh": "IEEE 提交的 Crossref 元数据及 IEEE Xplore 页面存档副本均给出 2020 年 6 月，本条目按月精度记录，不以 2020 年 5 月的 arXiv 提交日期或会议日期替代。", "date_precision": "month", "description_en": "GameGAN learns an action-conditioned neural simulator of a game from recorded frames and the actions taken, without access to the game’s logic or engine. An action-conditioned LSTM dynamics engine with a stochastic latent variable predicts the next state, an optional external memory module builds an internal map so that revisited locations stay consistent, and a rendering engine decodes frames while separating static from dynamic components. Training is end-to-end with adversarial losses, including an action-conditioned discriminator, and a temporal cycle loss for memory consistency. The authors evaluate on a modified Pac-Man, a ghost-free Pac-Man-Maze and VizDoom “take cover”, training RL agents inside the learned simulators and testing them in the real games, and measure long-term consistency with a come-back-home task; a human-playable model of the official Pac-Man is shown qualitatively.", "description_zh": "GameGAN 从录制的画面帧及对应动作中学习游戏的动作条件神经模拟器，无需访问游戏逻辑或引擎。带随机潜变量的动作条件 LSTM 动力学引擎预测下一状态；可选的外部记忆模块构建内部地图，使重新访问的位置保持一致；渲染引擎在解码画面时区分静态与动态成分。模型以端到端方式训练，采用包括动作条件判别器在内的对抗损失，并用时间循环损失保持记忆一致性。作者在修改版 Pac-Man、无幽灵的 Pac-Man-Maze 及 VizDoom “take cover” 上进行评测：在学得的模拟器中训练强化学习智能体并在真实游戏中测试，并用“返回原点”任务衡量长期一致性；论文还定性展示了可由人类游玩的官方 Pac-Man 模型。", "doi": "10.1109/CVPR42600.2020.00131", "entry_url": "https://awesomerea.org/papers/paper-gamegan/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-gamegan/", "evidence_urls": [ "https://ieeexplore.ieee.org/document/9156900", "https://web.archive.org/web/20240914161135/https://ieeexplore.ieee.org/document/9156900/", "https://api.crossref.org/works/10.1109/CVPR42600.2020.00131", "https://openaccess.thecvf.com/content_CVPR_2020/papers/Kim_Learning_to_Simulate_Dynamic_Environments_With_GameGAN_CVPR_2020_paper.pdf", "https://arxiv.org/abs/2005.12126", "https://github.com/nv-tlabs/GameGAN_code/blob/1195c398e8ada865497a7f8c8a369de6e34cbd3f/readme.md", "https://github.com/nv-tlabs/GameGAN_code/blob/1195c398e8ada865497a7f8c8a369de6e34cbd3f/LICENSE", "https://github.com/nv-tlabs/GameGAN_code/blob/1195c398e8ada865497a7f8c8a369de6e34cbd3f/requirements.txt" ], "first_arxiv_date": "2020-05-25", "id": "paper-gamegan", "kind": "research", "metadata_notes": "Crossref and the archived IEEE Xplore page give the five authors, CVPR 2020 and pages 1228–1237; IEEE metadata capitalizes the title as “Learning to Simulate Dynamic Environments With GameGAN”, while the CVF open-access paper and arXiv print “with”. The 10-page CVF PDF is the Computer Vision Foundation’s open-access version; IEEE Xplore holds the version of record. arXiv has only v1, submitted 2020-05-25 with the comment “CVPR 2020”. The repository README at the reviewed 2021-11-11 commit gives BibTeX pages 1231–1240, which differ from IEEE, and its Project Page link points to an unrelated lift-splat-shoot page, so no project URL is recorded. The README lists Ubuntu 18.04 and Python 3.8.3, and requirements pin torch 1.4.0 and torchvision 0.5.0. LICENSE section 3.3 limits use to non-commercial research or evaluation. No code, data or experiments were run.", "metadata_notes_zh": "Crossref 与 IEEE Xplore 页面存档给出五位作者、CVPR 2020 及第 1228–1237 页；IEEE 元数据将标题写作“Learning to Simulate Dynamic Environments With GameGAN”，而 CVF 开放获取论文与 arXiv 中为小写“with”。10 页的 CVF PDF 是计算机视觉基金会提供的开放获取版本，版本记录以 IEEE Xplore 为准。arXiv 只有 2020-05-25 提交的 v1，备注为“CVPR 2020”。所审阅的 2021-11-11 提交中，仓库 README 的 BibTeX 页码为 1231–1240，与 IEEE 不同；其 Project Page 链接指向无关的 lift-splat-shoot 页面，因此不记录项目页面。README 列出 Ubuntu 18.04 与 Python 3.8.3，requirements 固定 torch 1.4.0 与 torchvision 0.5.0。LICENSE 第 3.3 条将使用限定为非商业的研究或评估用途。本次未运行代码、数据或实验。", "pdf_url": "https://openaccess.thecvf.com/content_CVPR_2020/papers/Kim_Learning_to_Simulate_Dynamic_Environments_With_GameGAN_CVPR_2020_paper.pdf", "project_url": null, "publication_date": "2020-06", "publication_status": "conference-paper", "runtime_tested": false, "scope_limitations_en": "GameGAN imitates a game’s pixels and dynamics; it does not recover game code, symbolic rules, assets or an executable. Training needs large logged datasets with actions: 40K Pac-Man episodes from a high-entropy DQN agent that sees the full environment, and 10K random-policy VizDoom episodes, at 84×84 and 64×64 resolution. Quantitative results cover small grid-based Pac-Man variants and one VizDoom scenario, with an external classifier supplying game outcomes. Agents trained in the simulators can exploit modeling errors: the full model sometimes let Pac-Man pass through walls, and its Pac-Man agents scored below those of the memoryless variant, while on VizDoom the World Model baseline scored higher than GameGAN. The released code supports VizDoom training only, relies on a deprecated WorldModels data setup, and is under the non-commercial NVIDIA Source Code License; Pac-Man data and the official Pac-Man model are not included.", "scope_limitations_zh": "GameGAN 模仿的是游戏的画面与动态，并不恢复游戏代码、符号规则、素材或可执行程序。训练需要带动作的大量日志数据：Pac-Man 使用 4 万个由能观察完整环境、高熵策略的 DQN 智能体生成的回合，VizDoom 使用 1 万个随机策略回合，分辨率分别为 84×84 与 64×64。定量结果只覆盖小型网格化的 Pac-Man 变体与一个 VizDoom 场景，并借助外部分类器给出游戏结果。在模拟器中训练的智能体可能利用建模误差：完整模型有时让 Pac-Man 穿过墙壁，其 Pac-Man 智能体得分低于无记忆版本；在 VizDoom 上，World Model 基线的得分高于 GameGAN。发布的代码只支持 VizDoom 训练，依赖已弃用的 WorldModels 数据准备流程，并采用仅限非商业用途的 NVIDIA Source Code License；其中不含 Pac-Man 数据及官方 Pac-Man 模型。", "targets": [ "game" ], "title": "Learning to Simulate Dynamic Environments with GameGAN", "title_zh": "使用 GameGAN 学习模拟动态环境", "url": "https://ieeexplore.ieee.org/document/9156900", "venue": "CVPR 2020", "verification": "source-reviewed", "verified_at": "2026-10-19", "why_fits_en": "Adds a neural approach to reconstructing a playable game simulator from observed frames and actions, complementing the section’s program-synthesis and black-box game-replication research.", "why_fits_zh": "补充一种从观察到的画面与动作中重建可游玩游戏模拟器的神经网络方法，与本节的程序合成及黑盒游戏复刻研究互补。", "year": 2020 }, { "arxiv_id": "2609.22308", "arxiv_version_reviewed": "v1", "authors": [ "Boyu Qiao", "Zixin Tang", "Xiaoshuai Hao", "Wenbo Li" ], "code_url": null, "date_basis": "arXiv v1 submission history", "date_basis_zh": "arXiv v1 的首次提交日期。", "date_precision": "day", "description_en": "Evaluates whether vision-language agents can infer hidden game rules through screenshots and active interaction, then build runnable single-file HTML replicas across 125 tasks from 25 web games, each with five difficulty levels.", "description_zh": "通过来自 25 款网页游戏、各设五个难度级别的 125 个任务，评估视觉语言智能体能否通过截图和主动交互推断隐藏规则，并构建可运行的单文件 HTML 游戏复刻。", "doi": "10.48550/arXiv.2609.22308", "entry_url": "https://awesomerea.org/papers/paper-gamereplica/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-gamereplica/", "evidence_urls": [ "https://arxiv.org/abs/2609.22308", "https://arxiv.org/html/2609.22308v1", "https://qqqqqqby.github.io/GameReplica/" ], "first_arxiv_date": "2026-09-15", "id": "paper-gamereplica", "kind": "research", "metadata_notes": "The official project page marks the work as under review. arXiv reports the v1 submission on 2026-09-15 and displays its arXiv DOI as pending registration. The project link is a showcase with demos, not a verified release of the full evaluation framework.", "metadata_notes_zh": "官方项目页将该工作标注为审稿中。arXiv 记载 v1 于 2026-09-15 提交，并将其 arXiv DOI 标注为待注册。项目链接为含演示的展示页，不代表已核实发布完整评测框架。", "pdf_url": "https://arxiv.org/pdf/2609.22308v1", "project_url": "https://qqqqqqby.github.io/GameReplica/", "publication_date": "2026-09-15", "publication_status": "preprint", "runtime_tested": false, "scope_limitations_en": "The tasks cover rule-driven web puzzles and board games, not native or commercial game reconstruction. Rule, implementation, and visual scores use LLM judges and do not prove behavioral equivalence. The official site provides demos; a benchmark-code repository was not verified.", "scope_limitations_zh": "任务覆盖以规则为核心的网页解谜和棋盘游戏，不代表原生或商业游戏重建能力。规则、实现和视觉评分使用 LLM 评审，不能证明行为等价。官方网站提供演示，尚未核实基准代码仓库。", "targets": [ "game", "website" ], "title": "GameReplica: A Benchmark for Black-Box Visual Game Replication by Vision-Language Agents", "title_zh": "GameReplica：视觉语言智能体的黑盒视觉游戏复刻基准", "url": "https://arxiv.org/abs/2609.22308", "venue": "arXiv", "verification": "source-reviewed", "verified_at": "2026-10-16", "why_fits_en": "Directly evaluates active black-box specification recovery and executable game reconstruction, filling the bibliography’s game-replication gap.", "why_fits_zh": "直接评估主动黑盒规格恢复与可执行游戏重建，补充书目中的游戏复刻研究。", "year": 2026 }, { "arxiv_id": "2306.02546", "arxiv_version_reviewed": "v4", "authors": [ "Xiangzhe Xu", "Zhuo Zhang", "Zian Su", "Ziyang Huang", "Shiwei Feng", "Yapeng Ye", "Nan Jiang", "Danning Xie", "Siyuan Cheng", "Lin Tan", "Xiangyu Zhang" ], "code_url": "https://github.com/XZ-X/gennm-ndss-ae/tree/9955139b4c8d43144852a674bf317cbfaf32ed17", "date_basis": "The official NDSS paper and the publisher’s Crossref deposit establish publication year 2025. The conference dates and the arXiv versions do not establish a publication day.", "date_basis_zh": "NDSS 官方论文与出版方提交的 Crossref 元数据确认出版年份为 2025；会议日期与各 arXiv 版本日期不能据此推定具体出版日。", "date_precision": "year", "description_en": "GenNm suggests names for placeholder variables in decompiled code of stripped binaries by fine-tuning generative code models (CodeGemma-2B by default; CodeLlama-7B and a LoRA-tuned CodeLlama-34B are also tested). Queries add renamed caller code and callee signatures propagated along the call graph; a DPO-style symbol-preference optimization (SymPO) counters bias toward frequent training names, and a data-flow name-validation step chooses among candidates over iterative rounds. The authors report 5.6–11.4-point precision gains over VarBERT and ReSym on rebuilt DIRTY and VarCorpus datasets, and 22.8% precision on names unseen in training against 17.3% for the strongest baseline.", "description_zh": "GenNm 通过微调生成式代码模型（默认 CodeGemma-2B，另测试 CodeLlama-7B 及经 LoRA 微调的 CodeLlama-34B），为剥离符号二进制反编译代码中的占位变量建议名称。查询会加入沿调用图传播、已重命名的调用者代码与被调用者签名；类 DPO 的符号偏好优化（SymPO）抑制模型偏向训练集中高频名称，基于数据流的名称验证步骤则在多轮迭代中从候选名称里选择。作者报告，在重建的 DIRTY 与 VarCorpus 数据集上，其精确率比 VarBERT 和 ReSym 高 5.6–11.4 个百分点；对训练中未出现的名称，精确率为 22.8%，最强基线为 17.3%。", "doi": "10.14722/ndss.2025.240276", "entry_url": "https://awesomerea.org/papers/paper-gennm/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-gennm/", "evidence_urls": [ "https://www.ndss-symposium.org/ndss-paper/unleashing-the-power-of-generative-model-in-recovering-variable-names-from-stripped-binary/", "https://www.ndss-symposium.org/wp-content/uploads/2025-276-paper.pdf", "https://api.crossref.org/works/10.14722/ndss.2025.240276", "https://arxiv.org/abs/2306.02546v1", "https://arxiv.org/abs/2306.02546v2", "https://arxiv.org/abs/2306.02546v4", "https://github.com/XZ-X/gennm-ndss-ae/blob/9955139b4c8d43144852a674bf317cbfaf32ed17/README.md", "https://github.com/XZ-X/gennm-ndss-ae/blob/9955139b4c8d43144852a674bf317cbfaf32ed17/LICENSE", "https://github.com/XZ-X/gennm-ndss-ae/blob/9955139b4c8d43144852a674bf317cbfaf32ed17/requirements.txt", "https://zenodo.org/api/records/14220042", "https://zenodo.org/api/records/14287032" ], "first_arxiv_date": "2023-06-05", "id": "paper-gennm", "kind": "research", "metadata_notes": "The record uses the NDSS title and the 11 authors in the NDSS paper's order, which match Crossref; Crossref gives year 2025 without pages. The arXiv record has carried three titles. v1 of 2023-06-05, 'LmPa: Improving Decompilation by Synergy of Large Language Model and Program Analysis', listed nine authors, without Ziyang Huang and Danning Xie; its title framed the work as improving decompilation in general, although its abstract already targeted variable-name recovery. v2 of 2024-05-01 was 'Leveraging Generative Models to Recover Variable Names from Stripped Binary'. v3 of 2024-07-20 and v4 of 2024-12-09, with the 11 NDSS authors, are 'Symbol Preference Aware Generative Models for Recovering Variable Names from Stripped Binary'; the NDSS paper defers implementation details to this extended version. The paper cites the artifact as Zenodo 10.5281/zenodo.14220042, a v1.0 code snapshot under concept DOI 10.5281/zenodo.14220041 as in the README badge. The reviewed 2026-01-29 repository commit is MIT-licensed, and Zenodo record 14287032 holds a 9.8 GB CC-BY-4.0 data package with intermediate results and model checkpoints. The README asks for Ubuntu 20.04+, Python 3.10 with vllm 0.5.3.post1, at least 24 GB of GPU memory for inference and 96 GB for training. No data or models were downloaded and no code or experiments were run.", "metadata_notes_zh": "本条目采用 NDSS 标题，并按 NDSS 论文顺序列出 11 位作者，与 Crossref 一致；Crossref 仅给出 2025 年，未列页码。arXiv 记录先后使用过三个标题。2023-06-05 的 v1 题为“LmPa: Improving Decompilation by Synergy of Large Language Model and Program Analysis”，列出九位作者，不含 Ziyang Huang 与 Danning Xie；该标题将工作表述为泛化的反编译改进，但其摘要已聚焦变量名恢复。2024-05-01 的 v2 题为“Leveraging Generative Models to Recover Variable Names from Stripped Binary”。2024-07-20 的 v3 与 2024-12-09 的 v4 列出 NDSS 的 11 位作者，题为“Symbol Preference Aware Generative Models for Recovering Variable Names from Stripped Binary”；NDSS 论文将实现细节留给这一扩展版本。论文将产物引用为 Zenodo 10.5281/zenodo.14220042，即概念 DOI 10.5281/zenodo.14220041（与 README 徽章一致）下的 v1.0 代码快照。所审阅的 2026-01-29 仓库提交采用 MIT 许可，Zenodo 记录 14287032 提供 9.8 GB、采用 CC-BY-4.0 的数据包，内含中间结果与模型检查点。README 要求 Ubuntu 20.04+、带 vllm 0.5.3.post1 的 Python 3.10，推理至少需要 24 GB 显存，训练建议 96 GB。本次未下载数据或模型，也未运行代码或实验。", "pdf_url": "https://www.ndss-symposium.org/wp-content/uploads/2025-276-paper.pdf", "project_url": null, "publication_date": null, "publication_status": "conference-paper", "runtime_tested": false, "scope_limitations_en": "Predictions are scored against debug-symbol names by token matching with SymLM's word clusters and rules, plus a GPT-4 evaluator for context relevance and semantic accuracy; neither shows that outputs are the original identifiers, and overall split-by-binary precision is 35.8% (DIRTY) and 41.2% (VarCorpus). Precision is about 30% for projects unseen in training, and gains are smaller at -O2 and -O3. Ground truth comes from debug information in Linux binaries rebuilt from GitHub projects or Gentoo packages, with IDA Pro output in the paper's examples. GenNm needs each binary's call graph, which is why the DIRTY dataset was rebuilt; split-by-function VarCorpus results use a 15% binary sample, and the black-box GPT-3.5/GPT-4 comparison uses 1,000 sampled functions. It recovers variable names only, not types, function names or full decompiled code.", "scope_limitations_zh": "预测结果依据调试符号中的名称评分：一方面借助 SymLM 的词簇与规则进行词元匹配，另一方面由 GPT-4 评估器判断上下文相关性与语义准确性；两者都不能说明输出就是原始标识符，按二进制划分时整体精确率为 35.8%（DIRTY）和 41.2%（VarCorpus）。对训练中未出现的项目，精确率约为 30%，在 -O2 与 -O3 下的提升也较小。真实标签来自由 GitHub 项目或 Gentoo 软件包重建的 Linux 二进制文件中的调试信息，论文示例使用 IDA Pro 输出。GenNm 需要每个二进制的调用图，这也是重建 DIRTY 数据集的原因；VarCorpus 按函数划分的结果只使用 15% 的二进制样本，与黑盒 GPT-3.5／GPT-4 的比较使用 1,000 个抽样函数。它只恢复变量名，不恢复类型、函数名或完整的反编译代码。", "targets": [ "binary" ], "title": "Unleashing the Power of Generative Model in Recovering Variable Names from Stripped Binary", "title_zh": "释放生成式模型在剥离符号二进制变量名恢复中的能力", "url": "https://www.ndss-symposium.org/ndss-paper/unleashing-the-power-of-generative-model-in-recovering-variable-names-from-stripped-binary/", "venue": "NDSS 2025", "verification": "source-reviewed", "verified_at": "2026-10-18", "why_fits_en": "Adds generative, call-graph-aware variable-name recovery with explicit treatment of name-frequency bias, extending the learned-naming line of work in this section.", "why_fits_zh": "补充结合调用图上下文、并专门处理名称频率偏差的生成式变量名恢复方法，延续了本节的学习式命名研究。", "year": 2025 }, { "arxiv_id": null, "arxiv_version_reviewed": null, "authors": [ "Atif Memon", "Ishan Banerjee", "Adithya Nagarajan" ], "code_url": null, "date_basis": "IEEE Xplore gives the publication date as 2003 and the proceedings title as WCRE 2003; the Crossref deposit has no publication date. Year precision is retained, and the conference dates and the 2004 Xplore insertion date are not substituted.", "date_basis_zh": "IEEE Xplore 给出的出版日期为 2003 年，论文集名称为 WCRE 2003；Crossref 元数据未记载出版日期。本条目保留年精度，不以会议日期或 2004 年的 Xplore 收录日期替代。", "date_precision": "year", "description_en": "GUI ripping reverse engineers a test model from a running desktop application rather than from its source code or specifications. Starting from the top-level windows, a ripper opens each child window by programmatically clicking executable widgets, records every window’s widgets, properties and values, and builds a GUI forest of windows. From that forest it derives event-flow graphs, which record which events can follow one another within a component, and an integration tree of component invocations. The paper describes rippers for Microsoft Windows applications, using window handles and the Windows API, and for Java Swing applications, using Java’s AWT and Swing APIs. It applies them to WordPad, Notepad, Yahoo Messenger and four applications of the TerpOffice student office suite, with the models feeding automated test generation in the authors’ GUITAR and DART systems.", "description_zh": "GUI 抓取从运行中的桌面应用程序逆向工程出测试模型，而不依赖其源码或规格说明。抓取器从顶层窗口开始，以编程方式点击可执行控件逐一打开子窗口，记录每个窗口的控件、属性与取值，并构建由窗口组成的 GUI 森林。它再从森林推导出事件流图（记录组件内哪些事件可以相继发生）以及表示组件调用关系的集成树。论文介绍了两种抓取器：面向 Microsoft Windows 应用、基于窗口句柄与 Windows API 的实现，以及面向 Java Swing 应用、基于 Java AWT 与 Swing API 的实现。作者将其应用于 WordPad、Notepad、Yahoo Messenger 及学生开发的 TerpOffice 办公套件中的四个应用，所得模型用于作者 GUITAR 与 DART 系统中的自动化测试生成。", "doi": "10.1109/WCRE.2003.1287256", "entry_url": "https://awesomerea.org/papers/paper-gui-ripping/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-gui-ripping/", "evidence_urls": [ "https://ieeexplore.ieee.org/document/1287256", "https://web.archive.org/web/20251228032001/https://ieeexplore.ieee.org/document/1287256/", "https://api.crossref.org/works/10.1109/WCRE.2003.1287256", "https://www.cs.umd.edu/~atif/papers/MemonWCRE2003.pdf" ], "first_arxiv_date": null, "id": "paper-gui-ripping", "kind": "research", "metadata_notes": "IEEE Xplore and Crossref list the authors only as A. Memon, I. Banerjee and A. Nagarajan, with pages 260–269 in the 10th Working Conference on Reverse Engineering proceedings (Victoria, BC); the record uses the full names printed in the paper. The title follows IEEE’s sentence case; the paper capitalizes it as “GUI Ripping: Reverse Engineering of Graphical User Interfaces for Testing”. The PDF is the 10-page copy on Atif Memon’s University of Maryland page; IEEE Xplore holds the version of record and does not mark it open access. The paper says the GUI Ripper was made available as a downloadable tool and cites guitar.cs.umd.edu, but that host did not resolve during this review; no code link is recorded, and the later GUITAR project is not treated as this paper’s artifact. No code or experiments were run.", "metadata_notes_zh": "IEEE Xplore 与 Crossref 仅以 A. Memon、I. Banerjee 和 A. Nagarajan 列出作者，页码为第 10 届逆向工程工作会议（Victoria, BC）论文集第 260–269 页；本条目采用论文中印出的作者全名。标题沿用 IEEE 的句首大写形式；论文中的写法为“GUI Ripping: Reverse Engineering of Graphical User Interfaces for Testing”。PDF 为 Atif Memon 在马里兰大学页面上提供的 10 页副本；版本记录以 IEEE Xplore 为准，后者未将其标为开放获取。论文称 GUI Ripper 已作为可下载工具提供，并引用 guitar.cs.umd.edu，但本次审阅时该主机名无法解析；本条目不记录代码链接，也不将后来的 GUITAR 项目视为本论文的产物。本次未运行代码或实验。", "pdf_url": "https://www.cs.umd.edu/~atif/papers/MemonWCRE2003.pdf", "project_url": null, "publication_date": null, "publication_status": "conference-paper", "runtime_tested": false, "scope_limitations_en": "The targets are 2003-era desktop GUIs on Microsoft Windows and Java Swing, not mobile apps or web interfaces; the model assumes deterministic events on widgets with discrete property values and excludes timing-dependent, continuous-media or nondeterministic GUIs. The recovered model is a window, widget and event structure for test generation, not UI code or application logic, and the paper does not establish complete behavioral coverage. Ripping can miss windows and widgets: the Windows ripper misses widgets that bypass the Windows API and cannot distinguish modal from modeless windows, while the Java ripper cannot extract the Print dialog structure. In the case studies, testers added missed windows manually, taking 5 to 10 minutes per application, and identified top-level windows by hand for Windows applications. Results come from seven applications and the authors’ own test pipeline.", "scope_limitations_zh": "目标是 2003 年前后 Microsoft Windows 与 Java Swing 上的桌面 GUI，而非移动应用或网页界面；模型假定控件上的事件结果确定且属性取值离散，不涵盖依赖时序、连续媒体或非确定性的 GUI。恢复出的模型是供测试生成使用的窗口、控件与事件结构，并非 UI 代码或应用逻辑，论文也未证明覆盖了全部行为。抓取可能遗漏窗口与控件：Windows 抓取器会遗漏绕过 Windows API 的控件，且无法区分模态与非模态窗口；Java 抓取器则无法提取打印对话框的结构。在案例研究中，测试人员需手动补充遗漏的窗口，每个应用耗时 5 至 10 分钟，并需为 Windows 应用手动指定顶层窗口。结果来自七个应用以及作者自己的测试流程。", "targets": [ "app" ], "title": "GUI ripping: reverse engineering of graphical user interfaces for testing", "title_zh": "GUI 抓取：面向测试的图形用户界面逆向工程", "url": "https://ieeexplore.ieee.org/document/1287256", "venue": "WCRE 2003", "verification": "source-reviewed", "verified_at": "2026-10-19", "why_fits_en": "Adds a classic execution-based method for recovering an application’s GUI structure and event model, complementing the section’s screenshot-to-code and app-analysis research.", "why_fits_zh": "补充一种经典的基于执行恢复应用 GUI 结构与事件模型的方法，与本节的截图转代码及应用分析研究互补。", "year": 2003 }, { "arxiv_id": null, "arxiv_version_reviewed": null, "authors": [ "Abraham A Clements", "Eric Gustafson", "Tobias Scharnowski", "Paul Grosen", "David Fritz", "Christopher Kruegel", "Giovanni Vigna", "Saurabh Bagchi", "Mathias Payer" ], "citation": { "container_title": "29th USENIX Security Symposium (USENIX Security 20)", "pages": "1201-1218", "publisher": "USENIX Association", "sources": [ "https://www.usenix.org/conference/usenixsecurity20/presentation/clements" ] }, "code_url": "https://github.com/embedded-sec/halucinator", "date_basis": "The official USENIX proceedings citation gives August 2020. Month precision is retained; the conference’s event dates are not substituted for a publication day.", "date_basis_zh": "USENIX 官方论文集引用信息给出 2020 年 8 月。保留月份精度，不把会议举办日期当作具体出版日。", "date_precision": "month", "description_en": "HALucinator rehosts monolithic ARM Cortex-M firmware by identifying hardware-abstraction-library functions and replacing them with authored Python handlers and peripheral models. LibMatch locates library interfaces; the QEMU/Avatar2 implementation supports interactive I/O, while the paper-associated HAL-fuzz variant uses AFL-Unicorn for fuzzing.", "description_zh": "HALucinator 识别单体 ARM Cortex-M 固件中的硬件抽象库函数，并用人工编写的 Python 处理函数和外设模型替换它们，从而重托管固件。LibMatch 定位库接口；QEMU/Avatar2 实现支持交互式输入输出，与论文关联的 HAL-fuzz 变体则使用 AFL-Unicorn 进行模糊测试。", "doi": null, "entry_url": "https://awesomerea.org/papers/paper-halucinator/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-halucinator/", "evidence_urls": [ "https://www.usenix.org/conference/usenixsecurity20/presentation/clements", "https://www.usenix.org/system/files/sec20-clements.pdf", "https://github.com/embedded-sec/halucinator/blob/fa85a1dcbaaa72bd425094fc3917abdd7d9b9a8a/README.md", "https://github.com/embedded-sec/halucinator/blob/fa85a1dcbaaa72bd425094fc3917abdd7d9b9a8a/LICENSE", "https://github.com/embedded-sec/halucinator/blob/fa85a1dcbaaa72bd425094fc3917abdd7d9b9a8a/dependencies.md", "https://github.com/embedded-sec/halucinator/blob/fa85a1dcbaaa72bd425094fc3917abdd7d9b9a8a/Developing.md", "https://github.com/embedded-sec/halucinator/blob/fa85a1dcbaaa72bd425094fc3917abdd7d9b9a8a/doc/tutorial/0_Preqs.md", "https://github.com/embedded-sec/halucinator/blob/fa85a1dcbaaa72bd425094fc3917abdd7d9b9a8a/doc/tutorial/1_HALucinator_overview.md", "https://github.com/embedded-sec/halucinator/blob/fa85a1dcbaaa72bd425094fc3917abdd7d9b9a8a/install_deps.sh", "https://github.com/ucsb-seclab/hal-fuzz/blob/1446408e64b25aa77971226b764d1db65fe8ba09/LICENSE", "https://github.com/ucsb-seclab/hal-fuzz/blob/1446408e64b25aa77971226b764d1db65fe8ba09/README.md", "https://github.com/ucsb-seclab/hal-fuzz/blob/1446408e64b25aa77971226b764d1db65fe8ba09/requirements.txt" ], "first_arxiv_date": null, "id": "paper-halucinator", "kind": "research", "metadata_notes": "Reviewed the final USENIX paper, pages 1201–1218; no DOI or arXiv identifier is asserted. The paper-linked embedded-sec/halucinator repository carries GPLv3, while the separate ucsb-seclab/hal-fuzz implementation carries Apache-2.0; these licenses are not interchangeable. The original README describes a lightly tested Ubuntu 16.04/18.04 and Python 3 environment with Avatar2, QEMU and GDB, and points to a newer project separately. Reproduction needs firmware images, compatible HAL/SDK inputs and configuration; vendor firmware, dependencies and SDK rights remain separate. HAL-fuzz uses simplified handlers and deterministic timers rather than wall-clock equivalence. No firmware binaries were retrieved and no upstream runtime or experiment was executed.", "metadata_notes_zh": "核查的是 USENIX 正式论文，页码 1201–1218；不推定 DOI 或 arXiv 标识。论文链接的 embedded-sec/halucinator 仓库采用 GPLv3，独立的 ucsb-seclab/hal-fuzz 实现采用 Apache-2.0，两者许可不可混同。原始 README 记载了仅经有限测试的 Ubuntu 16.04/18.04 与 Python 3 环境，依赖 Avatar2、QEMU 和 GDB，并另行指向较新项目。复现需要固件镜像、兼容的 HAL/SDK 输入及配置；厂商固件、依赖项和 SDK 的使用权需分别处理。HAL-fuzz 使用简化处理函数和确定性计时器，不保证与真实时钟等价。本次未获取固件二进制，也未运行上游程序或实验。", "pdf_url": "https://www.usenix.org/system/files/sec20-clements.pdf", "project_url": null, "publication_date": "2020-08", "publication_status": "conference-paper", "runtime_tested": false, "scope_limitations_en": "LibMatch requires an available HAL/library and a sufficiently similar compilation environment; compiler variation and inlining limit matching. Rehosting also needs a QEMU-supported architecture, firmware memory layout, interception addresses and authored handlers/models. Unmodeled direct hardware accesses may return zero or ignore writes, and simplified timing and peripheral behavior do not establish hardware equivalence. The authors’ rehosting and fuzzing demonstrations are not universal firmware coverage, complete device reconstruction or original-source recovery.", "scope_limitations_zh": "LibMatch 需要可获取的硬件抽象层或库，以及足够相似的编译环境；编译器差异与内联会限制匹配效果。重托管还需要 QEMU 支持的架构、固件内存布局、拦截地址及人工编写的处理函数和模型。未建模的直接硬件访问可能在读取时返回零、在写入时被忽略；简化的时序与外设行为不能证明硬件等价。作者的重托管与模糊测试演示不代表普遍覆盖所有固件、完整重建设备或恢复原始源代码。", "targets": [ "firmware" ], "title": "HALucinator: Firmware Re-hosting Through Abstraction Layer Emulation", "title_zh": "HALucinator：通过抽象层仿真实现固件重托管", "url": "https://www.usenix.org/conference/usenixsecurity20/presentation/clements", "venue": "USENIX Security 2020", "verification": "source-reviewed", "verified_at": "2026-10-17", "why_fits_en": "Shows how binary library identification and explicit environment models can reconstruct enough of an embedded execution environment to analyze existing firmware, with the abstraction boundary made visible.", "why_fits_zh": "展示如何通过二进制库识别与显式环境模型，重建分析已有固件所需的嵌入式执行环境，并明确其抽象边界。", "year": 2020 }, { "arxiv_id": null, "arxiv_version_reviewed": null, "authors": [ "Haojie He", "Xingwei Lin", "Ziang Weng", "Ruijie Zhao", "Shuitao Gan", "Libo Chen", "Yuede Ji", "Jiashui Wang", "Zhi Xue" ], "code_url": "https://github.com/NSSL-SJTU/HermesSim", "date_basis": "Publication month in the official USENIX proceedings BibTeX; the August 14–16, 2024 symposium dates are not used to assert a publication day.", "date_basis_zh": "采用 USENIX 官方论文集 BibTeX 中的出版月份；不以 2024 年 8 月 14–16 日的会议日期推定具体出版日。", "date_precision": "month", "description_en": "HermesSim detects binary code similarity by lifting each function to Ghidra P-code and building a semantics-oriented graph that exposes operand structure inside instructions, def-use, control-flow and effect-order relations, while dropping semantics-independent details such as which register temporarily holds a value. A gated graph neural network with a multi-head softmax aggregator embeds the graph, and functions are compared by embedding similarity. On the Dataset-1 benchmark of Marcelli et al., the authors report 48.1% RECALL@1 for x64 cross-compiler retrieval in pools of 10,000 functions, against 31.4% for a fine-tuned jTrans, with a 388K-parameter model.", "description_zh": "HermesSim 将每个函数提升为 Ghidra P-code，并构建面向语义的图，以显式表示指令内部的操作数结构、定义—使用关系、控制流及副作用顺序，同时舍弃与语义无关的细节，例如由哪个寄存器临时保存某个值。它使用带多头 softmax 聚合器的门控图神经网络对图进行嵌入，再按嵌入相似度比较函数。作者在 Marcelli 等人发布的 Dataset-1 基准上报告：在 10,000 个函数的候选池中进行 x64 跨编译器检索时，RECALL@1 为 48.1%，经微调的 jTrans 为 31.4%；HermesSim 模型参数量为 388K。", "doi": null, "entry_url": "https://awesomerea.org/papers/paper-hermessim/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-hermessim/", "evidence_urls": [ "https://www.usenix.org/conference/usenixsecurity24/presentation/he-haojie", "https://www.usenix.org/system/files/usenixsecurity24-he-haojie.pdf", "https://github.com/NSSL-SJTU/HermesSim/tree/db37ec664fda4ea9d26afe46ec28ff4de0d8ebc3", "https://github.com/NSSL-SJTU/HermesSim/blob/db37ec664fda4ea9d26afe46ec28ff4de0d8ebc3/README.md", "https://github.com/NSSL-SJTU/HermesSim/blob/db37ec664fda4ea9d26afe46ec28ff4de0d8ebc3/LICENSE", "https://github.com/NSSL-SJTU/HermesSim/blob/db37ec664fda4ea9d26afe46ec28ff4de0d8ebc3/requirements.txt", "https://github.com/sgfvamll/gsat/releases/tag/v1.0.0", "https://zenodo.org/records/10369788" ], "first_arxiv_date": null, "id": "paper-hermessim", "kind": "research", "metadata_notes": "The USENIX page, its BibTeX entry and the final PDF agree on the nine-author order, pages 1759–1776 and ISBN 978-1-939133-44-1; the page also lists a prepublication PDF. USENIX assigns no paper DOI and no arXiv version was found, so the record relies on the reviewed USENIX Security 2024 URL/PDF identity. The paper links github.com/NSSL-SJTU/HermesSim. At the reviewed 2024-12-10 commit its LICENSE file is MIT for the project and reproduces MIT and Apache-2.0 notices for included Cisco Talos and DeepMind code, which is why GitHub reports no single license. The README's paper link uses /presentation/he, which redirects to the he-haojie page. Lifting calls the separate GPL-3.0 GSAT Ghidra toolkit (gsat-1.0.jar). Zenodo record 10.5281/zenodo.10369788 (CC BY 4.0), linked from the README, holds the Dataset-RTOS binaries and archives of about 17 GB, 19 GB and 5 GB with extracted features, model inputs and outputs; that DOI identifies the data, not the paper. Dataset-1 binaries come from the Cisco Talos binary_function_similarity repository. The pinned requirements target Python 3.10, PyTorch 1.13.1 with CUDA 11.6 and PyTorch Geometric 2.3.0. No archives were downloaded, and no code or experiments were run.", "metadata_notes_zh": "USENIX 页面、其 BibTeX 条目与最终 PDF 的九位作者顺序、页码 1759–1776 及 ISBN 978-1-939133-44-1 一致；该页面另列有预发表版 PDF。USENIX 不为论文分配 DOI，也未找到 arXiv 版本，因此本条目依据经审阅的 USENIX Security 2024 页面／PDF 出版方标识。论文链接 github.com/NSSL-SJTU/HermesSim。在所审阅的 2024-12-10 提交中，其 LICENSE 文件为项目声明 MIT 许可证，并附有所含 Cisco Talos 与 DeepMind 代码的 MIT 和 Apache-2.0 声明，因此 GitHub 未识别出单一许可证。README 中的论文链接使用 /presentation/he，该地址会重定向至 he-haojie 页面。提升步骤调用独立的 GPL-3.0 GSAT Ghidra 工具包（gsat-1.0.jar）。README 链接的 Zenodo 记录 10.5281/zenodo.10369788（CC BY 4.0）包含 Dataset-RTOS 二进制，以及约 17 GB、19 GB 和 5 GB 的压缩包，内含提取的特征、模型输入与输出；该 DOI 标识的是数据，而非论文。Dataset-1 的二进制来自 Cisco Talos 的 binary_function_similarity 仓库。固定版本的依赖面向 Python 3.10、PyTorch 1.13.1（CUDA 11.6）及 PyTorch Geometric 2.3.0。本次未下载压缩包，也未运行代码或实验。", "pdf_url": "https://www.usenix.org/system/files/usenixsecurity24-he-haojie.pdf", "project_url": null, "publication_date": "2024-08", "publication_status": "conference-paper", "runtime_tested": false, "scope_limitations_en": "Laboratory results reuse Dataset-1 from Marcelli et al.: 257K, 13K and 522K training, validation and test functions for x86, ARM and MIPS in 32 and 64 bits, built at O0–O3 and Os by GCC and Clang. HermesSim keeps that dataset's IDA Pro 7.3 control flow and basic-block boundaries and uses Ghidra only to disassemble and lift each block, so the results do not measure function or CFG recovery. Each setting samples 1,000 queries against pools of up to 10,000 functions, and the gains are relative to the paper's own runs of SAFE, Asm2Vec, GMN, Trex and jTrans, which supports x86 only and was compared on the x64 subset. The real-world study searches 62,605 ARM32 and MIPS32 functions from 12 RTOS firmware images of three vendors for 10 functions linked to 5 CVEs; its ground truth comes from manually examining the top 20 results of the compared methods. String, integer and external-symbol references are not encoded, only memory effects are modeled, and unresolved indirect branches leave graphs incomplete. Similarity ranks candidates for review; it does not establish equivalence or vulnerability.", "scope_limitations_zh": "实验室结果沿用 Marcelli 等人的 Dataset-1：训练、验证与测试集分别含 257K、13K 与 522K 个函数，覆盖 x86、ARM 和 MIPS 的 32 位与 64 位代码，由 GCC 和 Clang 以 O0–O3 及 Os 编译。HermesSim 保留该数据集由 IDA Pro 7.3 恢复的控制流和基本块边界，仅用 Ghidra 反汇编并提升各基本块，因此结果并不衡量函数或控制流图的恢复能力。每项设置抽取 1,000 个查询函数，候选池最多为 10,000 个函数；性能提升是相对于论文自行运行的 SAFE、Asm2Vec、GMN、Trex 和 jTrans 而言，其中 jTrans 仅支持 x86，只在 x64 子集上比较。真实场景实验在来自三家厂商 12 个 RTOS 固件映像的 62,605 个 ARM32 与 MIPS32 函数中，检索与 5 个 CVE 相关的 10 个函数；其真实标签来自对各比较方法前 20 个结果的人工检查。方法不编码字符串、整数及外部符号引用，只建模内存副作用，未解析的间接跳转也会使图不完整。相似度用于为人工审查排列候选，并不能证明等价性或存在漏洞。", "targets": [ "binary" ], "title": "Code is not Natural Language: Unlock the Power of Semantics-Oriented Graph Representation for Binary Code Similarity Detection", "title_zh": "代码并非自然语言：释放面向语义的图表示在二进制代码相似性检测中的潜力", "url": "https://www.usenix.org/conference/usenixsecurity24/presentation/he-haojie", "venue": "USENIX Security 2024", "verification": "source-reviewed", "verified_at": "2026-10-19", "why_fits_en": "Adds learned binary code similarity search, which reverse engineers use to match functions across builds, recover library functions in stripped binaries and locate known vulnerable code, complementing decompilation and symbol-recovery research.", "why_fits_zh": "补充基于学习的二进制代码相似性检索；逆向工程中常借此跨版本匹配函数、在剥离符号的二进制中识别库函数并定位已知漏洞代码，与反编译和符号恢复研究互补。", "year": 2024 }, { "arxiv_id": "2610.14960", "arxiv_version_reviewed": "v1", "authors": [ "Samuele Doria", "Stefano De Rosa", "Ruoyu Wang", "Zion Leonahenahe Basque", "Eleonora Losiouk", "Simone Aonzo" ], "code_url": null, "date_basis": "arXiv v1 submission", "date_basis_zh": "arXiv v1 首次提交日期。", "date_precision": "day", "description_en": "Compares human and LLM-agent understanding and navigation on the same static reverse-engineering challenges, then studies how binary representations consume context windows.", "description_zh": "比较人类与 LLM 智能体在相同静态逆向挑战中的理解和导航方式，并研究二进制表示如何占用上下文窗口。", "doi": "10.48550/arxiv.2610.14960", "entry_url": "https://awesomerea.org/papers/paper-humans-machines-sre/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-humans-machines-sre/", "evidence_urls": [ "https://arxiv.org/abs/2610.14960", "https://arxiv.org/html/2610.14960v1", "https://api.datacite.org/dois/10.48550/arxiv.2610.14960" ], "first_arxiv_date": "2026-10-10", "id": "paper-humans-machines-sre", "kind": "research", "metadata_notes": "The original source review did not verify a conference venue or paper-specific public code link. On 2026-10-20, the official arXiv history still listed only v1. Although its abstract page labels the DOI as pending, DataCite reports the matching title and six authors as findable, registered on 2026-10-14. This is an identifier correction, not a new paper version or expanded experimental verification.", "metadata_notes_zh": "原有来源复核未确认会议发表场所或论文专属公开代码链接。2026-10-20 查询时，arXiv 官方历史仍只列 v1。尽管摘要页将 DOI 标为待注册，DataCite 中相同标题与六位作者的记录已可检索，登记日期为 2026-10-14。此处仅修正标识符，不代表论文出现新版本或扩大实验验证范围。", "pdf_url": "https://arxiv.org/pdf/2610.14960", "project_url": null, "publication_date": "2026-10-10", "publication_status": "preprint", "runtime_tested": false, "scope_limitations_en": "Understanding is graded on two compact challenges; the separate 4,000-binary study measures context capacity, not task-solving accuracy. The interface is static IDA/MCP without dynamic execution, and prior exposure to challenge source remains an acknowledged validity threat.", "scope_limitations_zh": "理解能力仅在两个紧凑挑战上评分；另一个包含 4,000 个二进制文件的实验测量上下文容量，并非解题准确率。接口为不含动态执行的静态 IDA/MCP，模型曾接触挑战源码的可能性仍是作者承认的有效性威胁。", "targets": [ "binary" ], "title": "Humans vs. Machines: A Comparison With AI Agents in Software Reverse Engineering", "title_zh": "人类与机器：AI 智能体在软件逆向工程中的对比研究", "url": "https://arxiv.org/abs/2610.14960", "venue": "arXiv", "verification": "source-reviewed", "verified_at": "2026-10-16", "why_fits_en": "Informs tool-interface design, selective retrieval, and persistent analysis state for reverse-engineering agents.", "why_fits_zh": "为逆向智能体的工具接口、选择性检索及持久分析状态设计提供依据。", "year": 2026 }, { "arxiv_id": null, "arxiv_version_reviewed": null, "authors": [ "Yibo Qu", "Dongliang Fang", "Zhen Wang", "Jiaxing Cheng", "Shuaizong Si", "Yongle Chen", "Limin Sun" ], "citation": { "article_number": "ISSTA105", "container_title": "Proceedings of the ACM on Software Engineering", "issue": "ISSTA", "pages": "2384-2406", "publisher": "ACM", "sources": [ "https://dl.acm.org/doi/10.1145/3728982", "https://api.crossref.org/works/10.1145/3728982" ], "volume": "2" }, "code_url": "https://github.com/QYbPtqyb/ICEPRE", "date_basis": "The ACM article page and publisher-deposited Crossref metadata agree on publication on 2025-06-22. The ISSTA presentation date is not substituted for this journal publication date.", "date_basis_zh": "ACM 文章页面与出版方提交的 Crossref 元数据均将出版日期列为 2025-06-22；本条目不以 ISSTA 报告日期替代该期刊出版日期。", "date_precision": "day", "description_en": "Infers message-field boundaries by following concrete message-guided paths through binary protocol parsers, then symbolically replaying them to extract byte-level data flow. It merges bytes using value-preserving operations and similar processing traces. For the 1,000-message datasets of four public ICS protocols, the authors report average boundary F1 of 0.76 and field perfection of 0.67.", "description_zh": "在二进制协议解析器中沿具体报文引导的路径分析，再进行符号化重放，提取字节级数据流以推断报文字段边界。它依据保持原值的运算和相似处理轨迹合并字节。作者在四种公开工控协议、每组 1,000 条报文的数据集上，报告平均边界 F1 分数为 0.76、字段完美分割率为 0.67。", "doi": "10.1145/3728982", "entry_url": "https://awesomerea.org/papers/paper-icepre/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-icepre/", "evidence_urls": [ "https://dl.acm.org/doi/10.1145/3728982", "https://api.crossref.org/works/10.1145/3728982", "https://github.com/QYbPtqyb/ICEPRE/blob/506bdf1f970460d0eaa52f67ae9ae338795ef48b/README.md", "https://github.com/QYbPtqyb/ICEPRE/blob/506bdf1f970460d0eaa52f67ae9ae338795ef48b/requirements.txt", "https://github.com/QYbPtqyb/ICEPRE/blob/506bdf1f970460d0eaa52f67ae9ae338795ef48b/ICEPRE.py", "https://github.com/QYbPtqyb/ICEPRE/blob/506bdf1f970460d0eaa52f67ae9ae338795ef48b/Ctracer.py", "https://github.com/QYbPtqyb/ICEPRE/blob/506bdf1f970460d0eaa52f67ae9ae338795ef48b/InferSyntax.py", "https://github.com/QYbPtqyb/ICEPRE/blob/506bdf1f970460d0eaa52f67ae9ae338795ef48b/config/modbus_config.yaml", "https://github.com/QYbPtqyb/ICEPRE/blob/506bdf1f970460d0eaa52f67ae9ae338795ef48b/config/enip_config.yaml", "https://github.com/QYbPtqyb/ICEPRE/blob/506bdf1f970460d0eaa52f67ae9ae338795ef48b/config/iec104_config.yaml", "https://github.com/QYbPtqyb/ICEPRE/blob/506bdf1f970460d0eaa52f67ae9ae338795ef48b/config/s7comm_config.yaml", "https://github.com/QYbPtqyb/ICEPRE/blob/506bdf1f970460d0eaa52f67ae9ae338795ef48b/evaluation/syntax_evaluation.py" ], "first_arxiv_date": null, "id": "paper-icepre", "kind": "research", "metadata_notes": "The publisher identifies article ISSTA105 and licenses the paper under CC BY 4.0; its Data Availability section links the repository. The reviewed 2025-04-16 code snapshot has no project-level license declaration. Python 3 dependencies use compatible-release bounds, including angr~=9.2.100, Netzob~=2.0.0 and scapy~=2.5.0; the paper describes Ghidra 11.0.3 for function analysis. The repository includes public-protocol configurations and a Modbus capture, but no firmware images; target binaries and libraries need separate provision. The paper specifies trace-similarity threshold 0.9, while released InferSyntax.py uses 99 on a 100-point scale. Its batch evaluator excludes abnormal traces from aggregate metrics. These source differences prevent treating this snapshot as a reproduced paper configuration. No firmware, captures or model payloads were downloaded, and no upstream code or experiments were run.", "metadata_notes_zh": "出版方将文章编号列为 ISSTA105，并以 CC BY 4.0 授权论文；其数据可用性章节链接了仓库。所审阅的 2025-04-16 代码快照未声明项目级许可证。Python 3 依赖使用兼容版本范围，包括 angr~=9.2.100、Netzob~=2.0.0 与 scapy~=2.5.0；论文说明使用 Ghidra 11.0.3 进行函数分析。仓库包含公开协议配置和一份 Modbus 捕获数据，但没有固件映像；目标二进制与库需要另行提供。论文指定轨迹相似度阈值为 0.9，发布的 InferSyntax.py 则在百分制上使用 99。批量评估器将异常轨迹排除在汇总指标之外。这些源码差异意味着不能将此快照视为已复现的论文配置。本次未下载固件、捕获数据或模型载荷，也未运行上游代码或实验。", "pdf_url": "https://dl.acm.org/doi/pdf/10.1145/3728982", "project_url": null, "publication_date": "2025-06-22", "publication_status": "journal-article", "runtime_tested": false, "scope_limitations_en": "Recovers message syntax, not field semantics, protocol state machines or endpoint equivalence. It needs the binary, loader configuration and correctly identified initialization, input and parsing functions; manual filtering remains necessary, especially without symbols. Encrypted protocols and bit-level fields are unsupported, and ignored or only copied bytes can be merged incorrectly. Perfection measures fields with both boundaries correct. Quantitative tests use four public protocols with 50- and 1,000-message sets; separate proprietary studies cover three protocols in five firmware targets, with interaction checks on three devices and manually established ground truth. Those checks do not demonstrate complete device behavior.", "scope_limitations_zh": "恢复的是报文语法，并非字段语义、协议状态机或端点等价性。方法需要二进制、加载配置，以及正确识别的初始化、输入和解析函数；尤其在缺少符号时，仍需人工筛选。不支持加密协议和位级字段；被忽略或仅被复制的字节可能遭到错误合并。完美分割率衡量两端边界均正确的字段。量化实验使用四种公开协议的 50 条与 1,000 条报文集合；另行开展的专有协议研究覆盖五个固件目标中的三种协议，在三台设备上进行交互检查，并由人工建立真实标签。这些检查不能证明完整设备行为。", "targets": [ "protocol" ], "title": "ICEPRE: ICS Protocol Reverse Engineering via Data-Driven Concolic Execution", "title_zh": "ICEPRE：基于数据驱动混合符号执行的工控协议逆向工程", "url": "https://dl.acm.org/doi/10.1145/3728982", "venue": "Proceedings of the ACM on Software Engineering (ISSTA 2025)", "verification": "source-reviewed", "verified_at": "2026-10-17", "why_fits_en": "Adds firmware-assisted protocol format inference using concolic analysis, complementing live-server instrumentation and traffic-only field inference.", "why_fits_zh": "补充借助固件与混合符号分析推断协议格式的方法，与实时服务端插桩和仅基于流量的字段推断互补。", "year": 2025 }, { "arxiv_id": "2609.32413", "arxiv_version_reviewed": "v1", "authors": [ "Xu Zhang", "Hongzhang Zheng", "Zhili Huang", "Yaoyi Wang", "Ling Xu", "Sheng Huang" ], "code_url": null, "date_basis": "First arXiv v1 submission; no formal venue publication was verified.", "date_basis_zh": "采用 arXiv v1 首次提交日期；未核实正式会议或期刊出版。", "date_precision": "day", "description_en": "Benchmarks reconstruction of interactive charts from a reference screenshot, local data and specified actions. Its TRAIL framework uses Developer and Inspector agents with browser interaction traces to diagnose errors and revise the HTML/JavaScript implementation.", "description_zh": "评测根据参照截图、本地数据和指定动作重建交互图表。其 TRAIL 框架结合开发与检查智能体及浏览器交互轨迹，诊断错误并修订 HTML／JavaScript 实现。", "doi": "10.48550/arxiv.2609.32413", "entry_url": "https://awesomerea.org/papers/paper-ichart2code/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-ichart2code/", "evidence_urls": [ "https://arxiv.org/abs/2609.32413", "https://arxiv.org/html/2609.32413v1", "https://api.datacite.org/dois/10.48550/arxiv.2609.32413" ], "first_arxiv_date": "2026-09-26", "id": "paper-ichart2code", "kind": "research", "metadata_notes": "The six-author v1 identity matches arXiv and DataCite, which registered the arXiv DOI on 2026-09-29. The article uses the arXiv non-exclusive license. No author-linked public implementation, dataset release or corresponding license was verified in the reviewed full text and focused search. Referenced chart libraries and browser tools are not the benchmark release. No chart implementation, browser task, dataset payload or model was downloaded or executed.", "metadata_notes_zh": "六位作者的 v1 身份与 arXiv、DataCite 一致；后者于 2026-09-29 登记 arXiv DOI。文章采用 arXiv 非独占许可。所审阅全文及定向检索未核实作者链接的公开实现、数据集发布或相应许可。引用的图表库和浏览器工具不等于该基准发布。本次未下载或运行图表实现、浏览器任务、数据集载荷或模型。", "pdf_url": "https://arxiv.org/pdf/2609.32413v1", "project_url": null, "publication_date": "2026-09-26", "publication_status": "preprint", "runtime_tested": false, "scope_limitations_en": "Covers 377 single-file HTML/JavaScript tasks with supplied data and explicit interaction requirements. Four models are evaluated with at most one repair round. Failing the Executability gate gives zero on scored dimensions; other rubric judgments use an MLLM, with human validation on 200 Direct outputs from 100 tasks and two models. Finite interactions and judge agreement do not establish complete application equivalence or recovery of hidden data and unspecified behavior.", "scope_limitations_zh": "覆盖 377 个单文件 HTML／JavaScript 任务，提供数据及明确交互要求。评测四个模型，最多进行一轮修复。未通过可执行性检查时，各评分维度计零分；其他评分规则由多模态模型判断，人类验证只覆盖两个模型在 100 个任务上的 200 份 Direct 输出。有限交互及评判一致性不证明完整应用等价，也不代表恢复隐藏数据或未指定行为。", "targets": [ "website" ], "title": "IChart2Code: Benchmarking Multimodal Large Language Models for Interactive Chart Code Generation", "title_zh": "IChart2Code：面向交互图表代码生成的多模态大语言模型评测", "url": "https://arxiv.org/abs/2609.32413", "venue": "arXiv", "verification": "source-reviewed", "verified_at": "2026-10-20", "why_fits_en": "Adds an execution-aware benchmark for reproducing visual charts and their specified interactive state changes.", "why_fits_zh": "补充面向视觉图表及其指定交互状态变化的执行感知复现基准。", "year": 2026 }, { "arxiv_id": "2502.04536", "arxiv_version_reviewed": "v2", "authors": [ "Luke Dramko", "Claire Le Goues", "Edward J. Schwartz" ], "citation": { "container_title": "Proceedings 2026 Network and Distributed System Security Symposium", "publisher": "Internet Society", "sources": [ "https://api.crossref.org/works/10.14722/ndss.2026.240795" ] }, "code_url": "https://github.com/squaresLab/idioms", "date_basis": "The official NDSS paper and the Internet Society’s Crossref deposit establish publication year 2026. The February 23–27 symposium dates are not used as a publication day.", "date_basis_zh": "NDSS 官方论文与 Internet Society 提交的 Crossref 元数据确认出版年份为 2026；不以 2 月 23—27 日的研讨会日期作为出版日。", "date_precision": "year", "description_en": "Idioms fine-tunes code language models to turn Hex-Rays output for one target function into predicted original C together with definitions of the user-defined structs, unions and typedefs it uses. Input can include neighboring decompiled functions in breadth-first call-graph order, so evidence about a type scattered across callers and callees reaches the model. The authors also build Realtype, 157,163 functions from compiled open-source C repositories with full type definitions. Their CodeGemma-7b-based model passes ExeBench unit tests for 54.4% of functions versus 46.3% for LLM4Decompile and 37.5% for Nova, and scores at least 95% higher on Realtype.", "description_zh": "Idioms 微调代码语言模型，把单个目标函数的 Hex-Rays 输出转换为预测的原始 C 代码，并同时给出其中使用的用户自定义结构体、联合体和类型别名定义。输入可按调用图广度优先顺序附带相邻的反编译函数，使分散在调用者与被调用者中的类型线索能够提供给模型。作者还构建了 Realtype 数据集，包含来自已编译开源 C 仓库的 157,163 个函数及完整类型定义。其基于 CodeGemma-7b 的模型在 ExeBench 上有 54.4% 的函数通过单元测试，LLM4Decompile 为 46.3%，Nova 为 37.5%；在 Realtype 上的得分至少高出 95%。", "doi": "10.14722/ndss.2026.240795", "entry_url": "https://awesomerea.org/papers/paper-idioms/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-idioms/", "evidence_urls": [ "https://www.ndss-symposium.org/ndss-paper/idioms-a-simple-and-effective-framework-for-turbo-charging-local-neural-decompilation-with-well-defined-types/", "https://www.ndss-symposium.org/wp-content/uploads/2026-f795-paper.pdf", "https://api.crossref.org/works/10.14722/ndss.2026.240795", "https://arxiv.org/abs/2502.04536v1", "https://arxiv.org/abs/2502.04536v2", "https://github.com/squaresLab/idioms/blob/d08791287545c6d4b1e0d5f79e28ae5e6542b493/README.md", "https://github.com/squaresLab/idioms/blob/d08791287545c6d4b1e0d5f79e28ae5e6542b493/env.yml", "https://zenodo.org/records/15683630", "https://zenodo.org/api/records/15683630" ], "first_arxiv_date": "2025-02-06", "id": "paper-idioms", "kind": "research", "metadata_notes": "The NDSS page, final PDF and Crossref agree on the published title, three-author order and DOI; Crossref lists no pages. arXiv:2502.04536 v1 (2025-02-06) is titled “Idioms: Neural Decompilation With Joint Code and Type Prediction” and v2 (2025-06-17) “Idioms: Neural Decompilation With Joint Code and Type Definition Prediction”; the repository README still uses the v1 title. The paper links Zenodo version 10.5281/zenodo.15683630, while the README links its concept DOI 10.5281/zenodo.14797016; both resolve to the same open 2025-06-17 record of about 11.8 GB, including a 10.1 GB models archive, and the Zenodo metadata names no license. The reviewed 2025-12-03 repository snapshot has no license file, and GitHub detects none, so no open-source license is asserted. Its env.yml pins Python 3.11, CUDA 12.1, transformers 4.46.3 and peft 0.17.0; training also needs unsloth on GPUs with compute capability 7.0 or greater, dataset building runs GHCC builds in Docker that can take weeks, and the main decompilation step needs IDA Pro’s Hex-Rays. ExeBench tests run in a provided Docker image. No code, models or datasets were run or downloaded.", "metadata_notes_zh": "NDSS 页面、最终 PDF 与 Crossref 的正式标题、三位作者顺序和 DOI 一致；Crossref 未列出页码。arXiv:2502.04536 的 v1（2025-02-06）题为《Idioms: Neural Decompilation With Joint Code and Type Prediction》，v2（2025-06-17）题为《Idioms: Neural Decompilation With Joint Code and Type Definition Prediction》；仓库 README 仍使用 v1 标题。论文链接 Zenodo 版本 DOI 10.5281/zenodo.15683630，README 则链接其概念 DOI 10.5281/zenodo.14797016；两者指向同一个 2025-06-17 发布的开放记录，约 11.8 GB，其中模型压缩包约 10.1 GB，Zenodo 元数据未注明许可证。所审阅的 2025-12-03 仓库快照没有许可证文件，GitHub 也未检测到许可证，因此本条目不认定任何开源许可证。其 env.yml 固定 Python 3.11、CUDA 12.1、transformers 4.46.3 与 peft 0.17.0；训练还需要在计算能力 7.0 及以上的 GPU 上使用 unsloth，构建数据集需在 Docker 中运行可能耗时数周的 GHCC 编译，主要反编译步骤需要 IDA Pro 的 Hex-Rays。ExeBench 测试在提供的 Docker 镜像中运行。本次未运行或下载代码、模型及数据集。", "pdf_url": "https://www.ndss-symposium.org/wp-content/uploads/2026-f795-paper.pdf", "project_url": null, "publication_date": null, "publication_status": "conference-paper", "runtime_tested": false, "scope_limitations_en": "This is local, function-level neural decompilation: each prediction covers one target function and its type definitions, not a compilable whole program. Evaluation uses x86-64 Linux gcc binaries from open-source GitHub projects and ExeBench’s “real” subset; O1–O3 builds disable inlining, and keeping only functions that decompiled at every level removes 21% of the Hex-Rays and 76% of the Ghidra test sets. ExeBench unit tests are an optimistic proxy; Realtype has no tests, so dependency-graph equivalence and exact name and type matches serve as conservative proxies, and a Realtype user-defined type counts as correct only if all of its fields, 17.6 on average when counted recursively, match. The main models use proprietary Hex-Rays output and context windows of 2,048 or 4,096 tokens. Predicted names and types are statistical, not recovered originals. Pretraining leakage from GitHub remains possible, and obfuscated code and malware were not evaluated.", "scope_limitations_zh": "这是局部、函数级的神经反编译：每次预测只覆盖一个目标函数及其类型定义，而非可编译的完整程序。评测使用来自 GitHub 开源项目的 x86-64 Linux gcc 二进制及 ExeBench 的“real”子集；O1–O3 构建禁用内联，且只保留在所有优化级别均能反编译的函数，使 Hex-Rays 与 Ghidra 测试集分别减少 21% 和 76%。ExeBench 单元测试是偏乐观的代理指标；Realtype 没有测试，因此以依赖图等价性及名称、类型的完全匹配作为偏保守的代理指标，且 Realtype 的用户自定义类型须所有字段（递归计算平均 17.6 个）均匹配才算正确。主要模型使用专有 Hex-Rays 的输出，上下文窗口为 2,048 或 4,096 个词元。预测的名称与类型属于统计推断，并非恢复的原始信息。仍可能存在来自 GitHub 的预训练数据泄漏，且未评估混淆代码和恶意软件。", "targets": [ "binary" ], "title": "Idioms: A Simple and Effective Framework for Turbo-Charging Local Neural Decompilation with Well-Defined Types", "title_zh": "Idioms：以明确定义的类型显著增强局部神经反编译的简单有效框架", "url": "https://www.ndss-symposium.org/ndss-paper/idioms-a-simple-and-effective-framework-for-turbo-charging-local-neural-decompilation-with-well-defined-types/", "venue": "NDSS 2026", "verification": "source-reviewed", "verified_at": "2026-10-18", "why_fits_en": "Adds neural decompilation that jointly predicts code and user-defined type definitions with interprocedural context, and introduces a type-rich benchmark, complementing assembly-to-source models and type and symbol recovery research.", "why_fits_zh": "补充借助过程间上下文、同时预测代码与用户自定义类型定义的神经反编译方法，并提供类型丰富的基准，与从汇编生成源码的模型及类型、符号恢复研究互补。", "year": 2026 }, { "arxiv_id": "2411.03292", "arxiv_version_reviewed": "v3", "authors": [ "Jingyu Xiao", "Yuxuan Wan", "Yintong Huo", "Zixin Wang", "Xinyi Xu", "Wenxuan Wang", "Zhiyao Xu", "Yuhang Wang", "Michael R. Lyu" ], "code_url": "https://github.com/WebPAI/Interaction2Code", "date_basis": "Publisher-deposited Crossref print-publication date; this also matches the conference start date.", "date_basis_zh": "采用出版商在 Crossref 登记的印刷出版日期，该日期也与会议开幕日期一致。", "date_precision": "day", "description_en": "Benchmarks reconstruction of interactive webpages from screenshots before and after an interaction. The final study covers 127 webpages and 374 interactions, comparing rendered appearance, automated interaction checks, and human usability judgments.", "description_zh": "评测模型根据交互前后的截图重建可交互网页的能力。最终研究涵盖 127 个网页、374 项交互，并比较渲染外观、自动交互检查与人工可用性判断。", "doi": "10.1109/ASE63991.2025.00028", "entry_url": "https://awesomerea.org/papers/paper-interaction2code/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-interaction2code/", "evidence_urls": [ "https://doi.org/10.1109/ASE63991.2025.00028", "https://api.crossref.org/works/10.1109/ASE63991.2025.00028", "https://arxiv.org/abs/2411.03292", "https://arxiv.org/pdf/2411.03292v3", "https://github.com/WebPAI/Interaction2Code", "https://github.com/WebPAI/Interaction2Code/blob/29d8af1572888d33b028ef001dc8452f9e88497b/README.md", "https://webpai.github.io/Interaction2Code/" ], "first_arxiv_date": "2024-11-05", "id": "paper-interaction2code", "kind": "research", "metadata_notes": "Uses the final nine-author title and author list. The 2026 arXiv v3 revision is separate from the 2025 conference publication; the earlier preprint used a different title, five authors, and a smaller benchmark.", "metadata_notes_zh": "采用最终版本的标题及九位作者名单。2026 年更新的 arXiv v3 与 2025 年会议发表时间分开记录；早期预印本的标题、五位作者名单和较小基准规模均不同。", "pdf_url": "https://arxiv.org/pdf/2411.03292v3", "project_url": "https://webpai.github.io/Interaction2Code/", "publication_date": "2025-11-16", "publication_status": "conference-paper", "runtime_tested": false, "scope_limitations_en": "The inputs specify individual interaction transitions, not autonomous exploration of a complete site. Its tests do not establish long-workflow, server-side, or original-source equivalence; a detectable interaction is not necessarily usable.", "scope_limitations_zh": "输入描述单项交互的状态变化，并非自主探索完整网站。测试不能证明长流程、服务端行为或原始源码等价；交互能够被检测到，也不代表它可用。", "targets": [ "website" ], "title": "Interaction2Code: Benchmarking MLLM-based Interactive Webpage Code Generation from Interactive Prototyping", "title_zh": "Interaction2Code：从交互原型生成网页代码的多模态大语言模型评测基准", "url": "https://doi.org/10.1109/ASE63991.2025.00028", "venue": "ASE 2025", "verification": "source-reviewed", "verified_at": "2026-10-16", "why_fits_en": "Extends screenshot reconstruction with concrete behavioral checks, helping distinguish visual similarity from usable interaction.", "why_fits_zh": "在截图重建中加入具体的行为检查，有助于区分视觉相似与交互可用。", "year": 2025 }, { "arxiv_id": "2610.21597", "arxiv_version_reviewed": "v1", "authors": [ "Douglas Leith" ], "code_url": "https://github.com/doug-leith/ios-protobuf-decoding", "date_basis": "First arXiv submission; the reviewed version is v1, not a verified proceedings publication.", "date_basis_zh": "采用 arXiv 首次提交日期；审阅版本为 v1，并非已经核实的会议录出版。", "date_precision": "day", "description_en": "Compares direct LLM recovery of Apple PBCodable schemas with an AI-written Extractor checked against compiled synthetic fixtures, published descriptors and captured traffic. It shows how plausible recovered schemas can silently decode values incorrectly.", "description_zh": "比较直接用大语言模型恢复 Apple PBCodable 模式与构建 Extractor 工具两种路径；工具以编译后的合成样本、既有描述文件和捕获流量交叉检查，说明看似合理的模式也可能静默解码出错误值。", "doi": null, "entry_url": "https://awesomerea.org/papers/paper-ios-protobuf-extractor/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-ios-protobuf-extractor/", "evidence_urls": [ "https://arxiv.org/abs/2610.21597", "https://arxiv.org/html/2610.21597v1", "https://github.com/doug-leith/ios-protobuf-decoding/blob/9a4a688c52686f82c1a86e386848edc4eb671746/README.md", "https://github.com/doug-leith/ios-location-services-study-data/blob/a091d8dad932faf7e8e526ef07b854640ce8bc23/README.md" ], "first_arxiv_date": "2026-10-15", "id": "paper-ios-protobuf-extractor", "kind": "research", "metadata_notes": "ArXiv names Douglas Leith; the manuscript uses D.J. Leith. The author-linked code and data READMEs were inspected at pinned commits. No repository-wide license was verified. No Apple binaries, traffic datasets or tests were downloaded or run.", "metadata_notes_zh": "arXiv 列名 Douglas Leith，手稿使用 D.J. Leith。已读取作者所链代码及数据仓库的固定版本 README，未核实仓库整体许可；未下载 Apple 二进制、流量数据集或运行测试。", "pdf_url": "https://arxiv.org/pdf/2610.21597v1", "project_url": null, "publication_date": "2026-10-15", "publication_status": "preprint", "runtime_tested": false, "scope_limitations_en": "The direct-agent study uses 17 seeds with 7,788 field occurrences, 4,987 distinct. Apple's true schemas remain unpublished; synthetic tests share the recovered template's assumptions. Traffic comes from one jailbroken iPhone 8 on iOS 16.7.11. Matching fields in newer OS binaries does not verify their network behavior. The maintained code also documents estimated or unresolved fields.", "scope_limitations_zh": "直接智能体评测采用 17 个种子，共 7,788 次字段出现，其中 4,987 个不同字段。Apple 的真实模式未公开，合成测试共享恢复模板的假设。流量来自一台运行 iOS 16.7.11 的越狱 iPhone 8；较新系统二进制中的字段一致，不等于其联网行为已验证。维护中的代码也明确记录估计或尚未解决的字段。", "targets": [ "binary", "protocol", "app" ], "title": "Decoding What iOS Location Services Send to Apple: An LLM Is an Unreliable Analyst but a Useful Toolmaker", "title_zh": "解码 iOS 定位服务发送给 Apple 的数据：大语言模型并非可靠分析员，却能辅助构建工具", "url": "https://arxiv.org/abs/2610.21597", "venue": "arXiv", "verification": "source-reviewed", "verified_at": "2026-10-20", "why_fits_en": "A concrete binary-to-protocol-schema recovery study that separates parseable output from verified interpretation.", "why_fits_zh": "具体研究从二进制恢复协议模式，并区分可解析输出与经过验证的解释。", "year": 2026 }, { "arxiv_id": "2509.24709", "arxiv_version_reviewed": "v3", "authors": [ "Yang Chen", "Minghao Liu", "Yufan Shen", "Yunwen Li", "Tianyuan Huang", "Xinyu Fang", "Tianyu Zheng", "Wenxuan Huang", "Cheng Yang", "Daocheng Fu", "Jianbiao Mei", "Rong Wu", "Licheng Wen", "Xuemeng Yang", "Song Mao", "Qunshu Lin", "Zhi Yu", "Yongliang Shen", "Yu Qiao", "Botian Shi" ], "code_url": "https://github.com/SIGMME/IWR-Bench", "date_basis": "Publication year stated by the official ICLR proceedings; no finer publication date is asserted.", "date_basis_zh": "采用 ICLR 官方论文集标明的出版年份，不推定更精确的出版日期。", "date_precision": "year", "description_en": "Tests reconstruction of interactive webpages from user-interaction videos and supplied static assets. Its 113 tasks replay annotated action sequences to assess visual fidelity and functional behavior across observed page states.", "description_zh": "测试模型利用用户交互视频和提供的静态资源重建可交互网页的能力。其 113 项任务通过重放标注的操作序列，评估已观察页面状态的视觉保真度与功能行为。", "doi": null, "entry_url": "https://awesomerea.org/papers/paper-iwr-bench/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-iwr-bench/", "evidence_urls": [ "https://proceedings.iclr.cc/paper_files/paper/2026/hash/55bfedfd31489e5ae83c9ce8eec7b0e1-Abstract-Conference.html", "https://proceedings.iclr.cc/paper_files/paper/2026/file/55bfedfd31489e5ae83c9ce8eec7b0e1-Paper-Conference.pdf", "https://arxiv.org/abs/2509.24709", "https://github.com/SIGMME/IWR-Bench", "https://github.com/SIGMME/IWR-Bench/blob/891ca67cbd940961245d3eea883f211637e03490/README.md", "https://sigmme.github.io/IWR-Bench/", "https://huggingface.co/datasets/IWR-Bench/IWR-Bench" ], "first_arxiv_date": "2025-09-29", "id": "paper-iwr-bench", "kind": "research", "metadata_notes": "Authors and order follow the published PDF: 20 authors. The proceedings landing page orders some middle authors differently; arXiv v3 and the project page list 21, additionally including Yunfei Zhao. The 2025 preprint date is separate from ICLR 2026 publication.", "metadata_notes_zh": "作者及顺序以正式发表的 PDF 为准，共 20 位。论文集网页的部分中间作者顺序不同；arXiv v3 和项目页列出 21 位，另含 Yunfei Zhao。2025 年预印本日期与 ICLR 2026 发表年份分开记录。", "pdf_url": "https://proceedings.iclr.cc/paper_files/paper/2026/file/55bfedfd31489e5ae83c9ce8eec7b0e1-Paper-Conference.pdf", "project_url": "https://sigmme.github.io/IWR-Bench/", "publication_date": null, "publication_status": "conference-paper", "runtime_tested": false, "scope_limitations_en": "The required output is one HTML file; the paper explicitly instructs models to mock implied backend logic with static JavaScript data. Trajectory coverage and model-based judgments do not prove complete website or backend equivalence.", "scope_limitations_zh": "要求输出单个 HTML 文件；论文明确要求用 JavaScript 静态数据模拟隐含的后端逻辑。轨迹覆盖和模型评审均不能证明完整网站或后端等价。", "targets": [ "website" ], "title": "IWR-Bench: Can LVLMs reconstruct interactive webpage from a user interaction video?", "title_zh": "IWR-Bench：大型视觉语言模型能否根据用户交互视频重建可交互网页？", "url": "https://proceedings.iclr.cc/paper_files/paper/2026/hash/55bfedfd31489e5ae83c9ce8eec7b0e1-Abstract-Conference.html", "venue": "ICLR 2026", "verification": "source-reviewed", "verified_at": "2026-10-16", "why_fits_en": "Provides a direct behavioral reconstruction benchmark beyond static screenshots while making the frontend/backend boundary explicit.", "why_fits_zh": "提供超越静态截图的行为重建基准，同时明确前端与后端的能力边界。", "year": 2026 }, { "arxiv_id": null, "arxiv_version_reviewed": null, "authors": [ "Evan Johnson", "Maxwell Bland", "YiFei Zhu", "Joshua Mason", "Stephen Checkoway", "Stefan Savage", "Kirill Levchenko" ], "code_url": "https://github.com/aerosec/jetset", "date_basis": "The official USENIX proceedings citation gives August 2021. Month precision is retained; the August 11–13 symposium dates on the proceedings cover are not substituted for a publication day.", "date_basis_zh": "USENIX 官方论文集引用信息给出 2021 年 8 月。本条目保留月精度，不以论文集封面上 8 月 11–13 日的研讨会日期替代具体出版日。", "date_precision": "month", "description_en": "Jetset rehosts firmware only as far as an analyst-chosen goal address, such as the point where a fuzzer can inject input. Given the architecture, the MMIO address range, an entry point and the goal, it symbolically executes the firmware with angr against a modified QEMU, treating peripheral reads as symbolic, cycling interrupts, and steering toward the goal with CFG distances and Tabu search. Solved constraints become C peripheral models for QEMU that replay the inferred values and interrupts so the firmware boots concretely to the goal. The authors evaluate 13 targets across x86, ARM and Motorola ColdFire, including Linux on a Raspberry Pi 2, a BeagleBoard-xM bootloader, a SEL-751 relay, a Boeing 737 CMU-900 and nine P²IM firmware, and use the CMU model with AFL to find a privilege escalation in its VRTX kernel.", "description_zh": "Jetset 只将固件重托管到分析人员指定的目标地址，例如模糊测试器可以注入输入的位置。给定体系结构、MMIO 地址范围、入口点与目标地址后，它使用 angr 配合修改过的 QEMU 对固件进行符号执行，将外设读取视为符号值、轮流触发中断，并借助控制流图距离与禁忌搜索向目标推进。求解得到的约束被转换为供 QEMU 使用的 C 语言外设模型，重放推断出的取值与中断，使固件以具体执行方式启动到目标处。作者在 x86、ARM 与 Motorola ColdFire 上评测了 13 个目标，包括 Raspberry Pi 2 上的 Linux、BeagleBoard-xM 引导程序、SEL-751 继电器、波音 737 的 CMU-900 以及九个 P²IM 固件，并利用 CMU 模型结合 AFL 在其 VRTX 内核中发现一个提权漏洞。", "doi": null, "entry_url": "https://awesomerea.org/papers/paper-jetset/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-jetset/", "evidence_urls": [ "https://www.usenix.org/conference/usenixsecurity21/presentation/johnson", "https://www.usenix.org/system/files/sec21-johnson.pdf", "https://github.com/aerosec/jetset/blob/a55dc69ef7b8a1d768df192065916fa4936258b1/README.md", "https://github.com/aerosec/jetset/blob/a55dc69ef7b8a1d768df192065916fa4936258b1/LICENSE.GPL", "https://github.com/aerosec/jetset/blob/a55dc69ef7b8a1d768df192065916fa4936258b1/Makefile", "https://github.com/aerosec/jetset_engine/blob/b71990fb002948b221710233e519f3340344c91a/README.md", "https://github.com/aerosec/aerosec.github.io/blob/c831d9d329bb1d0b788a5ce1d31baba1e7ea53ce/_data/publications.yml", "https://github.com/aerosec/jetset_qemu/blob/ea9d17aad5edb030c836bcd7ab911a6cb275fedf/LICENSE", "https://github.com/aerosec/jetset_public_data/tree/c1f387325bd102f248d6f4a02f86d616210fad74" ], "first_arxiv_date": null, "id": "paper-jetset", "kind": "research", "metadata_notes": "The USENIX presentation page and final proceedings PDF give the seven authors in this order, the 30th USENIX Security Symposium, pages 321–338, ISBN 978-1-939133-24-3 and month August; the 19-page PDF includes a proceedings cover page. The page also links a separate prepublication PDF. No DOI or arXiv identifier was found; the record uses the reviewed USENIX Security presentation-page and final-PDF profile. The paper cites jetset.aerosec.org as its open-source release, but that host did not resolve during this review. The aerosec GitHub organization, whose site lists the paper, hosts aerosec/jetset with commits from the first two authors; its README says it contains the code and data to reproduce the paper’s results, except the proprietary or security-critical CMU-900 and ICS binaries. The reviewed 2024-03-21 commit is GPL-2.0, and its Makefile clones the jetset_engine, jetset_qemu and jetset_public_data repositories over SSH; GitHub does not identify a single license for the modified-QEMU repository jetset_qemu, and jetset_public_data declares none. No code, firmware or experiments were run.", "metadata_notes_zh": "USENIX 报告页面与最终论文集 PDF 按此顺序列出七位作者，记载第 30 届 USENIX 安全研讨会、第 321–338 页、ISBN 978-1-939133-24-3 及 8 月；19 页的 PDF 含一页论文集封面。该页面另链接一份预发表 PDF。未找到 DOI 或 arXiv 标识符；本条目采用经审核的 USENIX Security 报告页面与最终 PDF 规则。论文将 jetset.aerosec.org 列为开源发布地址，但本次审阅时该主机名无法解析。aerosec GitHub 组织的网站列出了该论文，其 aerosec/jetset 仓库含前两位作者的提交；README 称仓库包含复现论文结果所需的代码与数据，但不含属于专有或安全敏感的 CMU-900 与 ICS 二进制。所审阅的 2024-03-21 提交采用 GPL-2.0，其 Makefile 通过 SSH 克隆 jetset_engine、jetset_qemu 与 jetset_public_data 仓库；GitHub 未能为修改版 QEMU 仓库 jetset_qemu 识别出单一许可证，jetset_public_data 则未声明许可证。本次未运行代码、固件或实验。", "pdf_url": "https://www.usenix.org/system/files/sec21-johnson.pdf", "project_url": null, "publication_date": "2021-08", "publication_status": "conference-paper", "runtime_tested": false, "scope_limitations_en": "This is targeted rehosting, not full device emulation or firmware decompilation. The analyst supplies the MMIO range, entry point and goal address, and the synthesized models replay one satisfying path and then the last satisfying value for each address, so they need not match real hardware and may mishandle stateful or complex peripheral interaction after the goal. DMA is unsupported; the two targets that needed it relied on an existing QEMU device model or a manually symbolic memory region. Incomplete CFGs, for example across virtual calls or x86 task switches, weaken the distance heuristic, and the BeagleBoard-xM emulator crashed when synthesized serial data was executed as code. Fidelity checks compare against hardware or a manually built QEMU model for selected targets. The VRTX privilege escalation is described by the authors as primarily of academic interest.", "scope_limitations_zh": "这是定向重托管，并非完整的设备仿真或固件反编译。MMIO 范围、入口点和目标地址需由分析人员提供；合成模型先重放一条满足约束的路径，之后对每个地址返回最后一个满足约束的值，因此不必与真实硬件一致，到达目标后也可能无法正确处理有状态或复杂的外设交互。不支持 DMA；需要 DMA 的两个目标分别依赖已有的 QEMU 设备模型或人工标为符号值的内存区域。控制流图不完整（例如跨越虚函数调用或 x86 任务切换）会削弱距离启发式，BeagleBoard-xM 仿真也因把合成的串口数据当作代码执行而崩溃。保真度检验只在部分目标上与硬件或人工构建的 QEMU 模型对比。作者称 VRTX 提权漏洞主要具有学术意义。", "targets": [ "firmware" ], "title": "Jetset: Targeted Firmware Rehosting for Embedded Systems", "title_zh": "Jetset：面向嵌入式系统的定向固件重托管", "url": "https://www.usenix.org/conference/usenixsecurity21/presentation/johnson", "venue": "USENIX Security 2021", "verification": "source-reviewed", "verified_at": "2026-10-19", "why_fits_en": "Adds symbolic-execution-based peripheral model synthesis for booting firmware to an analysis point, complementing the section’s HAL replacement, MMIO-modeling fuzzing and Linux user-space rehosting research.", "why_fits_zh": "补充基于符号执行合成外设模型、使固件启动到分析位置的方法，与本节的 HAL 替换、MMIO 建模模糊测试及 Linux 用户态重托管研究互补。", "year": 2021 }, { "arxiv_id": "2506.20170", "arxiv_version_reviewed": "v1", "authors": [ "Guoqiang Chen", "Xin Jin", "Zhiqiang Lin" ], "citation": { "container_title": "Proceedings of the 2025 ACM SIGSAC Conference on Computer and Communications Security", "pages": "36-50", "publisher": "ACM", "sources": [ "https://api.crossref.org/works/10.1145/3719027.3744871" ] }, "code_url": "https://github.com/Ch3nYe/JsDeObsBench", "date_basis": "ACM-deposited Crossref print-publication date; the October 13–17 CCS 2025 conference week is not used as the publication date.", "date_basis_zh": "采用 ACM 在 Crossref 登记的印刷出版日期；不将 CCS 2025 于 10 月 13—17 日举行的会议周作为出版日期。", "date_precision": "day", "description_en": "Builds an execution-verifiable JavaScript deobfuscation benchmark by applying seven JavaScript-Obfuscator transformations to Project CodeNet programs with test cases, then scores LLM and tool outputs for syntax, execution, code simplification and similarity to the original code.", "description_zh": "对附带测试用例的 Project CodeNet 程序施加 JavaScript-Obfuscator 的七种混淆变换，构建可通过执行验证的 JavaScript 反混淆基准，并从语法、执行结果、代码简化程度及与原始代码的相似度评估 LLM 和现有工具的输出。", "doi": "10.1145/3719027.3744871", "entry_url": "https://awesomerea.org/papers/paper-jsdeobsbench/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-jsdeobsbench/", "evidence_urls": [ "https://doi.org/10.1145/3719027.3744871", "https://api.crossref.org/works/10.1145/3719027.3744871", "https://arxiv.org/abs/2506.20170", "https://github.com/Ch3nYe/JsDeObsBench/blob/8b2e1c35dc4ae25a46ea580ea5dcb6b5de5edbe9/README.md", "https://github.com/Ch3nYe/JsDeObsBench/tree/8b2e1c35dc4ae25a46ea580ea5dcb6b5de5edbe9", "https://jsdeobf.github.io/" ], "first_arxiv_date": "2025-06-25", "id": "paper-jsdeobsbench", "kind": "research", "metadata_notes": "ACM-deposited Crossref metadata records print publication on 2025-11-19 and online publication on 2025-11-22, pages 36–50. The ACM Digital Library page could not be retrieved during review; the reviewed text is arXiv v1, which carries the CCS 2025 header. The paper links the code repository and the jsdeobf.github.io leaderboard. At the pinned commit the repository contains the CodeNet-derived obfuscated datasets, evaluators and scripts, but no malware samples or license file.", "metadata_notes_zh": "ACM 在 Crossref 登记的元数据记载印刷出版于 2025-11-19，在线出版于 2025-11-22，页码为 36–50。核查期间无法读取 ACM 数字图书馆页面；审阅文本为带有 CCS 2025 页眉的 arXiv v1。论文给出了代码仓库和 jsdeobf.github.io 排行榜链接。固定提交中的仓库包含基于 CodeNet 生成的混淆数据集、评估器和脚本，但不含恶意代码样本，也没有许可证文件。", "pdf_url": "https://arxiv.org/pdf/2506.20170v1", "project_url": "https://jsdeobf.github.io/", "publication_date": "2025-11-19", "publication_status": "conference-paper", "runtime_tested": false, "scope_limitations_en": "On average, LLM outputs passed execution checks 60.93% of the time, against 83% for the two existing deobfuscator baselines. All samples come from a single obfuscator applied to moderate-length competitive-programming solutions. The 4,515 obfuscated malware samples have no test cases and are compared only through behavior traces.", "scope_limitations_zh": "平均而言，LLM 输出通过执行检查的比例为 60.93%，两种现有反混淆工具基线为 83%。所有样本均由单一混淆器生成，原始程序是长度适中的编程竞赛解答。4,515 个经混淆的恶意代码样本没有测试用例，只能通过行为轨迹比较。", "targets": [ "website" ], "title": "JsDeObsBench: Measuring and Benchmarking LLMs for JavaScript Deobfuscation", "title_zh": "JsDeObsBench：衡量与评测大语言模型的 JavaScript 反混淆能力", "url": "https://doi.org/10.1145/3719027.3744871", "venue": "ACM CCS 2025", "verification": "source-reviewed", "verified_at": "2026-10-17", "why_fits_en": "Adds a measurable, execution-checked benchmark for LLM-assisted JavaScript deobfuscation, a common step in recovering website behavior from shipped scripts.", "why_fits_zh": "为 LLM 辅助的 JavaScript 反混淆提供可量化、经执行检验的基准；反混淆是从已部署脚本恢复网站行为的常见步骤。", "year": 2025 }, { "arxiv_id": "2512.14070", "arxiv_version_reviewed": "v1", "authors": [ "Dongchao Zhou", "Lingyun Ying", "Huajun Chai", "Dongbin Wang" ], "code_url": "https://github.com/XingTuLab/JSIMPLIFIER", "date_basis": "The Internet Society's Crossref deposit and the official NDSS paper identify publication year 2026. The PDF footer names the 23–27 February 2026 symposium; no finer publication date is asserted from the event dates.", "date_basis_zh": "Internet Society 提交的 Crossref 元数据与 NDSS 官方论文标明出版年份为 2026。PDF 页脚标注研讨会于 2026 年 2 月 23–27 日举行；不根据会议举办日期推定更精确的出版日期。", "date_precision": "year", "description_en": "JSimplifier recovers readable JavaScript from obfuscated scripts in three stages. A preprocessor normalizes malformed or mixed-encoding input; a deobfuscator combines AST-based static simplification with selective execution of obfuscated call sites in a Node.js vm context, feeding the results back into the AST; and an optional humanizer renames identifiers with an LLM, adapting HumanifyJS, then formats the output with Prettier. The authors catalog 20 obfuscation techniques in four categories and assemble MalJS (23,212 malicious scripts) and BenignJS (21,209 scripts). They report that JSimplifier processes all 44,421 samples and reduces Halstead length by 88.2% on 1,296 multi-technique JsDeObsBench samples.", "description_zh": "JSimplifier 分三个阶段从混淆脚本中恢复可读的 JavaScript：预处理器规范化格式错误或混合编码的输入；反混淆器将基于 AST 的静态简化与在 Node.js vm 上下文中有选择地执行混淆调用点相结合，并把执行结果写回 AST；可选的人性化模块借鉴 HumanifyJS，利用大语言模型重命名标识符，再用 Prettier 格式化输出。作者将混淆技术归纳为四大类共 20 种，并构建了 MalJS（23,212 个恶意脚本）与 BenignJS（21,209 个脚本）数据集。作者报告 JSimplifier 能处理全部 44,421 个样本，并在 JsDeObsBench 中 1,296 个组合多种技术的样本上将 Halstead 长度降低 88.2%。", "doi": "10.14722/ndss.2026.242198", "entry_url": "https://awesomerea.org/papers/paper-jsimplifier/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-jsimplifier/", "evidence_urls": [ "https://www.ndss-symposium.org/ndss-paper/from-obfuscated-to-obvious-a-comprehensive-javascript-deobfuscation-tool-for-security-analysis/", "https://www.ndss-symposium.org/wp-content/uploads/2026-f2198-paper.pdf", "https://doi.org/10.14722/ndss.2026.242198", "https://api.crossref.org/works/10.14722/ndss.2026.242198", "https://arxiv.org/abs/2512.14070", "https://github.com/XingTuLab/JSIMPLIFIER/blob/eaa72ae63758957ac95b2f5e3391fefb96827987/README.md", "https://github.com/XingTuLab/JSIMPLIFIER/blob/eaa72ae63758957ac95b2f5e3391fefb96827987/LICENSE", "https://github.com/XingTuLab/JSIMPLIFIER/blob/eaa72ae63758957ac95b2f5e3391fefb96827987/package.json", "https://zenodo.org/records/17531662" ], "first_arxiv_date": "2025-12-16", "id": "paper-jsimplifier", "kind": "research", "metadata_notes": "The four-author order follows the PDF, the NDSS paper page and Crossref. The PDF footer gives ISBN 979-8-9919276-8-0 and the DOI; Crossref lists no pages, and no page range was verified. arXiv v1 (2025-12-16) carries the same DOI in its metadata and no venue comment; the reviewed text is the NDSS final PDF. The paper links XingTuLab/JSIMPLIFIER and Zenodo artifact 10.5281/zenodo.17531662, whose DOI identifies the artifact, not the paper. At the reviewed 2025-12-17 commit the repository's LICENSE is GPL-3.0, while package.json still declares MIT; the Zenodo record states GPL-3.0-or-later. The CLI needs Node.js 20 or later, and LLM renaming needs the user's OpenAI or Gemini API key; --model=none runs the AST stages only. Per the artifact appendix, the roughly 3 GB Zenodo archive includes the MalJS malicious samples; it was not downloaded. The paper credits HumanifyJS for its renaming approach. No code was run.", "metadata_notes_zh": "四位作者的顺序以 PDF、NDSS 论文页面与 Crossref 为准。PDF 页脚给出 ISBN 979-8-9919276-8-0 及 DOI；Crossref 未列出页码，本条目未核实页码范围。arXiv v1（2025-12-16）的元数据带有同一 DOI，但没有发表场所注释；本次审阅的是 NDSS 最终版 PDF。论文链接 XingTuLab/JSIMPLIFIER 与 Zenodo 产物 10.5281/zenodo.17531662，后者 DOI 标识的是产物而非论文。在所审阅的 2025-12-17 提交中，仓库 LICENSE 为 GPL-3.0，package.json 却仍声明 MIT；Zenodo 记录标注 GPL-3.0-or-later。命令行工具需要 Node.js 20 或更高版本，大语言模型重命名需要用户自备 OpenAI 或 Gemini API 密钥；--model=none 仅运行 AST 阶段。据产物附录，约 3 GB 的 Zenodo 压缩包包含 MalJS 恶意样本，本次未下载。论文说明其重命名方法借鉴 HumanifyJS。本次未运行任何代码。", "pdf_url": "https://www.ndss-symposium.org/wp-content/uploads/2026-f2198-paper.pdf", "project_url": null, "publication_date": null, "publication_status": "conference-paper", "runtime_tested": false, "scope_limitations_en": "The headline “100% correctness” is syntactic validity on 400 samples (100 BenignJS, 300 MalJS) checked by parser and by hand; behavioral consistency, judged with Joern CFG/DDG comparison and manual review, holds for 83 of 100 samples. The 20-technique capability test applies each technique to one representative snippet, and the static and dynamic stages alone handle 19; identifier renaming needs the LLM stage. Readability gains come from four LLMs (Claude 3.7 Sonnet, Gemini 2.5 Pro, DeepSeek-R1 and GPT-o3) scoring 60 MalJS pairs on a 0–10 scale; a separate check of GPT-4o-mini renaming on 100 samples found 12% hallucinated names, and the user study had 9 participants. The entropy comparison excludes the LLM stage. MalJS was collected with a security company and BenignJS mixes Tranco top-site scripts with 2,000 clean samples obfuscated by the authors. The authors exclude cryptographic packing, custom interpreters and time-dependent decryption, and note that ES6+ syntax may be downgraded and that vm-based execution carries escape risk. The output is readable JavaScript, not a reconstructed website.", "scope_limitations_zh": "论文标题性的“100% 正确”指 400 个样本（100 个 BenignJS、300 个 MalJS）经解析器与人工检查后的语法有效性；借助 Joern 控制流图／数据依赖图比较和人工复核判断的行为一致性，在 100 个样本中有 83 个成立。20 种技术的能力测试是把每种技术分别施加在同一段代表性代码上；仅靠静态与动态阶段可处理其中 19 种，标识符重命名需要大语言模型阶段。可读性提升来自四个大语言模型（Claude 3.7 Sonnet、Gemini 2.5 Pro、DeepSeek-R1 与 GPT-o3）对 60 组 MalJS 样本按 0–10 分打分；另对 100 个样本的 GPT-4o-mini 重命名进行检查，发现 12% 的名称属于幻觉，用户研究仅有 9 名参与者。熵比较未包含大语言模型阶段。MalJS 是与一家安全公司合作收集的，BenignJS 则混合了 Tranco 热门网站脚本和作者自行混淆的 2,000 个干净样本。作者说明该工具不处理加密打包、自定义解释器和依赖时间的解密，ES6+ 语法可能被降级，基于 vm 的执行也存在逃逸风险。输出是可读的 JavaScript，而非重建的网站。", "targets": [ "website" ], "title": "From Obfuscated to Obvious: A Comprehensive JavaScript Deobfuscation Tool for Security Analysis", "title_zh": "从混淆到清晰：面向安全分析的综合性 JavaScript 反混淆工具", "url": "https://www.ndss-symposium.org/ndss-paper/from-obfuscated-to-obvious-a-comprehensive-javascript-deobfuscation-tool-for-security-analysis/", "venue": "NDSS 2026", "verification": "source-reviewed", "verified_at": "2026-10-19", "why_fits_en": "Adds an open-source end-to-end JavaScript deobfuscator with a large real-world evaluation set, complementing the JsDeObsBench benchmark and LLM-based deobfuscation work in recovering readable client-side code.", "why_fits_zh": "补充一款开源的端到端 JavaScript 反混淆工具及大规模真实评测数据，与 JsDeObsBench 基准和基于大语言模型的反混淆研究共同服务于恢复可读的客户端代码。", "year": 2026 }, { "arxiv_id": "2205.12713", "arxiv_version_reviewed": "v1", "authors": [ "Hao Wang", "Wenjie Qu", "Gilad Katz", "Wenyu Zhu", "Zeyu Gao", "Han Qiu", "Jianwei Zhuge", "Chao Zhang" ], "code_url": "https://github.com/vul337/jTrans", "date_basis": "ACM’s Crossref deposit records published/print and online publication on 2022-07-18. The date comes from that publisher deposit, not from the July 18–22 conference dates.", "date_basis_zh": "ACM 提交的 Crossref 元数据将 published／纸质与在线出版日期均记为 2022-07-18；该日期取自出版方元数据，而非 7 月 18–22 日的会议日期。", "date_precision": "day", "description_en": "jTrans embeds binary functions for similarity search with a BERT-style Transformer. Its jump-aware representation shares parameters between a direct jump’s operand token and the positional embedding of the jump target, so control flow enters the instruction sequence without a separate graph network. The model is pre-trained with masked language modeling and jump-target prediction, then fine-tuned with a cosine triplet objective on functions compiled from the same source at different optimization levels. The paper also introduces BinaryCorp, built by compiling C/C++ packages from Arch Linux’s official repositories and the AUR with gcc and g++.", "description_zh": "jTrans 使用 BERT 风格的 Transformer 为二进制函数生成嵌入，以支持相似性检索。其跳转感知表示让直接跳转的操作数词元与跳转目标的位置嵌入共享参数，从而无需单独的图神经网络即可将控制流引入指令序列。模型先以掩码语言建模和跳转目标预测进行预训练，再以余弦三元组目标在同一源码不同优化级别编译出的函数上微调。论文还发布了 BinaryCorp，它由 gcc 与 g++ 编译 Arch Linux 官方仓库及 AUR 中的 C/C++ 软件包构建而成。", "doi": "10.1145/3533767.3534367", "entry_url": "https://awesomerea.org/papers/paper-jtrans/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-jtrans/", "evidence_urls": [ "https://dl.acm.org/doi/10.1145/3533767.3534367", "https://api.crossref.org/works/10.1145/3533767.3534367", "https://arxiv.org/abs/2205.12713", "https://arxiv.org/pdf/2205.12713v1", "https://github.com/vul337/jTrans/blob/1d405156865e3c582e4f183cbaa623b700ea0e9e/README.md", "https://github.com/vul337/jTrans/blob/1d405156865e3c582e4f183cbaa623b700ea0e9e/LICENSE", "https://github.com/vul337/jTrans/blob/1d405156865e3c582e4f183cbaa623b700ea0e9e/datautils/README.md", "https://github.com/vul337/jTrans/blob/1d405156865e3c582e4f183cbaa623b700ea0e9e/data.py", "https://github.com/vul337/jTrans/blob/1d405156865e3c582e4f183cbaa623b700ea0e9e/finetune.py" ], "first_arxiv_date": "2022-05-25", "id": "paper-jtrans", "kind": "research", "metadata_notes": "The arXiv abstract page titles the paper “jTrans: Jump-Aware Transformer for Binary Code Similarity”; its v1 PDF, the only version, carries the full ISSTA title, ACM reference format and DOI, and its comment cites ISSTA 2022. Crossref and the PDF agree on the eight-author order, the DOI, pages 1–13 and a CC BY 4.0 license. The README at the reviewed 2025-04-10 commit declares MIT and lists Linux, Python 3.8+, PyTorch 1.10+, CUDA 10.2+ and IDA Pro 7.5+ for dataset processing. Trained models, experiment files, the processed BinaryCorp and its original binaries are hosted on the authors’ lab file server outside GitHub, so their availability is separate from the repository. The released data-loading code truncates each function to 512 token positions. Packaged software in BinaryCorp retains its own licenses. Nothing was downloaded beyond the paper and repository files, and no code or experiments were run.", "metadata_notes_zh": "arXiv 摘要页将论文标题写作“jTrans: Jump-Aware Transformer for Binary Code Similarity”；其唯一版本 v1 的 PDF 使用完整的 ISSTA 标题、ACM 引用格式及 DOI，备注也注明 ISSTA 2022。Crossref 与 PDF 一致给出八位作者顺序、DOI、第 1–13 页及 CC BY 4.0 许可。所审阅的 2025-04-10 提交中，README 声明 MIT 许可，并列出 Linux、Python 3.8+、PyTorch 1.10+、CUDA 10.2+，以及用于数据集处理的 IDA Pro 7.5+。训练好的模型、实验文件、处理后的 BinaryCorp 及其原始二进制托管在作者实验室的 GitHub 之外的文件服务器上，其可用性与代码仓库无关。发布的数据加载代码将每个函数截断为 512 个词元位置。BinaryCorp 中的软件包各自保留原有许可。本次除论文与仓库文件外未下载其他内容，也未运行代码或实验。", "pdf_url": "https://arxiv.org/pdf/2205.12713v1", "project_url": null, "publication_date": "2022-07-18", "publication_status": "conference-paper", "runtime_tested": false, "scope_limitations_en": "The model is trained on a single architecture (x86, per the paper’s discussion); cross-architecture search is not evaluated. Only direct jumps are encoded, and indirect-jump targets are left out of scope. Disassembly and function extraction rely on IDA Pro 7.5, so boundary errors upstream are not measured. BinaryCorp pairs gcc/g++ builds across O0–O3 and Os, with train and test split by project; it does not cover obfuscation or other compilers, and only the vulnerability study adds clang variants. Author-reported Recall@1 at pool size 10,000 on BinaryCorp-26M averages 62.5% against 32.0% for the best baseline, and accuracy still falls as pools grow, which the authors note for larger real-world pools. The vulnerability search uses eight CVEs with ten variants each. Baselines date from 2022, and Asm2Vec and OrderMatters were reimplemented, so the comparison does not establish current rankings. Similarity ranking identifies candidate matches; it does not recover source code, names or types.", "scope_limitations_zh": "模型仅在单一架构上训练（据论文讨论部分为 x86），未评估跨架构检索。方法只编码直接跳转，间接跳转目标不在研究范围内。反汇编与函数提取依赖 IDA Pro 7.5，上游的边界识别错误未被衡量。BinaryCorp 在 O0–O3 与 Os 之间配对 gcc／g++ 构建结果，并按项目划分训练集与测试集；它不涵盖混淆或其他编译器，只有漏洞检索实验额外加入 clang 变体。作者报告在 BinaryCorp-26M、候选池规模为 10,000 时，平均 Recall@1 为 62.5%，最佳基线为 32.0%；随着候选池增大，准确率仍会下降，作者也指出真实场景的候选池更大。漏洞检索实验使用八个 CVE，每个有十个变体。基线来自 2022 年，其中 Asm2Vec 与 OrderMatters 为重新实现，因此该比较不能确立当前排名。相似性排序只给出候选匹配，并不恢复源码、名称或类型。", "targets": [ "binary" ], "title": "jTrans: Jump-Aware Transformer for Binary Code Similarity Detection", "title_zh": "jTrans：面向二进制代码相似性检测的跳转感知 Transformer", "url": "https://dl.acm.org/doi/10.1145/3533767.3534367", "venue": "ACM ISSTA 2022", "verification": "source-reviewed", "verified_at": "2026-10-18", "why_fits_en": "Adds learned binary code similarity search, a reverse-engineering aid for function matching, library identification and known-vulnerability search, complementing decompilation and symbol-recovery research.", "why_fits_zh": "补充基于学习的二进制代码相似性检索。它可辅助逆向工程中的函数匹配、库识别与已知漏洞检索，与反编译和符号恢复研究互补。", "year": 2022 }, { "arxiv_id": null, "arxiv_version_reviewed": null, "authors": [ "Chunlin Wang", "Yicheng Yang", "Yuan Zhang", "Haoyu Xiao", "Yifan Zhang", "Jiarun Dai" ], "citation": { "container_title": "35th USENIX Security Symposium (USENIX Security 26)", "pages": "573-592", "publisher": "USENIX Association", "sources": [ "https://www.usenix.org/conference/usenixsecurity26/presentation/wang-chunlin" ] }, "code_url": "https://github.com/seclab-fudan/Khost", "date_basis": "Publication month in the official USENIX proceedings BibTeX.", "date_basis_zh": "采用 USENIX 官方会议录 BibTeX 的出版月份。", "date_precision": "month", "description_en": "Extends KVM with MCU instruction handling, memory mapping and interrupt modeling to rehost firmware on ARMv8-A hosts. An MMIO monitor and firmware wrapper support peripheral interaction and coverage-guided testing.", "description_zh": "扩展 KVM 的 MCU 指令处理、内存映射及中断建模，在 ARMv8-A 主机上重托管固件；MMIO 监控器与固件包装层支持外设交互及覆盖率引导测试。", "doi": null, "entry_url": "https://awesomerea.org/papers/paper-khost/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-khost/", "evidence_urls": [ "https://www.usenix.org/conference/usenixsecurity26/presentation/wang-chunlin", "https://www.usenix.org/system/files/usenixsecurity26-wang-chunlin.pdf", "https://github.com/seclab-fudan/Khost/blob/7f47e429b8ce53b300b9be5074f1956a418238ab/README.md", "https://github.com/seclab-fudan/Khost/blob/7f47e429b8ce53b300b9be5074f1956a418238ab/LICENSE", "https://zenodo.org/api/records/18195819" ], "first_arxiv_date": null, "id": "paper-khost", "kind": "research", "metadata_notes": "Official proceedings give August 2026, pages 573–592. Reviewed pinned README and Apache-2.0 root license; dependencies and firmware licensing are separate. The paper-linked Zenodo v1.02 metadata declares CC BY 4.0 and lists a 65.7 MB archive; the archive was not downloaded. No firmware or tool was executed.", "metadata_notes_zh": "官方会议录列出 2026 年 8 月及 573–592 页。已读固定 README 与 Apache-2.0 根许可证，依赖及固件许可另计。论文所链 Zenodo v1.02 元数据声明 CC BY 4.0，并列出 65.7 MB 归档；本次未下载归档，未执行固件或工具。", "pdf_url": "https://www.usenix.org/system/files/usenixsecurity26-wang-chunlin.pdf", "project_url": "https://zenodo.org/records/18195819", "publication_date": "2026-08", "publication_status": "conference-paper", "runtime_tested": false, "scope_limitations_en": "The prototype needs ARMv8-A with 32-bit compatibility and EL2 virtualization. Some coprocessor operations need added emulation, and entry-point or basic-block recovery can require manual correction. Peripheral approximations can cause false positives; evaluation covers two benchmarks and 12 firmware images, not arbitrary devices.", "scope_limitations_zh": "原型需要支持 32 位兼容和 EL2 虚拟化的 ARMv8-A。部分协处理器操作需补充模拟，入口或基本块恢复可能需要人工修正。外设近似可能造成误报；评测覆盖两个基准及 12 个固件镜像，并非任意设备。", "targets": [ "firmware", "binary" ], "title": "Khost: KVM-based Near Native MCU Firmware Rehosting", "title_zh": "Khost：基于 KVM 的近原生 MCU 固件重托管", "url": "https://www.usenix.org/conference/usenixsecurity26/presentation/wang-chunlin", "venue": "USENIX Security '26", "verification": "source-reviewed", "verified_at": "2026-10-20", "why_fits_en": "Adds a concrete firmware execution-recovery substrate and its architecture constraints.", "why_fits_zh": "补充固件执行环境恢复的具体基础设施及架构限制。", "year": 2026 }, { "arxiv_id": "2511.01252", "arxiv_version_reviewed": "v1", "authors": [ "Siyuan Li", "Yaowen Zheng", "Hong Li", "Jingdong Guo", "Chaopeng Dong", "Chunpeng Yan", "Weijie Wang", "Yimo Ren", "Limin Sun", "Hongsong Zhu" ], "code_url": "https://github.com/Siyuan-Li201/Lares", "date_basis": "Publication year from IEEE's Crossref deposit for the 2025 ASE proceedings. Its only date, 2025-11-16, is the first day of the November 16–20 conference, so no publication month or day is asserted; the arXiv date is not substituted.", "date_basis_zh": "出版年份依据 IEEE 为 2025 年 ASE 论文集提交的 Crossref 元数据。其中唯一的日期 2025-11-16 是 11 月 16–20 日会议的首日，因此本条目不主张出版月份或日期，也不以 arXiv 日期替代。", "date_precision": "year", "description_en": "Lares tests whether a known 1-day vulnerability fix is present in a target binary function without recompiling the project. Its inputs are the target binary, the project source and the patch commit diff. A patch-enhancement step adds data- and control-flow context from the source (via Tree-sitter and Joern) to patches with few changed statements. An LLM then locates the pseudocode slice in the IDA Pro decompilation of the target function that corresponds to each patch slice. Finally, matched slices are normalized into equations and checked for equivalence with the Z3 SMT solver, and the LLM judges the cases Z3 cannot model, deciding whether the function matches the pre-patch or the patched version. On 4,480 test cases from 73 CVEs in OpenSSL, FreeType, tcpdump and libxml2, compiled with GCC 9.4.0 and Clang 6 at O0–O3 for x86, x64 and ARM, the authors report an average F1 of 0.77 on x86 with Claude 3.5 Sonnet, against 0.67 for Robin and 0.68 for PS3, and F1 from 0.71 to 0.77 across five compiler–architecture settings.", "description_zh": "Lares 在不重新编译项目的情况下，测试目标二进制函数中是否已包含某个已知 1-day 漏洞的修复。其输入为目标二进制、项目源码和补丁提交差异。补丁增强步骤借助 Tree-sitter 与 Joern 从源码中为改动语句较少的补丁补充数据流和控制流上下文。随后由大语言模型在目标函数的 IDA Pro 反编译伪代码中定位与每个补丁切片对应的伪代码切片。最后，匹配的切片被规范化为等式并交由 Z3 SMT 求解器检验等价性，Z3 无法建模的情况由大语言模型判断，从而确定该函数对应修复前版本还是已修复版本。在来自 OpenSSL、FreeType、tcpdump 和 libxml2 中 73 个 CVE 的 4,480 个测试用例上（使用 GCC 9.4.0 和 Clang 6 以 O0–O3 为 x86、x64 与 ARM 编译），作者报告使用 Claude 3.5 Sonnet 时 x86 上的平均 F1 为 0.77，Robin 与 PS3 分别为 0.67 和 0.68；在五种编译器—架构组合下 F1 为 0.71 至 0.77。", "doi": "10.1109/ASE63991.2025.00081", "entry_url": "https://awesomerea.org/papers/paper-lares/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-lares/", "evidence_urls": [ "https://ieeexplore.ieee.org/document/11334274", "https://api.crossref.org/works/10.1109/ASE63991.2025.00081", "https://arxiv.org/abs/2511.01252", "https://arxiv.org/pdf/2511.01252v1", "https://github.com/Siyuan-Li201/Lares/blob/b6ca6316f65c706cd21f0febfae87cabc668ef79/README.md", "https://github.com/Siyuan-Li201/Lares/tree/b6ca6316f65c706cd21f0febfae87cabc668ef79/code", "https://github.com/Siyuan-Li201/Lares/tree/b6ca6316f65c706cd21f0febfae87cabc668ef79/patch" ], "first_arxiv_date": "2025-11-03", "id": "paper-lares", "kind": "research", "metadata_notes": "IEEE's Crossref deposit gives the 2025 40th IEEE/ACM ASE proceedings, pages 919–931, and the same ten authors in order; the DOI resolves to IEEE Xplore document 11334274, which refused automated requests, so the review relied on Crossref and the arXiv PDF. arXiv v1 (2025-11-03) is the only version and carries no venue comment, so it may differ from the IEEE version. The abstract links Siyuan-Li201/Lares; at the reviewed 2025-09-16 commit the repository has no license file, and its README gives the inputs as the binary, the project source path and the patch diff file. The repository commits IDA databases for stripped OpenSSL test builds, zipped tcpdump, FreeType and libxml2 sources and patch files, links the evaluation binaries on Google Drive, and requires an IDA Pro 7.5 path and an LLM API key in settings.py; settings.py preconfigures a third-party API relay with an author-supplied test key, which this record does not reproduce. No code or experiments were run.", "metadata_notes_zh": "IEEE 提交的 Crossref 元数据列出 2025 年第 40 届 IEEE/ACM ASE 论文集、第 919–931 页，以及顺序相同的十位作者；该 DOI 解析至 IEEE Xplore 文档 11334274，但该页面拒绝自动请求，因此本次审阅依据 Crossref 与 arXiv PDF。arXiv v1（2025-11-03）是唯一版本，且没有发表场所注释，可能与 IEEE 版本存在差异。摘要链接了 Siyuan-Li201/Lares；在所审阅的 2025-09-16 提交中，仓库没有许可证文件，其 README 将输入列为二进制、项目源码路径和补丁差异文件。仓库提交了已剥离符号的 OpenSSL 测试构建的 IDA 数据库、tcpdump、FreeType 与 libxml2 的源码压缩包及补丁文件，并通过 Google Drive 链接评测用二进制；运行时需要在 settings.py 中设置 IDA Pro 7.5 路径与大语言模型 API 密钥。settings.py 预置了第三方 API 中转服务及作者提供的测试密钥，本条目不予转载。本次未运行代码或实验。", "pdf_url": "https://arxiv.org/pdf/2511.01252v1", "project_url": null, "publication_date": null, "publication_status": "conference-paper", "runtime_tested": false, "scope_limitations_en": "Lares answers a narrow question: given a specific CVE patch diff, the project source with its history and a candidate function, is that function pre-patch or patched? It needs both the patch diff and the project source, and assumes a separate binary code similarity tool (the paper names BinaryAI as an example) has already located the candidate function. It does not find vulnerable functions, discover new vulnerabilities or diff arbitrary binaries. Its judgments rest on an LLM plus SMT reasoning over decompiler pseudocode: Z3 handles only about 21% of test cases (Z3-only verification has recall 0.221), so most decisions come from the LLM, and the authors list hallucinated comparisons, stealthy edit-type patches and repeated patch statements as failure modes. Results use IDA Pro 7.5 and a commercial model at about $0.20 per case; GPT-3.5-Turbo and DeepSeek-Coder score lower. The evaluation covers four C projects, 73 CVEs and binaries the authors compiled themselves, plus 20 vulnerabilities disclosed after October 2024 (400 cases) to check training-data contamination; firmware, other languages and real vendor builds are not evaluated. The repository has no license file, so no reuse terms are granted.", "scope_limitations_zh": "Lares 回答的问题范围很窄：给定某个 CVE 的补丁差异、带有版本历史的项目源码以及候选函数，判断该函数属于修复前版本还是已修复版本。它同时需要补丁差异与项目源码，并假定已由另外的二进制代码相似性工具（论文以 BinaryAI 为例）定位候选函数。它不负责发现漏洞函数、挖掘新漏洞或比较任意二进制。其判断依赖大语言模型与基于反编译伪代码的 SMT 推理：Z3 只能处理约 21% 的测试用例（仅用 Z3 验证时召回率为 0.221），多数判断来自大语言模型；作者列出的失败原因包括大语言模型在比较时产生幻觉、隐蔽的修改型补丁以及重复出现的补丁语句。结果使用 IDA Pro 7.5 与商用模型，每个用例约花费 0.20 美元；GPT-3.5-Turbo 与 DeepSeek-Coder 的得分更低。评测覆盖四个 C 项目、73 个 CVE 及作者自行编译的二进制，另以 2024 年 10 月之后披露的 20 个漏洞（400 个用例）检验训练数据污染；未评测固件、其他语言或真实厂商构建。仓库没有许可证文件，因此未授予任何复用条款。", "targets": [ "binary" ], "title": "Lares: LLM-driven Code Slice Semantic Search for Patch Presence Testing", "title_zh": "Lares：面向补丁存在性测试的大语言模型驱动代码切片语义搜索", "url": "https://ieeexplore.ieee.org/document/11334274", "venue": "ASE 2025", "verification": "source-reviewed", "verified_at": "2026-10-19", "why_fits_en": "Adds binary patch presence testing, using LLM-located slices of decompiled pseudocode, to the decompilation and binary-analysis research; it complements the curated BinDiff diffing tool rather than replacing it.", "why_fits_zh": "为反编译与二进制分析研究补充二进制补丁存在性测试方向，利用大语言模型在反编译伪代码中定位切片；它与精选目录中的 BinDiff 差异比较工具互补，而非替代。", "year": 2025 }, { "arxiv_id": "2310.12357", "arxiv_version_reviewed": "v2", "authors": [ "Chongzhou Fang", "Ning Miao", "Shaurya Srivastav", "Jialin Liu", "Ruoyu Zhang", "Ruijie Fang", "Asmita", "Ryan Tsang", "Najmeh Nazari", "Han Wang", "Houman Homayoun" ], "code_url": null, "date_basis": "Publication month in the official USENIX proceedings BibTeX; the August 14–16, 2024 symposium dates are not used to assert a publication day.", "date_basis_zh": "采用 USENIX 官方论文集 BibTeX 中的出版月份，不以 2024 年 8 月 14–16 日的会议日期推定具体出版日。", "date_precision": "month", "description_en": "Evaluates GPT-3.5-turbo, GPT-4, LLaMA-2-13B, Code-LLaMA-2-13B-Instruct and StarChat-Beta on explaining what de-commented JavaScript, Python and C code does, then repeats the task on JavaScript obfuscated with JavaScript Obfuscator (identifier renaming, dead-code injection, control-flow flattening and string splitting) and with Wobfuscator’s WebAssembly transformation. GPT-3.5 and GPT-4 are also asked to rewrite 100 IOCCC winning programs as readable, compilable code. Case studies apply GPT models to a botnet and a benign browser-extension repository, an Android SMS stealer decompiled with JD-GUI, and WannaCry code decompiled with RetDec.", "description_zh": "评估 GPT-3.5-turbo、GPT-4、LLaMA-2-13B、Code-LLaMA-2-13B-Instruct 与 StarChat-Beta 解释已去除注释的 JavaScript、Python 和 C 代码功能的能力，再在经 JavaScript Obfuscator（标识符重命名、死代码注入、控制流平坦化与字符串拆分）及 Wobfuscator WebAssembly 变换混淆的 JavaScript 上重复该任务。研究还要求 GPT-3.5 与 GPT-4 将 100 个 IOCCC 获奖程序改写为可读、可编译的代码。案例研究将 GPT 模型用于一个僵尸网络仓库与一个正常浏览器扩展仓库、经 JD-GUI 反编译的 Android 短信窃取程序，以及经 RetDec 反编译的 WannaCry 代码。", "doi": null, "entry_url": "https://awesomerea.org/papers/paper-llm-code-analysis/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-llm-code-analysis/", "evidence_urls": [ "https://www.usenix.org/conference/usenixsecurity24/presentation/fang", "https://www.usenix.org/system/files/usenixsecurity24-fang.pdf", "https://arxiv.org/abs/2310.12357", "https://arxiv.org/pdf/2310.12357v2", "https://github.com/aseec-lab/llms-for-code-analysis/blob/f1bdb01f1da9143bda796c259f06c7364683a102/README.md", "https://github.com/aseec-lab/llms-for-code-analysis/tree/f1bdb01f1da9143bda796c259f06c7364683a102" ], "first_arxiv_date": "2023-10-18", "id": "paper-llm-code-analysis", "kind": "research", "metadata_notes": "USENIX publishes no DOI for the paper; the arXiv identifier is recorded, and the final PDF name usenixsecurity24-fang.pdf does not use the secYY publisher profile. The USENIX page, its BibTeX and the final PDF agree on the 11-author order, the single-name author Asmita, pages 829–846 and ISBN 978-1-939133-44-1; the page also lists a prepublication PDF. arXiv v2 (2024-03-05) carries the comment “Accepted by Usenix Security 2024”. The paper names the online appendix; at the reviewed 2024-08-28 commit it holds dataset, result and case-study folders and declares no license, and its samples include third-party code that keeps its own terms. The appendix is recorded as the project link rather than as code. Model versions beyond family names are not specified in the paper. The appendix contents and malware samples were not downloaded, and no experiments were run.", "metadata_notes_zh": "USENIX 未为该论文提供 DOI；本条目记录 arXiv 标识符，最终 PDF 文件名 usenixsecurity24-fang.pdf 也不符合 secYY 出版方规则。USENIX 页面、其 BibTeX 与最终 PDF 一致给出 11 位作者顺序、单名作者 Asmita、第 829–846 页及 ISBN 978-1-939133-44-1；页面还提供一份预发表 PDF。arXiv v2（2024-03-05）备注为“Accepted by Usenix Security 2024”。论文点名了在线附录；在所审阅的 2024-08-28 提交中，附录包含数据集、结果与案例研究目录，但未声明许可证，其中的样本包括保留各自条款的第三方代码。该附录作为项目链接记录，而非代码。论文除模型家族名称外未说明具体模型版本。本次未下载附录内容或恶意软件样本，也未运行实验。", "pdf_url": "https://www.usenix.org/system/files/usenixsecurity24-fang.pdf", "project_url": "https://github.com/aseec-lab/llms-for-code-analysis", "publication_date": "2024-08", "publication_status": "conference-paper", "runtime_tested": false, "scope_limitations_en": "Ground truth is GPT-4’s own explanations after manual checking by four students; other models are scored against those texts with similarity metrics and a GPT-4 judge, which the authors say is unreliable without manual calibration. Correctness is judged at explanation level, not by recovered behavior or executable equivalence. Only JavaScript is obfuscated with generated transformations; neither GPT model deciphered the WebAssembly that Wobfuscator inserts, and the smaller models produced no meaningful explanations once obfuscation was applied. Author-reported figures include 97.4% GPT-4 accuracy on non-obfuscated code and 87% on obfuscated JavaScript; in IOCCC de-obfuscation, about 20% of GPT-3.5’s targets and 19% of GPT-4’s yielded compilable code, and only 8% and 4% produced correct results. The malware analyses are qualitative case studies on a few samples, with manual chunking for WannaCry, missed behavior when context was split, and a false alarm in the botnet repository. Models recognized code from popular repositories, so memorization is a confound. The evaluated GPT-3.5/GPT-4-era and LLaMA-2-13B-class models are dated. The study analyzes source or already-decompiled text; it does not perform binary decompilation.", "scope_limitations_zh": "真实标签是 GPT-4 自身生成、经四名学生人工核查的解释；其他模型则通过相似度指标与 GPT-4 评判与这些文本比较，作者也指出该评判方法若无人工校准并不可靠。正确性在解释层面判断，并非依据恢复出的行为或可执行等价性。只有 JavaScript 经过工具生成的混淆变换；两个 GPT 模型都未能解读 Wobfuscator 插入的 WebAssembly，较小模型在施加混淆后则无法给出有意义的解释。作者报告 GPT-4 在未混淆代码上的准确率为 97.4%，在混淆 JavaScript 上为 87%；在 IOCCC 去混淆任务中，GPT-3.5 约 20%、GPT-4 19% 的目标得到可编译代码，最终仅分别有 8% 和 4% 产生正确结果。恶意软件分析是针对少量样本的定性案例研究：WannaCry 需人工分块输入，上下文被拆分时会漏掉行为，僵尸网络仓库中还出现误报。模型能认出来自热门仓库的代码，因此记忆效应是混杂因素。被评测的 GPT-3.5／GPT-4 时代模型及 LLaMA-2-13B 级别模型已经过时。研究分析的是源码或已反编译的文本，并不执行二进制反编译。", "targets": [ "website", "app" ], "title": "Large Language Models for Code Analysis: Do LLMs Really Do Their Job?", "title_zh": "面向代码分析的大语言模型：LLM 真的胜任吗？", "url": "https://www.usenix.org/conference/usenixsecurity24/presentation/fang", "venue": "USENIX Security 2024", "verification": "source-reviewed", "verified_at": "2026-10-18", "why_fits_en": "Measures how far LLM explanations survive JavaScript obfuscation and decompiler output, complementing JavaScript deobfuscation benchmarks and tools in the collection.", "why_fits_zh": "衡量 LLM 的代码解释在 JavaScript 混淆和反编译器输出下还能保持多少可靠性，与合集中的 JavaScript 去混淆基准和工具互补。", "year": 2024 }, { "arxiv_id": null, "arxiv_version_reviewed": null, "authors": [ "David Beste", "Grégoire Menguy", "Hossein Hajipour", "Mario Fritz", "Antonio Emanuele Cinà", "Sébastien Bardin", "Thorsten Holz", "Thorsten Eisenhofer", "Lea Schönherr" ], "code_url": "https://github.com/DavidBeste/llm-code-deobfuscation", "date_basis": "Springer's Crossref deposit gives first online publication on 2025-07-10, during the July 9–11 conference; its print and issued dates give only the year. This entry uses the publisher's online date, not the conference schedule or the later CISPA repository date.", "date_basis_zh": "Springer 提交的 Crossref 元数据将首次在线出版日期列为 2025-07-10，处于 7 月 9–11 日会议期间；其纸质出版与发布日期只给出年份。本条目采用出版方的在线出版日期，不依据会议日程或之后的 CISPA 存储库日期。", "date_precision": "day", "description_en": "Studies LLMs as source-to-source deobfuscators for C functions protected with the Tigress obfuscator. Functions from ExeBench, with identifiers randomized, are obfuscated with five transformations: MBA arithmetic encoding, branch encoding, control-flow flattening, opaque predicates and argument randomization. Each model receives a whole obfuscated function and returns simplified C. DeepSeek Coder 6.7B and Code Llama 7B are fine-tuned on obfuscated–original pairs, GPT-4 is prompted, and Clang optimization at -O0 to -O3 serves as a compiler baseline. Simplification is scored with Halstead program length relative to the original and obfuscated code, syntactic correctness by compiling ExeBench wrappers and semantic correctness by ExeBench input/output samples. The fine-tuned models reduce complexity more than GPT-4 on every transformation and more than Clang except on arithmetic encoding and argument randomization, where Clang is on par. Trained on chains of up to five transformations, they keep stable scores on chains of six and seven, and the best model cuts Halstead program length by 89.21% on average in the hardest scenario. A test with randomized constants found one sample that reproduced memorized code.", "description_zh": "研究将大语言模型用作源码到源码的去混淆器，处理经 Tigress 混淆器保护的 C 函数。研究从 ExeBench 选取函数并随机化标识符，再施加五种变换：MBA 算术编码、分支编码、控制流平坦化、不透明谓词和参数随机化。模型每次读入一个完整的混淆函数并输出简化后的 C 代码。DeepSeek Coder 6.7B 与 Code Llama 7B 在“混淆—原始”代码对上微调，GPT-4 通过提示使用，Clang 的 -O0 至 -O3 优化则作为编译器基线。简化效果以 Halstead 程序长度相对于原始代码与混淆代码的变化衡量，语法正确性通过编译 ExeBench 包装程序检查，语义正确性则用 ExeBench 输入／输出样例检查。微调模型在每种变换上降低复杂度的幅度都大于 GPT-4，除算术编码和参数随机化（Clang 与之相当）外也大于 Clang。模型在最多五个变换组成的链上训练，在六个和七个变换的链上得分仍保持稳定；最佳模型在最困难场景中平均将 Halstead 程序长度缩减 89.21%。随机化常量的记忆测试只发现一个样本复现了记忆中的代码。", "doi": "10.1007/978-3-031-97620-9_15", "entry_url": "https://awesomerea.org/papers/paper-llm-code-deobfuscation/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-llm-code-deobfuscation/", "evidence_urls": [ "https://doi.org/10.1007/978-3-031-97620-9_15", "https://api.crossref.org/works/10.1007/978-3-031-97620-9_15", "https://ndownloader.figshare.com/files/65792754", "https://publications.cispa.de/articles/conference_contribution/Exploring_the_Potential_of_LLMs_for_Code_Deobfuscation/32771220", "https://cispa.de/en/research/publications/84747-exploring-the-potential-of-llms-for-code-deobfuscation", "https://github.com/DavidBeste/llm-code-deobfuscation/blob/00c9c4581403187e964ffec42d315114bccf5125/README.md", "https://github.com/DavidBeste/llm-code-deobfuscation/blob/00c9c4581403187e964ffec42d315114bccf5125/LICENSE", "https://github.com/DavidBeste/llm-code-deobfuscation/blob/00c9c4581403187e964ffec42d315114bccf5125/requirements.txt", "https://github.com/DavidBeste/llm-code-deobfuscation/blob/00c9c4581403187e964ffec42d315114bccf5125/single_transformations/eval/create_eval_data_single.py", "https://zenodo.org/records/15831457" ], "first_arxiv_date": null, "id": "paper-llm-code-deobfuscation", "kind": "research", "metadata_notes": "Springer's Crossref deposit gives the Lecture Notes in Computer Science proceedings of the 22nd DIMVA (Graz, 9–11 July 2025), pages 267–286, and the nine authors in the order of the PDF byline. The Springer landing page returned a browser challenge to automated requests, so the review used Crossref and the open-access PDF from the CISPA repository record 10.60882/cispa.32771220.v1 (CC BY 4.0, deposited 2026-06-23). That record and the CISPA publication page list \"Antonio Emanuele\" and \"Sébastian Bardin\"; the authors here follow Crossref and the PDF. An arXiv API search for Beste with deobfuscation in the title returned no record, so arxiv_id is null. The PDF links DavidBeste/llm-code-deobfuscation, reviewed at commit 00c9c45 (2026-02-27), which added the MIT LICENSE after publication. Its README links the dataset 10.5281/zenodo.15831457 (2025-07-10, CC BY 4.0, a 17 MB deobfuscation_dataset.zip that was not downloaded); that dataset DOI is not used as the paper identifier. The scripts call a separately installed Tigress 3.3.3, load ExeBench from Hugging Face and query the OpenAI API for GPT-4 (gpt-4-32k-0314 in the README examples); requirements.txt pins clang 14.0 and torch 2.4.1 but lists two conflicting versions each of peft and transformers. No code or experiments were run.", "metadata_notes_zh": "Springer 提交的 Crossref 元数据列出第 22 届 DIMVA（格拉茨，2025 年 7 月 9–11 日）的 Lecture Notes in Computer Science 论文集、第 267–286 页，以及与 PDF 署名顺序一致的九位作者。Springer 页面对自动请求返回浏览器验证，因此本次审阅依据 Crossref，以及 CISPA 存储库记录 10.60882/cispa.32771220.v1 中的开放获取 PDF（CC BY 4.0，2026-06-23 存入）。该记录与 CISPA 出版物页面将作者写作“Antonio Emanuele”和“Sébastian Bardin”；本条目的作者姓名以 Crossref 和 PDF 为准。以 Beste 为作者、标题含 deobfuscation 的 arXiv API 检索没有结果，因此 arxiv_id 为 null。PDF 链接 DavidBeste/llm-code-deobfuscation，审阅的提交为 00c9c45（2026-02-27），该提交在论文发表后才加入 MIT LICENSE。其 README 链接数据集 10.5281/zenodo.15831457（2025-07-10，CC BY 4.0，17 MB 的 deobfuscation_dataset.zip，未下载）；该数据集 DOI 不用作论文标识符。脚本调用另行安装的 Tigress 3.3.3，从 Hugging Face 加载 ExeBench，并通过 OpenAI API 调用 GPT-4（README 示例中为 gpt-4-32k-0314）；requirements.txt 固定了 clang 14.0 与 torch 2.4.1，但 peft 和 transformers 各列出两个相互冲突的版本。本次未运行代码或实验。", "pdf_url": "https://ndownloader.figshare.com/files/65792754", "project_url": null, "publication_date": "2025-07-10", "publication_status": "conference-paper", "runtime_tested": false, "scope_limitations_en": "The obfuscation is Tigress (version 3.3.3 in the released scripts) applied source-to-source to single C functions. Compiled binaries, decompiler output, commercial protectors, inter-procedural obfuscation, VM-based packing and self-modifying code are not evaluated; the authors only note that decompilation can approximate C from binaries. This is source-level simplification, not binary deobfuscation or VM devirtualization. Semantic correctness is the main weakness: for single transformations the fine-tuned models preserve behavior in 50% to 94.5% of samples, mostly below GPT-4 and, except for branch encoding, below Clang, and it falls as transformation chains grow longer. Complexity scores count only samples that are both syntactically and semantically correct. Behavior is checked with ExeBench input/output samples rather than equivalence proofs, inputs are limited to a 6,144-token context, and models were fine-tuned with 8-bit quantization. Only one obfuscator is used, so generalization to other obfuscators, versions, machine code or bytecode is left open, and baselines are GPT-4 and Clang rather than dedicated deobfuscation tools.", "scope_limitations_zh": "混淆使用 Tigress（发布脚本中为 3.3.3 版），以源码到源码的方式作用于单个 C 函数。研究未评估已编译二进制、反编译器输出、商业保护器、跨过程混淆、基于虚拟机的加壳或自修改代码；作者仅指出可通过反编译从二进制得到近似的 C 代码。这是源码级简化，并非二进制去混淆或虚拟机去虚拟化。语义正确性是主要短板：在单一变换场景中，微调模型保持行为的样本比例为 50% 至 94.5%，大多低于 GPT-4，除分支编码外也低于 Clang，并且随着变换链变长而下降。复杂度得分只统计语法与语义均正确的样本。行为通过 ExeBench 输入／输出样例检查，而非等价性证明；输入受 6,144 个词元的上下文限制，模型微调时还使用了 8 位量化。研究只使用一种混淆器，因此对其他混淆器、版本、机器码或字节码的泛化仍待验证；基线是 GPT-4 与 Clang，而非专用去混淆工具。", "targets": [ "binary" ], "title": "Exploring the Potential of LLMs for Code Deobfuscation", "title_zh": "探索大语言模型在代码去混淆中的潜力", "url": "https://doi.org/10.1007/978-3-031-97620-9_15", "venue": "DIMVA 2025", "verification": "source-reviewed", "verified_at": "2026-10-19", "why_fits_en": "Adds source-level deobfuscation of protected C code with fine-tuned code LLMs, complementing the JavaScript (JsDeObsBench, CASCADE) and Android (DeGuard) deobfuscation papers and the LLM decompilation research in this section.", "why_fits_zh": "补充利用微调代码大语言模型对受保护 C 代码进行源码级去混淆的研究，与书目中的 JavaScript（JsDeObsBench、CASCADE）和 Android（DeGuard）去混淆论文以及本节的大语言模型反编译研究互补。", "year": 2025 }, { "arxiv_id": null, "arxiv_version_reviewed": null, "authors": [ "Ryutaro Nishizaka", "Yudai Fujiwara", "Takuya Shimizu", "Kazushi Kato", "Yuichi Sugiyama" ], "code_url": null, "date_basis": "The Internet Society’s Crossref deposit gives publication year 2026. The PDF footer names the 27 February 2026 workshop; no finer publication date is asserted from the event date.", "date_basis_zh": "Internet Society 向 Crossref 提交的元数据给出出版年份 2026。PDF 页脚标注研讨会于 2026 年 2 月 27 日举行；不据此推定更精确的出版日期。", "date_precision": "year", "description_en": "Runs Claude Code, Codex CLI and ChatGPT-5.2 Pro on 24 crackme-style challenges selected from 15 international CTF events held in 2025, and attributes their failures to stages of an Observe–Comprehend–Plan loop and to three protection effects: concealment, complication and misdirection. From the failure logs, the authors derive four recurring weaknesses (training bias, over-trust in observations, context limitation and plan persistence). They rerun both CLI agents without a decompiler and compare outcomes with in-competition solve rates.", "description_zh": "让 Claude Code、Codex CLI 与 ChatGPT-5.2 Pro 求解从 2025 年 15 场国际 CTF 赛事中选出的 24 道 crackme 类题目，并将失败归因到“观察—理解—计划”循环的各阶段，以及隐藏、复杂化与误导三类保护效果。作者从失败日志中归纳出四类反复出现的弱点：训练偏差、过度信任观察结果、上下文限制和计划固守。他们还在移除反编译器后重新运行两个命令行智能体，并将结果与赛时解题率对比。", "doi": "10.14722/bar.2026.23058", "entry_url": "https://awesomerea.org/papers/paper-llm-resistant-protection/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-llm-resistant-protection/", "evidence_urls": [ "https://www.ndss-symposium.org/ndss-paper/auto-draft-657/", "https://www.ndss-symposium.org/wp-content/uploads/bar2026-58.pdf", "https://doi.org/10.14722/bar.2026.23058", "https://api.crossref.org/works/10.14722/bar.2026.23058", "https://www.ndss-symposium.org/ndss-program/bar-2026/" ], "first_arxiv_date": null, "id": "paper-llm-resistant-protection", "kind": "research", "metadata_notes": "BAR 2026 is a workshop co-located with NDSS Symposium 2026, not the NDSS main track. The five-author order follows the PDF, the NDSS paper and program pages, and the Internet Society’s Crossref deposit. The DOI resolves directly to the PDF, whose footer gives ISBN 978-1-970672-08-4; Crossref lists no pages, and no page range was verified. No arXiv version was found. Table I gives per-task times and weakness labels for each configuration; the per-agent counts (15, 17, 14, 14 and 19 of 24) and the decompiler comparison are author-reported. The paper names no code or data release. Experiments were not rerun for this collection.", "metadata_notes_zh": "BAR 2026 是与 NDSS Symposium 2026 同期举办的研讨会，并非 NDSS 主会。五位作者的顺序以 PDF、NDSS 论文页与日程页及 Internet Society 向 Crossref 提交的元数据为准。该 DOI 直接解析到 PDF，PDF 页脚标注 ISBN 978-1-970672-08-4；Crossref 未列出页码，本条目未核实页码范围。未找到 arXiv 版本。表 I 给出各配置在每道题上的用时与弱点标签；各智能体解出的题数（24 题中分别为 15、17、14、14 和 19 题）及反编译器对比结果均由作者报告。论文未提及代码或数据发布。本合集未重新运行实验。", "pdf_url": "https://www.ndss-symposium.org/wp-content/uploads/bar2026-58.pdf", "project_url": null, "publication_date": null, "publication_status": "conference-paper", "runtime_tested": false, "scope_limitations_en": "The study covers 24 locally solvable Linux x86-64 ELF crackmes and three commercial agents (Claude Opus 4.5 and GPT-5.1-Codex-Max in the CLI tools, and an undisclosed ChatGPT model), evaluated in December 2025 with network access; runs that consulted public write-ups were excluded. The binaries are small relative to real-world software, and malware analysis and vulnerability discovery are out of scope. Each configuration had at most three attempts with early stopping, which the authors call noisy; success means printing the correct flag or finding an accepted input. Weakness labels come from qualitative log analysis by two evaluators and describe these runs, not general properties of LLM agents. ChatGPT-5.2 Pro ran in an uncontrolled web sandbox and is excluded from the decompiler comparison. Solve rates are among teams that solved at least one challenge, unavailable for six tasks, and may include LLM-assisted teams. Training-data exposure remains a validity threat, and the paper does not publish its assembled challenge set, run logs or code.", "scope_limitations_zh": "研究覆盖 24 道可在本地求解的 Linux x86-64 ELF crackme 题目和三个商用智能体（命令行工具使用 Claude Opus 4.5 与 GPT-5.1-Codex-Max，ChatGPT 所用模型未公开），于 2025 年 12 月在允许联网的条件下评测；查阅公开题解的运行已被排除。这些二进制相比真实软件规模较小，恶意软件分析与漏洞发现不在范围内。每种配置最多尝试三次，成功即停止，作者承认这种估计噪声较大；成功指输出正确 flag 或找到被程序接受的输入。弱点标签来自两名评估者对日志的定性分析，描述的是这些运行，并非 LLM 智能体的普遍属性。ChatGPT-5.2 Pro 在无法控制的网页沙箱中运行，未纳入反编译器对比。解题率按至少解出一题的队伍计算，其中六题没有数据，参赛队伍也可能借助 LLM。训练数据泄露仍是有效性威胁；论文未公开其整理的题目集、运行日志或代码。", "targets": [ "binary" ], "title": "Towards LLM-Resistant Software Protection: Agent Failure Patterns in CTF Reverse Engineering", "title_zh": "迈向抗 LLM 的软件保护：CTF 逆向工程中的智能体失败模式", "url": "https://www.ndss-symposium.org/ndss-paper/auto-draft-657/", "venue": "Workshop on Binary Analysis Research (BAR) 2026", "verification": "source-reviewed", "verified_at": "2026-10-18", "why_fits_en": "Links reverse-engineering agent failures to specific protection effects and analysis stages, complementing benchmarks that mainly report success rates.", "why_fits_zh": "将逆向工程智能体的失败与具体保护效果和分析阶段联系起来，补充主要报告成功率的基准。", "year": 2026 }, { "arxiv_id": "2403.05286", "arxiv_version_reviewed": "v3", "authors": [ "Hanzhuo Tan", "Qi Luo", "Jing Li", "Yuqun Zhang" ], "code_url": "https://github.com/albertan017/LLM4Decompile", "date_basis": "ACL proceedings publication month", "date_basis_zh": "ACL 会议论文集的出版月份。", "date_precision": "month", "description_en": "Trains language models for assembly-to-C decompilation and for refining Ghidra pseudocode, evaluating whether recovered functions can be recompiled and executed correctly.", "description_zh": "训练语言模型将汇编反编译为 C，并改进 Ghidra 伪代码，以恢复函数能否重新编译并正确执行为评估目标。", "doi": "10.18653/v1/2024.emnlp-main.203", "entry_url": "https://awesomerea.org/papers/paper-llm4decompile/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-llm4decompile/", "evidence_urls": [ "https://aclanthology.org/2024.emnlp-main.203/", "https://aclanthology.org/2024.emnlp-main.203.pdf", "https://arxiv.org/abs/2403.05286", "https://github.com/albertan017/LLM4Decompile", "https://github.com/albertan017/LLM4Decompile/blob/85b364bf093eb2ee4f3687cfe38a203fca89f23e/README.md" ], "first_arxiv_date": "2024-03-08", "id": "paper-llm4decompile", "kind": "research", "metadata_notes": "Publication date is the conference month; first_arxiv_date is recorded separately.", "metadata_notes_zh": "出版日期采用会议论文集月份；arXiv 首次提交日期单独记录。", "pdf_url": "https://aclanthology.org/2024.emnlp-main.203.pdf", "project_url": null, "publication_date": "2024-11", "publication_status": "conference-paper", "runtime_tested": false, "scope_limitations_en": "The paper limits its experiments to C on x86 and function-level benchmarks. Re-executability on sampled tests does not establish whole-program equivalence or recovery of the original source. Later repository releases are separate from the 2024 paper.", "scope_limitations_zh": "论文实验限定于 x86 平台的 C 代码和函数级基准。通过抽样测试重新执行，不代表整程序等价或恢复了原始源码。仓库后续版本应与 2024 年论文区分。", "targets": [ "binary" ], "title": "LLM4Decompile: Decompiling Binary Code with Large Language Models", "title_zh": "LLM4Decompile：使用大语言模型反编译二进制代码", "url": "https://aclanthology.org/2024.emnlp-main.203/", "venue": "EMNLP 2024", "verification": "source-reviewed", "verified_at": "2026-10-16", "why_fits_en": "Direct evidence for LLM decompilation and a concrete baseline for evaluating agent-generated or refined pseudocode.", "why_fits_zh": "直接研究 LLM 反编译，可作为评估智能体生成或改进伪代码的具体基线。", "year": 2024 }, { "arxiv_id": "2406.18379", "arxiv_version_reviewed": "v3", "authors": [ "Haolang Lu", "Hongrui Peng", "Guoshun Nan", "Jiaoyang Cui", "Cheng Wang", "Weifei Jin", "Songtao Wang", "Shengli Pan", "Xiaofeng Tao" ], "code_url": null, "date_basis": "IEEE's Crossref deposit gives only the 2025 publication year for volume 20. The 2025-06-26 DOI-registration date and the arXiv dates are not used to assert a month or day.", "date_basis_zh": "IEEE 提交的 Crossref 元数据仅给出第 20 卷的出版年份 2025。本条目不依据 2025-06-26 的 DOI 注册日期或 arXiv 日期推定月份或日期。", "date_precision": "year", "description_en": "MALSIGHT writes natural-language summaries of stripped binary malware one function at a time. IDA Pro produces pseudocode and a call graph, and functions are summarized callees first, so each caller receives its callees' summaries as context; a sequence-labeling model also marks key API calls and strings, which drive code-search retrieval and LLM-written annotations. The summarizer, MalT5, is a 0.77B-parameter CodeT5+ model fine-tuned first on MalS, 89,609 malicious C source functions from GitHub with LLM-generated summaries refined by human reviewers, and then on annotated benign pseudocode from the Capybara dataset. The authors also introduce MalP, 500 pseudocode functions for testing, and BLEURT-sum, a fine-tuned BLEURT metric, and report that MalT5 performs comparably to much larger Code Llama models.", "description_zh": "MALSIGHT 以函数为单位，为剥离符号的二进制恶意软件生成自然语言摘要。它先用 IDA Pro 生成伪代码和调用图，再按先被调用者、后调用者的顺序生成摘要，使每个调用者都能获得其被调用函数的摘要作为上下文；另有一个序列标注模型标记关键 API 调用和字符串，据此进行代码检索并由大语言模型生成注释。摘要模型 MalT5 是 0.77B 参数的 CodeT5+，先在 MalS 上微调，即来自 GitHub 的 89,609 个恶意 C 源码函数，其摘要由大语言模型生成并经人工审阅完善，再在 Capybara 数据集带注释的良性伪代码上微调。作者还提出了包含 500 个伪代码函数的测试集 MalP 和微调 BLEURT 得到的评测指标 BLEURT-sum，并报告 MalT5 的表现与规模大得多的 Code Llama 模型相当。", "doi": "10.1109/TIFS.2025.3583552", "entry_url": "https://awesomerea.org/papers/paper-malsight/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-malsight/", "evidence_urls": [ "https://doi.org/10.1109/TIFS.2025.3583552", "https://api.crossref.org/works/10.1109/TIFS.2025.3583552", "https://arxiv.org/abs/2406.18379", "https://arxiv.org/pdf/2406.18379v3", "https://github.com/lhl7/Malsight/blob/af49daf6dd1d2dbfaea7760af928c7d356fe5c7d/README.md" ], "first_arxiv_date": "2024-06-26", "id": "paper-malsight", "kind": "research", "metadata_notes": "Crossref records volume 20, pages 6733–6747, and the nine-author order, which matches arXiv; it spells the title 'Malsight', while arXiv and the paper write MALSIGHT, and the record follows the publisher title. IEEE Xplore could not be retrieved, so publication facts follow Crossref and the reviewed text is arXiv v3 (2025-06-17), whose comment states acceptance by IEEE TIFS; v1 is dated 2024-06-26 and v2 2024-11-06. The paper reports extracting close to 30K functions from 2,289 repositories before giving the 89,609-function MalS total, and calls MalT5 0.7B in its contribution list and 0.77B elsewhere. Footnote 1 promises a source-code release but gives no link. The repository lhl7/Malsight, described as 'code for Malsight', is owned by an account whose profile name matches the first author, but neither the paper nor an author page links it, so code_url stays null. At the reviewed 2025-07-24 commit it has no license file and links Apache-2.0 Hugging Face models (sequence labeling, CodeT5+ 770M, BLEURT) and datasets. Nothing was downloaded or run.", "metadata_notes_zh": "Crossref 记录第 20 卷、页码 6733–6747 及九位作者顺序，与 arXiv 一致；其标题写作“Malsight”，arXiv 与论文正文则写作 MALSIGHT，本条目采用出版方标题。IEEE Xplore 无法访问，因此出版信息以 Crossref 为准，所审阅的文本是 arXiv v3（2025-06-17），其注释说明论文已被 IEEE TIFS 接收；v1 发布于 2024-06-26，v2 为 2024-11-06。论文先称从 2,289 个仓库中提取了近 3 万个函数，随后又给出 MalS 共 89,609 个函数；贡献列表称 MalT5 为 0.7B 参数，其他部分则为 0.77B。脚注 1 承诺发布源码，但未给出链接。仓库 lhl7/Malsight 的描述为“code for Malsight”，其所属账号的个人资料名称与第一作者一致，但论文和作者页面均未链接该仓库，因此 code_url 保持为空。在所审阅的 2025-07-24 提交中，该仓库没有许可证文件，并链接采用 Apache-2.0 许可的 Hugging Face 模型（序列标注、CodeT5+ 770M、BLEURT）与数据集。本次未下载或运行任何内容。", "pdf_url": "https://arxiv.org/pdf/2406.18379v3", "project_url": null, "publication_date": null, "publication_status": "journal-article", "runtime_tested": false, "scope_limitations_en": "Training summaries are LLM-generated and then reviewed and refined by five experts rather than written from scratch. MalP's 500 test functions come from compiling and decompiling 20 of the same GitHub malware repositories, not from wild samples, and the authors note that loose filtering may let training and test data overlap and inflate results. Quality is scored mainly with the authors' own BLEURT-sum metric. On ten real malware samples, with 79 functions also rated by three reverse engineers, BLEURT-sum was about 30% lower than on MalP, which the authors attribute to long functions: 15.8% exceed 1,000 tokens, while most training functions are under 300. The pipeline depends on IDA Pro pseudocode, and static annotation relies on online code search and a general-purpose LLM. MALSIGHT summarizes behavior; it is not a malware detector or classifier.", "scope_limitations_zh": "训练用摘要由大语言模型生成，再经五位专家审阅完善，并非从零开始人工撰写。MalP 的 500 个测试函数来自对同一批 GitHub 恶意代码仓库中 20 个仓库的编译与反编译，而非野外样本；作者也指出，过滤不够严格可能导致训练集与测试集重叠，从而使结果偏高。质量评估主要采用作者自行提出的 BLEURT-sum 指标。在十个真实恶意软件样本上（其中 79 个函数另由三名逆向工程人员评分），BLEURT-sum 比在 MalP 上低约 30%，作者将其归因于函数过长：15.8% 的函数超过 1,000 个词元，而大多数训练函数不足 300 个。该流程依赖 IDA Pro 伪代码，静态注释依赖在线代码搜索和通用大语言模型。MALSIGHT 用于概括行为，既不是恶意软件检测器，也不是分类器。", "targets": [ "binary" ], "title": "Malsight: Exploring Malicious Source Code and Benign Pseudocode for Iterative Binary Malware Summarization", "title_zh": "Malsight：结合恶意源代码与良性伪代码的二进制恶意软件迭代式摘要生成", "url": "https://doi.org/10.1109/TIFS.2025.3583552", "venue": "IEEE Transactions on Information Forensics and Security", "verification": "source-reviewed", "verified_at": "2026-10-19", "why_fits_en": "Adds LLM-based summarization of stripped malware pseudocode that follows the call graph, complementing decompilation, symbol-recovery and benchmark records that include binary code summarization.", "why_fits_zh": "补充沿调用图对剥离符号的恶意软件伪代码进行摘要的大语言模型方法，与反编译、符号恢复以及包含二进制代码摘要任务的基准记录互补。", "year": 2025 }, { "arxiv_id": "2609.17236", "arxiv_version_reviewed": "v1", "authors": [ "Muhammad Asjad" ], "code_url": null, "date_basis": "arXiv v1 submission date; the artifact deposit date is separate.", "date_basis_zh": "采用 arXiv v1 首次提交日期；产物存档日期单独区分。", "date_precision": "day", "description_en": "Studies whether LLM refinement of decompiled C recovers identifiers from input evidence or prior knowledge. Within-item ablations and output-matched chance baselines test naming gains on textbook and newly authored functions, including a second-model replication.", "description_zh": "研究大语言模型改进反编译 C 代码时，标识符恢复来自输入证据还是先验知识。通过同一条目的消融实验和与输出词汇匹配的随机基线，比较教材式函数与新编写函数的命名增益，并进行第二模型复核。", "doi": "10.48550/arxiv.2609.17236", "entry_url": "https://awesomerea.org/papers/paper-memorization-floor/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-memorization-floor/", "evidence_urls": [ "https://arxiv.org/abs/2609.17236", "https://arxiv.org/html/2609.17236v1", "https://api.datacite.org/dois/10.48550/arxiv.2609.17236", "https://doi.org/10.5281/zenodo.21968878", "https://zenodo.org/records/22121473", "https://zenodo.org/api/records/21968878" ], "first_arxiv_date": "2026-09-15", "id": "paper-memorization-floor", "kind": "research", "metadata_notes": "Single-author arXiv v1; no formal venue was verified. DataCite confirms the arXiv DOI was registered on 2026-09-16 despite the abstract page’s pending label. The manuscript uses arXiv’s non-exclusive distribution license. The paper’s Zenodo concept DOI resolves to record 22121473, version 1.1.0, dated 2026-08-27, declaring CC BY 4.0 for a 9,639,907-byte replication ZIP. Only deposit metadata was inspected, not the archive or its per-file licenses. No experiments were run.", "metadata_notes_zh": "采用单作者的 arXiv v1，未核实正式发表场所。摘要页仍显示待登记，但 DataCite 确认 arXiv DOI 已于 2026-09-16 登记。手稿使用 arXiv 非独占分发许可。论文链接的 Zenodo 概念 DOI 解析到记录 22121473，版本为 1.1.0、日期为 2026-08-27，元数据为 9,639,907 字节的复现 ZIP 声明 CC BY 4.0。本次仅检查存档元数据，未读取压缩包或逐文件许可，未运行实验。", "pdf_url": "https://arxiv.org/pdf/2609.17236v1", "project_url": "https://zenodo.org/records/22121473", "publication_date": "2026-09-15", "publication_status": "preprint", "runtime_tested": false, "scope_limitations_en": "The study uses 25 textbook and 20 author-written small functions, GCC/Ghidra on x86-64, and one prompt per model. Operations remain visible and the ablation also changes idiom-recognition cues, so its bounded null does not prove memorization or absence of input use. No registered hypothesis was confirmed; the correctness measure failed its discrimination gate; original T3 per-item artifacts were lost and re-executed, changing precision. Most findings use one refiner, and the later second-model extension is distinct from the initial preregistration.", "scope_limitations_zh": "研究仅含 25 个教材式函数和 20 个作者编写的小函数，使用 x86-64 上的 GCC/Ghidra，每个模型只有一种提示。操作仍可观察，消融也改变惯用模式识别线索，因此有限检出能力下的零结果不能证明记忆或完全不利用输入。没有预登记假设得到确认，正确性指标未通过区分能力门槛；原 T3 逐项产物丢失后重新执行，精度随之改变。多数结果只来自一个改进模型，后续第二模型扩展与最初预登记分开报告。", "targets": [ "binary" ], "title": "A Memorization Floor for LLM Refinement of Decompiled Code", "title_zh": "大语言模型改进反编译代码中的记忆基线", "url": "https://arxiv.org/abs/2609.17236", "venue": "arXiv", "verification": "source-reviewed", "verified_at": "2026-10-20", "why_fits_en": "Provides controls for interpreting apparently readable or well-named recovered code and cautions against treating naming scores as semantic recovery.", "why_fits_zh": "为解释可读性好、命名合理的恢复代码提供对照方法，避免把命名分数当作语义恢复证明。", "year": 2026 }, { "arxiv_id": "2606.30182", "arxiv_version_reviewed": "v2", "authors": [ "Tom Adamczewski", "David Owen", "David Rein", "Florian Brand", "Giles Edkins", "Allen Hart", "Daniel O'Connell" ], "code_url": "https://github.com/epoch-research/MirrorCode", "date_basis": "First arXiv submission; the reviewed version is identified separately.", "date_basis_zh": "采用首次 arXiv 提交日期，另列所复核版本。", "date_precision": "day", "description_en": "Tests reimplementation of 25 command-line programs using execute-only reference access, documentation and visible examples. Separate scoring environments compare exact outputs on visible and held-out end-to-end tests.", "description_zh": "利用仅可执行的参考程序、文档及可见样例，评测 25 个命令行程序的重新实现；在独立评分环境中对可见及留出端到端测试进行精确输出比较。", "doi": "10.48550/arxiv.2606.30182", "entry_url": "https://awesomerea.org/papers/paper-mirrorcode/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-mirrorcode/", "evidence_urls": [ "https://arxiv.org/abs/2606.30182", "https://arxiv.org/html/2606.30182v2", "https://api.datacite.org/dois/10.48550/arxiv.2606.30182", "https://github.com/epoch-research/MirrorCode/blob/5c9d7b00b0c6d7609003e33896cd41d28f092fcb/README.md", "https://github.com/epoch-research/MirrorCode/blob/5c9d7b00b0c6d7609003e33896cd41d28f092fcb/LICENSE" ], "first_arxiv_date": "2026-06-29", "id": "paper-mirrorcode", "kind": "research", "metadata_notes": "June 29 first submission, July 17 v2: a six-month-window candidate. Distinct from ProgramBench, explicitly compared in the paper. The pinned repository has an MIT root license and public harness/task definitions, excluding private tasks; target-program licensing is separate. No benchmark was run.", "metadata_notes_zh": "首投为 6 月 29 日，v2 为 7 月 17 日，属于近六个月补充候选。与 ProgramBench 不同，论文专门比较两者。固定仓库的根许可证为 MIT，包含公开框架与任务定义，不含私有任务；目标程序许可另行适用。本次未运行基准。", "pdf_url": "https://arxiv.org/pdf/2606.30182v2", "project_url": null, "publication_date": "2026-06-29", "publication_status": "preprint", "runtime_tested": false, "scope_limitations_en": "Targets are scoped, deterministic, stateless programs with text output. Test agreement is not universal equivalence or code-quality assessment. A memorization screen flags possible exposure for 17 targets. Large inference budgets and scaffold choices limit comparisons with cheaper benchmarks; three targets remain private.", "scope_limitations_zh": "目标限于指定范围内、确定性、无状态且输出文本的程序。测试一致不等于普遍等价或代码质量评估；记忆探测发现 17 个目标可能已被接触。较大推理预算及框架选择限制与低成本基准的比较，三个目标仍未公开。", "targets": [ "binary", "app" ], "title": "MirrorCode: AI can rebuild entire programs from behavior alone", "title_zh": "MirrorCode：仅凭行为重建完整程序的评测", "url": "https://arxiv.org/abs/2606.30182", "venue": "arXiv", "verification": "source-reviewed", "verified_at": "2026-10-20", "why_fits_en": "Directly evaluates sustained reconstruction from observable software behavior.", "why_fits_zh": "直接评估依据可观察的软件行为开展长期重建的能力。", "year": 2026 }, { "arxiv_id": null, "arxiv_version_reviewed": null, "authors": [ "Stephan Kleber", "Henning Kopp", "Frank Kargl" ], "code_url": "https://github.com/vs-uulm/nemesys", "date_basis": "The official USENIX BibTeX entry identifies August 2018 for the WOOT 18 workshop publication.", "date_basis_zh": "USENIX 官方 BibTeX 将 WOOT 18 研讨会论文的出版月份列为2018年8月。", "date_precision": "month", "description_en": "Infers approximate field boundaries within individual binary-protocol messages from changes in bit congruence, and introduces Format Match Score to compare inferred segmentation with known protocol dissectors.", "description_zh": "根据单条二进制协议报文内比特一致性的变化，推断近似字段边界，并提出格式匹配分数，将推断的分段结果与已知协议解析器进行比较。", "doi": null, "entry_url": "https://awesomerea.org/papers/paper-nemesys/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-nemesys/", "evidence_urls": [ "https://www.usenix.org/conference/woot18/presentation/kleber", "https://www.usenix.org/system/files/conference/woot18/woot18-paper-kleber.pdf", "https://www.usenix.org/biblio/export/bibtex/220576", "https://github.com/vs-uulm/nemesys/blob/e98da1d9baa5727d8f085823369c733416b66a21/README.md", "https://github.com/vs-uulm/nemesys/blob/e98da1d9baa5727d8f085823369c733416b66a21/LICENSE" ], "first_arxiv_date": null, "id": "paper-nemesys", "kind": "research", "metadata_notes": "The official USENIX citation verifies this workshop paper; no DOI or arXiv identifier was verified. The linked author repository now integrates NEMESYS with later NEMETYL and 2022 methods, so the reviewed current commit is not claimed to be the original 2018 artifact. Its README identifies it as experimental and its LICENSE declares MIT.", "metadata_notes_zh": "USENIX 官方引文确认了这篇研讨会论文；尚未核实 DOI 或 arXiv 标识。所链接的作者仓库如今整合了 NEMESYS、后续 NEMETYL 及2022年方法，因此本次核查的当前提交不被视为2018年原始产物。README 将其定位为实验性软件，LICENSE 声明 MIT。", "pdf_url": "https://www.usenix.org/system/files/conference/woot18/woot18-paper-kleber.pdf", "project_url": null, "publication_date": "2018-08", "publication_status": "conference-paper", "runtime_tested": false, "scope_limitations_en": "Requires plaintext payloads. Evaluation covers DNS, DHCP and NTP with protocol-tuned parameters. Single-byte fields are not inferred; zero-filled fields, character sequences and pseudo-random values can cause errors. FMS needs known field boundaries for validation. The output is approximate segmentation, not field semantics, a state machine or complete application/device behavior.", "scope_limitations_zh": "需要明文载荷。评测覆盖 DNS、DHCP 和 NTP，并针对各协议调节参数。方法无法推断单字节字段；全零字段、字符序列和伪随机值可能导致误差。FMS 验证需要已知字段边界。输出是近似报文分段，不是字段语义、状态机或完整应用／设备行为。", "targets": [ "protocol" ], "title": "NEMESYS: Network Message Syntax Reverse Engineering by Analysis of the Intrinsic Structure of Individual Messages", "title_zh": "NEMESYS：通过分析单条报文的内在结构逆向推断网络报文语法", "url": "https://www.usenix.org/conference/woot18/presentation/kleber", "venue": "12th USENIX Workshop on Offensive Technologies (WOOT 18)", "verification": "source-reviewed", "verified_at": "2026-10-16", "why_fits_en": "Provides a foundational method for reconstructing wire-message structure from observed traffic.", "why_fits_zh": "为依据观测流量重建通信报文结构提供基础方法。", "year": 2018 }, { "arxiv_id": "1902.09122", "arxiv_version_reviewed": "v4", "authors": [ "Yaniv David", "Uri Alon", "Eran Yahav" ], "code_url": "https://github.com/tech-srl/Nero/tree/7dac9f5748974ea8f39b5f29bb3c7d33f971077e", "date_basis": "ACM’s Crossref deposit gives print and online publication on 2020-11-13, and an archived copy of the ACM article page shows the same publication date. The OOPSLA conference dates and the arXiv versions are not substituted.", "date_basis_zh": "ACM 提交的 Crossref 元数据将纸质与在线出版日期均记为 2020-11-13，ACM 文章页面的存档副本也显示同一出版日期。本条目不以 OOPSLA 会议日期或各 arXiv 版本日期代替。", "date_precision": "day", "description_en": "Nero predicts names for procedures in stripped x86-64 Linux executables; it does not produce decompiled code. Static analysis reconstructs call sites, including imported API names, and augments their arguments with concrete and abstract values along control-flow paths. LSTM, Transformer and graph neural network encoders over the resulting augmented call-site graph feed a decoder that generates the name as subtokens. On a GNU-package test set the authors report 45.53 F1 for Nero-GNN, against 35.52 for an adapted DIRE and 33.66 for Debin.", "description_zh": "Nero 为剥离符号的 x86-64 Linux 可执行文件中的过程预测名称，并不生成反编译代码。它通过静态分析重建调用点（包括导入的 API 名称），并沿控制流路径为参数补充具体值与抽象值。LSTM、Transformer 与图神经网络编码器处理由此得到的增强调用点图，再由解码器以子词序列生成名称。在 GNU 软件包测试集上，作者报告 Nero-GNN 的 F1 为 45.53，改造后的 DIRE 为 35.52，Debin 为 33.66。", "doi": "10.1145/3428293", "entry_url": "https://awesomerea.org/papers/paper-nero/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-nero/", "evidence_urls": [ "https://dl.acm.org/doi/10.1145/3428293", "https://web.archive.org/web/20250415223553/https://dl.acm.org/doi/10.1145/3428293", "https://api.crossref.org/works/10.1145/3428293", "https://arxiv.org/abs/1902.09122", "https://arxiv.org/pdf/1902.09122v4", "https://github.com/tech-srl/Nero/blob/7dac9f5748974ea8f39b5f29bb3c7d33f971077e/README.md", "https://github.com/tech-srl/Nero/blob/7dac9f5748974ea8f39b5f29bb3c7d33f971077e/LICENSE", "https://github.com/tech-srl/Nero/blob/7dac9f5748974ea8f39b5f29bb3c7d33f971077e/requirements.txt", "https://zenodo.org/api/records/4099685", "https://zenodo.org/api/records/4095276" ], "first_arxiv_date": "2019-02-25", "id": "paper-nero", "kind": "research", "metadata_notes": "ACM metadata in Crossref and in an Internet Archive copy of the ACM article page (the live page served a browser check during review) give the sentence-case title, volume 4, issue OOPSLA, article 225, pages 1–28; arXiv and the paper PDF capitalise it as 'Neural Reverse Engineering of Stripped Binaries using Augmented Control Flow Graphs'. Crossref records a CC BY-NC-SA 4.0 licence for the article. arXiv has four versions, v1 of 2019-02-25 to v4 of 2020-10-16, and links the DOI; v4 was reviewed and serves as the PDF because the ACM-hosted PDF was not retrieved. The README calls the repository the official Nero-GNN implementation; the reviewed 2021-05-10 commit carries GPL-3.0. Data generation targets Ubuntu 20 with Python 3.8, LLVM 10, angr and a licensed IDA Pro (IDAPython 2.7 scripts tested with 6.95); the model uses Python 3.6 and TensorFlow 1.13.1. The README warns that regenerated representations may differ slightly from the Zenodo copies after a Python 3 port. Zenodo (concept DOI 10.5281/zenodo.4081641) hosts the binaries, procedure representations and a trained GNN model under a CC-BY-4.0 record label. No archives were downloaded and no code or experiments were run.", "metadata_notes_zh": "Crossref 中的 ACM 元数据及 ACM 文章页面的互联网档案馆存档副本（审阅时实时页面显示浏览器验证）给出句首大写形式的标题、第 4 卷、OOPSLA 期、第 225 篇、第 1–28 页；arXiv 与论文 PDF 将标题写作“Neural Reverse Engineering of Stripped Binaries using Augmented Control Flow Graphs”。Crossref 记录该文章采用 CC BY-NC-SA 4.0 许可。arXiv 共有四个版本，从 2019-02-25 的 v1 到 2020-10-16 的 v4，并链接该 DOI；本次审阅 v4，并因未能获取 ACM 托管的 PDF 而以其作为 PDF 链接。README 称该仓库为 Nero-GNN 的官方实现，所审阅的 2021-05-10 提交采用 GPL-3.0。数据生成面向 Ubuntu 20，需要 Python 3.8、LLVM 10、angr 及已授权的 IDA Pro（IDAPython 2.7 脚本以 6.95 测试）；模型使用 Python 3.6 与 TensorFlow 1.13.1。README 提示，由于移植到 Python 3，重新生成的表示可能与 Zenodo 中的副本略有差异。Zenodo（概念 DOI 10.5281/zenodo.4081641）托管二进制文件、过程表示及训练好的 GNN 模型，记录标注为 CC-BY-4.0。本次未下载任何压缩包，也未运行代码或实验。", "pdf_url": "https://arxiv.org/pdf/1902.09122v4", "project_url": null, "publication_date": "2020-11-13", "publication_status": "journal-article", "runtime_tested": false, "scope_limitations_en": "Evaluation uses 67,246 procedures from C-only GNU packages built as x86-64 Linux executables, split by package into 60,403/2,034/4,809 examples after removing C++ executables, tests, statically linked packages and duplicate package versions. Labels come from names present before stripping, and F1 is measured over name subtokens, so outputs are learned suggestions rather than recovered original symbols. Simulated API-name obfuscation, which zeroes the .dynstr section, lowers Nero-GNN to 38.83 F1; packers and heavier obfuscation are not addressed. A procedure needs at least one statically detectable call site, and inlined procedures cannot be named. Data generation relied on a licensed IDA Pro (tested with 6.95) for procedure boundaries and export, plus angr and LLVM 10, and the model code uses TensorFlow 1.13.1; no claim is made about compatibility with current tool versions.", "scope_limitations_zh": "评测使用来自纯 C 语言 GNU 软件包、构建为 x86-64 Linux 可执行文件的 67,246 个过程；在剔除 C++ 可执行文件、测试程序、静态链接软件包及同一软件包的重复版本后，按软件包划分为 60,403／2,034／4,809 个样本。标签取自剥离前的名称，F1 按名称子词计算，因此输出是模型学到的建议，而非恢复出的原始符号。模拟 API 名称混淆（将 .dynstr 节清零）会使 Nero-GNN 的 F1 降至 38.83；论文未处理加壳和更强的混淆。每个过程至少需要一个可静态检测的调用点，内联过程无法命名。数据生成依赖已授权的 IDA Pro（测试版本 6.95）识别过程边界并导出，另需 angr 与 LLVM 10；模型代码使用 TensorFlow 1.13.1。本条不对与当前工具版本的兼容性作任何判断。", "targets": [ "binary" ], "title": "Neural reverse engineering of stripped binaries using augmented control flow graphs", "title_zh": "基于增强控制流图的剥离符号二进制神经逆向工程", "url": "https://dl.acm.org/doi/10.1145/3428293", "venue": "Proceedings of the ACM on Programming Languages (OOPSLA 2020)", "verification": "source-reviewed", "verified_at": "2026-10-18", "why_fits_en": "Adds learned procedure-name prediction for stripped binaries driven by static call-site analysis, complementing the variable-name and type-recovery papers in this section.", "why_fits_zh": "补充由静态调用点分析驱动、面向剥离符号二进制的过程名称学习式预测，与本节的变量名和类型恢复论文互补。", "year": 2020 }, { "arxiv_id": "2305.11781", "arxiv_version_reviewed": "v1", "authors": [ "Qingkai Shi", "Junyang Shao", "Yapeng Ye", "Mingwei Zheng", "Xiangyu Zhang" ], "citation": { "container_title": "Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security", "pages": "1287-1301", "publisher": "ACM", "sources": [ "https://api.crossref.org/works/10.1145/3576915.3616614" ] }, "code_url": "https://github.com/qingkaishi/netlifter", "date_basis": "ACM’s Crossref deposit records published/print publication on 2023-11-15 and a separate online/publication-history date of 2023-11-21. This entry uses the published/print date, not the November 26–30 conference dates.", "date_basis_zh": "ACM 提交的 Crossref 元数据将 published／纸质出版日期记为 2023-11-15，另列在线／发表历史日期为 2023-11-21。本条目采用 published／纸质出版日期，而非 11 月 26–30 日的会议日期。", "date_precision": "day", "description_en": "NetLifter statically lifts source-available C protocol parsers into BNF-style message grammars and first-order constraints between packet fields. It analyzes annotated LLVM bitcode using abstract format graphs, localized path-sensitive analysis, unfolding and reordering. The resulting field boundaries, constraints and names can support packet generation and parser construction.", "description_zh": "NetLifter 将可获取源码的 C 协议解析器静态转换为 BNF 风格的报文文法及报文字段之间的一阶逻辑约束。它分析经过标注的 LLVM 位码，结合抽象格式图、局部路径敏感分析、展开与重排序。所得字段边界、约束与名称可用于报文生成及解析器构建。", "doi": "10.1145/3576915.3616614", "entry_url": "https://awesomerea.org/papers/paper-netlifter/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-netlifter/", "evidence_urls": [ "https://dl.acm.org/doi/10.1145/3576915.3616614", "https://api.crossref.org/works/10.1145/3576915.3616614", "https://qingkaishi.github.io/public_pdfs/CCS23.pdf", "https://arxiv.org/abs/2305.11781", "https://arxiv.org/pdf/2305.11781v1", "https://github.com/qingkaishi/netlifter/blob/362fe1edc2c2027d6e404c5d27cf9fee8a6b6a48/README.md", "https://github.com/qingkaishi/netlifter/blob/362fe1edc2c2027d6e404c5d27cf9fee8a6b6a48/LICENSE.txt", "https://github.com/qingkaishi/netlifter/blob/362fe1edc2c2027d6e404c5d27cf9fee8a6b6a48/CMakeLists.txt", "https://github.com/qingkaishi/netlifter/blob/362fe1edc2c2027d6e404c5d27cf9fee8a6b6a48/tools/popeye/popeye.cpp", "https://github.com/qingkaishi/netlifter/blob/362fe1edc2c2027d6e404c5d27cf9fee8a6b6a48/tools/popeye/LiftingPass.cpp", "https://github.com/qingkaishi/netlifter/blob/362fe1edc2c2027d6e404c5d27cf9fee8a6b6a48/benchmarks/popeye/readme.txt", "https://github.com/qingkaishi/netlifter/blob/362fe1edc2c2027d6e404c5d27cf9fee8a6b6a48/benchmarks/popeye/regression.sh", "https://github.com/qingkaishi/z3/blob/b42b2d6d6994f593976cb8cc7eb6b093532954c9/README-CMake.md", "https://github.com/qingkaishi/z3/blob/b42b2d6d6994f593976cb8cc7eb6b093532954c9/LICENSE.txt" ], "first_arxiv_date": "2023-05-19", "id": "paper-netlifter", "kind": "research", "metadata_notes": "The final author PDF and Crossref establish the five-author order, CCS 2023 DOI and pages. The 19-page arXiv v1 retains an old CCS 2022 submission template and placeholder DOI; publication identity follows the final 15-page paper. The repository calls its prototype Popeye and warns of rough edges. Its reviewed 2025-04-21 snapshot declares AGPL-3.0-or-later in source headers. CMake requires 3.10+, LLVM 12.x and Z3>=4.8.12; README recommends LLVM 12.0.1 and the author’s modified Z3 4.8.12-popeye branch. Vectorized IR is unsupported: README documents -fno-vectorize and -fno-slp-vectorize, and recommends debug information and removal of optimization flags for field naming. This later artifact snapshot is not an independently reproduced 2023 environment; dependencies and target code retain separate terms. Source files were inspected without running upstream code, downloading benchmark inputs or reproducing experiments.", "metadata_notes_zh": "最终作者版 PDF 与 Crossref 确认五位作者顺序、CCS 2023 DOI 和页码。19 页的 arXiv v1 保留旧的 CCS 2022 投稿模板及占位 DOI；出版身份以最终 15 页论文为准。仓库将原型称为 Popeye，并提示仍有粗糙之处。所审阅的 2025-04-21 快照在源码头部声明 AGPL-3.0-or-later。CMake 要求 3.10+、LLVM 12.x 与 Z3>=4.8.12；README 推荐 LLVM 12.0.1 及作者修改的 Z3 4.8.12-popeye 分支。不支持向量化中间表示：README 说明使用 -fno-vectorize 和 -fno-slp-vectorize，并建议保留调试信息、移除优化选项，以帮助字段命名。这个较晚的产物快照不代表独立复现了 2023 年环境；依赖与目标代码保留各自条款。本次仅审阅源码，未运行上游代码、下载基准输入或复现实验。", "pdf_url": "https://qingkaishi.github.io/public_pdfs/CCS23.pdf", "project_url": null, "publication_date": "2023-11-15", "publication_status": "conference-paper", "runtime_tested": false, "scope_limitations_en": "Requires source/LLVM IR and packet-buffer/length annotations; it is not closed-binary or traffic-only recovery. The paper targets common top-down C parsers and does not support C++, inline assembly or libraries without available code. Pointer/loop analysis remains approximate; checksum fields can be identified while some checksum constraints are omitted, and fields ignored by an implementation may be missed. Precision/recall was manually checked on ten selected protocols. The reported fuzzing evaluation used three-hour runs repeated twenty times and bypassed checksum checks. It infers formats, not protocol state machines or proof of implementation equivalence.", "scope_limitations_zh": "需要源码／LLVM 中间表示及报文缓冲区、长度标注，并非对闭源二进制或仅凭流量进行恢复。论文面向常见的自顶向下 C 解析器，不支持 C++、内联汇编及缺少源码的库。指针和循环分析仍有近似；可识别校验和字段，但部分校验和约束会被省略，实现中忽略的字段也可能遗漏。精确率／召回率在选定的十种协议上进行人工核对。报告的模糊测试采用每次三小时、重复二十次的实验，并绕过校验和检查。方法推断的是格式，而非协议状态机或实现等价性的证明。", "targets": [ "protocol" ], "title": "Lifting Network Protocol Implementation to Precise Format Specification with Security Applications", "title_zh": "从网络协议实现提取精确格式规范及其安全应用", "url": "https://dl.acm.org/doi/10.1145/3576915.3616614", "venue": "ACM CCS 2023", "verification": "source-reviewed", "verified_at": "2026-10-17", "why_fits_en": "Adds source-to-format inference with cross-field constraints, complementing traffic-based and binary-assisted protocol reconstruction research.", "why_fits_zh": "补充包含跨字段约束的源码到格式推断方法，与基于流量及借助二进制的协议重建研究互补。", "year": 2023 }, { "arxiv_id": null, "arxiv_version_reviewed": null, "authors": [ "Yapeng Ye", "Zhuo Zhang", "Fei Wang", "Xiangyu Zhang", "Dongyan Xu" ], "code_url": "https://github.com/yapengye/NetPlier", "date_basis": "Publisher-deposited Crossref metadata supplies publication year 2021; the publisher PDF separately identifies the 21–25 February 2021 symposium.", "date_basis_zh": "出版方向 Crossref 提交的元数据仅给出出版年份2021；出版方 PDF 另列研讨会日期为2021年2月21—25日。", "date_precision": "year", "description_en": "Uses multiple sequence alignment and probabilistic keyword-field inference to cluster network messages by type, evaluated across ten protocols with downstream format and state-machine analysis.", "description_zh": "通过多序列比对与概率式关键字段推断，按类型对网络报文聚类，并在十种协议上评测及开展后续格式与状态机分析。", "doi": "10.14722/ndss.2021.24531", "entry_url": "https://awesomerea.org/papers/paper-netplier/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-netplier/", "evidence_urls": [ "https://www.ndss-symposium.org/ndss-paper/netplier-probabilistic-network-protocol-reverse-engineering-from-message-traces/", "https://www.ndss-symposium.org/wp-content/uploads/ndss2021_4A-5_24531_paper.pdf", "https://api.crossref.org/works/10.14722/ndss.2021.24531", "https://github.com/yapengye/NetPlier/blob/78abbe67606c76fcd9bfec17667c662dce58f567/README.md", "https://github.com/yapengye/NetPlier/blob/78abbe67606c76fcd9bfec17667c662dce58f567/netplier/netplier.py", "https://github.com/yapengye/NetPlier/blob/78abbe67606c76fcd9bfec17667c662dce58f567/LICENSE" ], "first_arxiv_date": null, "id": "paper-netplier", "kind": "research", "metadata_notes": "The publisher paper cites netplier-tool/NetPlier, which now redirects to yapengye/NetPlier. The pinned GPLv3 artifact implements keyword inference and clustering evaluation; its core retains TODOs for iteration and format inference. Do not treat this public repository as a complete reproduction of all paper stages. No runtime reproduction was performed.", "metadata_notes_zh": "出版方论文引用 netplier-tool/NetPlier，当前重定向至 yapengye/NetPlier。固定提交下的 GPLv3 产物实现了关键字段推断与聚类评测；核心代码仍将迭代和格式推断列为 TODO。不能将此公开仓库视为论文所有阶段的完整复现。本次未进行运行复现。", "pdf_url": "https://www.ndss-symposium.org/wp-content/uploads/ndss2021_4A-5_24531_paper.pdf", "project_url": null, "publication_date": null, "publication_status": "conference-paper", "runtime_tested": false, "scope_limitations_en": "Requires unencrypted traces and cannot recover unseen message types. Larger alignments, sub-byte keywords and one-way traffic can reduce accuracy. Format/FSM inference is downstream evaluation rather than the main contribution; state semantics in a case study were manually annotated. These models do not establish complete application/device reconstruction.", "scope_limitations_zh": "需要未加密的报文记录，无法恢复从未出现的报文类型。较大的比对、亚字节关键字段及单向流量可能降低准确性。格式／有限状态机推断属于下游评测而非主要贡献；一个案例中的状态语义由人工标注。这些模型不能证明已完整重建应用／设备。", "targets": [ "protocol" ], "title": "NetPlier: Probabilistic Network Protocol Reverse Engineering from Message Traces", "title_zh": "NetPlier：基于报文记录的概率网络协议逆向工程", "url": "https://www.ndss-symposium.org/ndss-paper/netplier-probabilistic-network-protocol-reverse-engineering-from-message-traces/", "venue": "NDSS 2021", "verification": "source-reviewed", "verified_at": "2026-10-16", "why_fits_en": "Connects observed application/device traffic to message-type models needed for protocol reconstruction.", "why_fits_zh": "将观测到的应用／设备流量转化为协议重建所需的报文类型模型。", "year": 2021 }, { "arxiv_id": null, "arxiv_version_reviewed": null, "authors": [ "Georges Bossert", "Frédéric Guihéry", "Guillaume Hiet" ], "code_url": "https://github.com/netzob/netzob", "date_basis": "ACM’s Crossref deposit records print and online publication on 2014-06-04. The HAL record gives the same date as the first day of the June 4–6 conference; the conference dates alone are not used as the basis.", "date_basis_zh": "ACM 提交的 Crossref 元数据将印刷与在线出版日期均记为 2014-06-04。HAL 记录给出相同日期，即 6 月 4–6 日会议的首日；本条目并非仅依据会议日期。", "date_precision": "day", "description_en": "Infers the vocabulary of an undocumented protocol, its message types and formats, from communication traces. The approach uses contextual information embedded in the messages to improve message clustering and the identification of field boundaries; the HAL record lists contextual clustering and semantic sequence alignment as keywords. The authors motivate the work with parsers and traffic generators for network security products, and compare it with their own reimplementations of ASAP, Discoverer and ScriptGen. The first two authors are the authors of Netzob, the open-source protocol reverse-engineering framework.", "description_zh": "从通信流量记录中推断未公开协议的词汇，即报文类型与格式。该方法利用报文中嵌入的上下文信息改进报文聚类和字段边界识别；HAL 记录列出的关键词为上下文聚类与语义序列比对。作者以为网络安全产品构建解析器与流量生成器作为研究动机，并与自行重新实现的 ASAP、Discoverer 和 ScriptGen 进行比较。前两位作者也是开源协议逆向框架 Netzob 的作者。", "doi": "10.1145/2590296.2590346", "entry_url": "https://awesomerea.org/papers/paper-netzob/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-netzob/", "evidence_urls": [ "https://dl.acm.org/doi/10.1145/2590296.2590346", "https://web.archive.org/web/20240405105101/https://dl.acm.org/doi/10.1145/2590296.2590346", "https://api.crossref.org/works/10.1145/2590296.2590346", "https://centralesupelec.hal.science/hal-01009283v1", "https://github.com/netzob/netzob/blob/088fe769e98e0bfbd3ed99e66b3982446bf8d197/README.rst", "https://github.com/netzob/netzob/blob/088fe769e98e0bfbd3ed99e66b3982446bf8d197/AUTHORS.txt", "https://github.com/netzob/netzob/blob/088fe769e98e0bfbd3ed99e66b3982446bf8d197/COPYING.txt" ], "first_arxiv_date": null, "id": "paper-netzob", "kind": "research", "metadata_notes": "Crossref, the archived ACM page and the HAL record agree on the three authors, the ASIA CCS ’14 proceedings and pages 51–62; the ACM metadata uses sentence case, and the record follows the capitalization in the HAL record. Crossref lists this paper under DOI 10.1145/2590296.2590346; the neighboring 10.1145/2590296.2590338 is a different paper. The HAL record has no attached file. This review used the ACM abstract, Crossref and HAL metadata and the Netzob repository; evaluation details beyond the abstract are not recorded. The code link is the authors’ Netzob repository, whose AUTHORS.txt names Georges Bossert and Frédéric Guihéry; its reviewed 2023 head ships the GPL-3.0 license text and is not identified as the 2014 implementation. No code or experiments were run.", "metadata_notes_zh": "Crossref、ACM 页面存档与 HAL 记录在三位作者、ASIA CCS ’14 论文集及第 51–62 页上一致；ACM 元数据采用句首大写，本条目沿用 HAL 记录中的大小写。Crossref 将本论文登记为 DOI 10.1145/2590296.2590346；相邻的 10.1145/2590296.2590338 是另一篇论文。HAL 记录未附文件。本次审阅依据 ACM 摘要、Crossref 与 HAL 元数据以及 Netzob 仓库；摘要以外的评测细节未予记录。代码链接指向作者的 Netzob 仓库，其 AUTHORS.txt 列出 Georges Bossert 与 Frédéric Guihéry；所审阅的 2023 年最新提交附有 GPL-3.0 许可文本，并未标明为 2014 年的实现。本次未运行代码或实验。", "pdf_url": "https://dl.acm.org/doi/pdf/10.1145/2590296.2590346", "project_url": null, "publication_date": "2014-06-04", "publication_status": "conference-paper", "runtime_tested": false, "scope_limitations_en": "The method starts from captured traces and addresses the protocol’s vocabulary, not its grammar or state machine; contextual hints help only where such information appears in the observed messages. Baseline results come from the authors’ reimplementations of ASAP, Discoverer and ScriptGen rather than the original tools. The comparative study and its results are the authors’ 2014 evaluation and are not summarized here. Netzob has changed substantially since 2014: the curated Netzob record describes the later 2.x Python library, and this record does not attribute the paper’s results to that release.", "scope_limitations_zh": "该方法以捕获的流量记录为起点，处理的是协议词汇，而非其语法或状态机；只有当观察到的报文中出现上下文信息时，这些线索才有帮助。基线结果来自作者对 ASAP、Discoverer 和 ScriptGen 的重新实现，而非原始工具。比较研究及其结果属于作者 2014 年的评测，本条目不作概括。Netzob 自 2014 年以来变化很大：合集中的 Netzob 工具条目描述的是后来的 2.x Python 库，本条目不将论文结果归于该版本。", "targets": [ "protocol" ], "title": "Towards Automated Protocol Reverse Engineering Using Semantic Information", "title_zh": "利用语义信息实现自动化协议逆向工程", "url": "https://dl.acm.org/doi/10.1145/2590296.2590346", "venue": "ACM ASIA CCS 2014", "verification": "source-reviewed", "verified_at": "2026-10-19", "why_fits_en": "Documents the trace-based inference approach from the authors of Netzob, already curated as a protocol-analysis tool, and complements the collection’s other traffic-based and executable-assisted format inference research.", "why_fits_zh": "记录 Netzob 作者提出的基于流量记录的推断方法（Netzob 已作为协议分析工具收录），并与合集中其他基于流量及借助可执行程序的格式推断研究互补。", "year": 2014 }, { "arxiv_id": "2608.03286", "arxiv_version_reviewed": "v1", "authors": [ "Jikai Wang", "Ningyu He", "Tianming Liu", "Junhai Wang", "Haoyu Wang" ], "citation": { "container_title": "Proceedings of the 2026 IEEE/ACM 48th International Conference on Software Engineering", "pages": "3813-3824", "publisher": "ACM", "sources": [ "https://api.crossref.org/works/10.1145/3744916.3787762" ] }, "code_url": "https://github.com/NotDec/NotDec", "date_basis": "Publisher-deposited print publication date; online and arXiv dates are recorded separately.", "date_basis_zh": "采用出版方提交的印刷出版日期；在线及 arXiv 日期另行说明。", "date_precision": "day", "description_en": "NotDec lifts WebAssembly into SSA-based IR, uses Retypd-derived type constraints and pointer/value distinctions to recover structures, and emits C. Its study separates full interprocedural analysis from a faster intraprocedural variant.", "description_zh": "NotDec 将 WebAssembly 提升为 SSA 中间表示，通过基于 Retypd 的类型约束及指针／数值区分恢复结构，并生成 C。研究区分完整跨过程分析与较快的过程内变体。", "doi": "10.1145/3744916.3787762", "entry_url": "https://awesomerea.org/papers/paper-notdec/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-notdec/", "evidence_urls": [ "https://arxiv.org/abs/2608.03286v1", "https://arxiv.org/html/2608.03286v1", "https://api.crossref.org/works/10.1145/3744916.3787762", "https://github.com/NotDec/NotDec/blob/0399bf0aec0f26247fee99097cb9442e4414bb0f/README.md", "https://api.github.com/repos/NotDec/NotDec/git/trees/ae799d9867dcd54b7e8f34fdd18ab385d18022b7" ], "first_arxiv_date": "2026-08-04", "id": "paper-notdec", "kind": "research", "metadata_notes": "Publisher metadata gives print/publication 2026-04-12 and online 2026-09-11; the arXiv deposit is 2026-08-04. ACM returned HTTP 403, so publication identity uses its Crossref deposit and author HTML. The paper is CC BY-NC-ND 4.0. The linked repository README at 0399bf0 describes ongoing work; its evaluated revision and repository-wide code/data license were not established. No root LICENSE/COPYING was present in the inspected tree.", "metadata_notes_zh": "出版元数据给出印刷／出版日期 2026-04-12、在线日期 2026-09-11；arXiv 提交于 2026-08-04。ACM 直接访问返回 HTTP 403，出版身份依据其 Crossref 元数据及作者 HTML。论文采用 CC BY-NC-ND 4.0。关联仓库 0399bf0 的 README 仍描述进行中的工作；尚未确定实验对应版本及覆盖全仓库代码／数据的许可，检查的根目录未出现 LICENSE／COPYING。", "pdf_url": "https://arxiv.org/pdf/2608.03286v1", "project_url": null, "publication_date": "2026-04-12", "publication_status": "conference-paper", "runtime_tested": false, "scope_limitations_en": "The study uses Juliet and five Howard programs at O0/O3. Howard binaries omit actual library linking and cannot be executed, so recompilation does not demonstrate behavioral equivalence. Full analysis timed out on six Howard variants at 24 hours; recompilation results cover successful decompilations. The inspected README also warns about backend syntax errors on complex statements.", "scope_limitations_zh": "研究使用 O0／O3 下的 Juliet 样例和五个 Howard 程序。Howard 二进制未实际链接所需库，无法执行，因此重编译不证明行为等价。完整分析有六个 Howard 变体在 24 小时超时；重编译结果仅覆盖成功反编译的样例。已检查的 README 也提醒复杂语句可能产生后端语法错误。", "targets": [ "binary" ], "title": "NotDec: WebAssembly Decompilation With Inter-Procedural Type Recovery", "title_zh": "NotDec：通过跨过程类型恢复进行 WebAssembly 反编译", "url": "https://dl.acm.org/doi/10.1145/3744916.3787762", "venue": "ICSE 2026", "verification": "source-reviewed", "verified_at": "2026-10-20", "why_fits_en": "Adds a concrete WebAssembly type-recovery and decompilation study with explicit scaling and execution limits.", "why_fits_zh": "补充具体的 WebAssembly 类型恢复与反编译研究，并保留扩展性及执行验证的边界。", "year": 2026 }, { "arxiv_id": "2311.13721", "arxiv_version_reviewed": "v7", "authors": [ "Nan Jiang", "Chengxiao Wang", "Kevin Liu", "Xiangzhe Xu", "Lin Tan", "Xiangyu Zhang", "Petr Babkin" ], "code_url": "https://github.com/lt-asset/nova/tree/6dfaf438fb23a8f024d0297653571615631ad8f4", "date_basis": "Publication year stated by the official ICLR proceedings; no finer publication date is asserted. The proceedings page's citation date of 2025-05-01 is not adopted, and the arXiv dates are not substituted.", "date_basis_zh": "采用 ICLR 官方论文集标明的出版年份，不推定更精确的出版日期。论文集页面 2025-05-01 的引用日期未被采用，也不以 arXiv 日期代替。", "date_precision": "year", "description_en": "Nova is a generative LLM for x86-64 assembly, trained from DeepSeek-Coder checkpoints on stripped, normalized gcc -O0 to -O3 assembly built from AnghaBench and The Stack. It adds hierarchical attention that builds per-instruction summaries, and contrastive objectives that keep a function's source and O0–O3 assembly close while ordering them by optimization level. Fine-tuned for decompilation, Nova-1.3B and Nova-6.7B reach 25.17% and 34.36% average Pass@1 on HumanEval-Decompile, 14.84 and 12.41 points above same-size LLM4Decompile; separately fine-tuned models report the highest average Recall@1 for O0-to-O3 binary code similarity on six real-world projects.", "description_zh": "Nova 是面向 x86-64 汇编的生成式大语言模型，从 DeepSeek-Coder 检查点出发，以 AnghaBench 与 The Stack 代码经 gcc -O0 至 -O3 编译、剥离符号并规范化后的汇编训练。它加入为每条指令构建摘要的层次注意力，以及对比学习目标：使同一函数的源码与 O0–O3 汇编表示彼此接近，并按优化级别排序。针对反编译微调后，Nova-1.3B 与 Nova-6.7B 在 HumanEval-Decompile 上的平均 Pass@1 分别为 25.17% 和 34.36%，比同规模 LLM4Decompile 高 14.84 和 12.41 个百分点；另行微调的模型在六个真实项目上的 O0 对 O3 二进制代码相似性检测中取得最高的平均 Recall@1。", "doi": null, "entry_url": "https://awesomerea.org/papers/paper-nova/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-nova/", "evidence_urls": [ "https://proceedings.iclr.cc/paper_files/paper/2025/hash/ef283d62b4bce30854a8d4827f331229-Abstract-Conference.html", "https://proceedings.iclr.cc/paper_files/paper/2025/file/ef283d62b4bce30854a8d4827f331229-Paper-Conference.pdf", "https://arxiv.org/abs/2311.13721", "https://arxiv.org/abs/2311.13721v1", "https://github.com/lt-asset/nova/blob/6dfaf438fb23a8f024d0297653571615631ad8f4/README.md", "https://github.com/lt-asset/nova/blob/6dfaf438fb23a8f024d0297653571615631ad8f4/LICENSE", "https://github.com/lt-asset/nova/blob/6dfaf438fb23a8f024d0297653571615631ad8f4/requirements.txt", "https://huggingface.co/lt-asset/nova-1.3b/blob/4b4805bac4f13ef8bec678072ef60609ea3b0e77/README.md", "https://huggingface.co/lt-asset/nova-6.7b/blob/dd808302b3f5929c29e8940f4e0c0e4cc38a5a63/README.md", "https://huggingface.co/lt-asset/nova-1.3b-bcr/blob/9101c192eb22bbb982ebe94830385cedee5b78e0/README.md", "https://huggingface.co/lt-asset/nova-6.7b-bcr/blob/69a8ccd089abc902b7ce9b4e17298a887fbe3626/README.md" ], "first_arxiv_date": "2023-11-22", "id": "paper-nova", "kind": "research", "metadata_notes": "Authors follow the proceedings, which list pages 95905–95926. arXiv has seven versions: v1 of 2023-11-22 was titled 'Nova+: Generative Language Models for Binaries' (written Nova$^+$ in the arXiv metadata) and listed six authors, without Petr Babkin; the checked later versions (v3, v5, v7) use the final title, and v7 of 2025-11-11 states ICLR 2025 publication. The repository README's abstract gives a relative decompilation gain of up to 146.54%, while the paper reports absolute percentage points. Licence signals are listed separately: the reviewed 2026-01-04 repository commit carries a BSD 3-Clause LICENSE, and the Hugging Face cards for nova-1.3b, nova-6.7b and their -bcr decompilation variants are tagged bsd-3-clause-clear; the models start from DeepSeek-Coder checkpoints, whose terms are not assessed here. requirements.txt pins torch 2.3.0, transformers 4.40.2, vllm 0.5.0 and deepspeed 0.14.4 for a Python 3.10 environment, and training examples use four GPUs. No models were downloaded and no code or experiments were run.", "metadata_notes_zh": "作者以论文集为准，论文集列出第 95905–95926 页。arXiv 共有七个版本：2023-11-22 的 v1 题为“Nova+: Generative Language Models for Binaries”（arXiv 元数据写作 Nova$^+$），列出六位作者，不含 Petr Babkin；本次核查的后续版本（v3、v5、v7）均使用最终标题，2025-11-11 的 v7 注明发表于 ICLR 2025。仓库 README 的摘要称反编译相对提升最高达 146.54%，论文报告的则是绝对百分点。各项许可信息分开记录：所审阅的 2026-01-04 仓库提交附有 BSD 3-Clause LICENSE，Hugging Face 上 nova-1.3b、nova-6.7b 及其 -bcr 反编译变体的模型卡均标注 bsd-3-clause-clear；模型从 DeepSeek-Coder 检查点出发，本条不评估其条款。requirements.txt 为 Python 3.10 环境固定 torch 2.3.0、transformers 4.40.2、vllm 0.5.0 与 deepspeed 0.14.4，训练示例使用四块 GPU。本次未下载模型，也未运行代码或实验。", "pdf_url": "https://proceedings.iclr.cc/paper_files/paper/2025/file/ef283d62b4bce30854a8d4827f331229-Paper-Conference.pdf", "project_url": null, "publication_date": null, "publication_status": "conference-paper", "runtime_tested": false, "scope_limitations_en": "Decompilation is evaluated function by function on the 164 HumanEval-Decompile C problems, each compiled for x86-64 at O0–O3, by running 20 samples per function against the problems' test cases; Pass@k on these tests is neither whole-program nor equivalence evidence. Baselines other than LLM4Decompile and Nova were prompted with three-shot examples rather than fine-tuned. Similarity results cover O0 queries against O3 candidates in pools of 50–500 functions from Binutils, Curl, ImageMagick, SQLite, OpenSSL and PuTTY, after fine-tuning on BinaryCorp-3M. Decompilation fine-tuning used a 2.16M-pair sample, the README says only 50K files came from The Stack, and the paper limits Nova to x86-64 assembly and 1.3B and 6.7B models. Inputs require the paper's assembly normalization.", "scope_limitations_zh": "反编译以函数为单位，在 HumanEval-Decompile 的 164 个 C 问题上评测；每个问题在 O0–O3 下编译为 x86-64，每个函数采样 20 次并以题目测试用例运行。基于这些测试的 Pass@k 既不能证明整程序反编译能力，也不能证明等价性。除 LLM4Decompile 与 Nova 外，其他基线采用三样例提示而非微调。相似性结果针对 O0 查询与 O3 候选，候选池为来自 Binutils、Curl、ImageMagick、SQLite、OpenSSL 与 PuTTY 的 50–500 个函数，模型先在 BinaryCorp-3M 上微调。反编译微调使用抽样的 216 万对数据，README 称仅从 The Stack 获取 5 万个文件；论文也说明 Nova 仅支持 x86-64 汇编，模型规模限于 1.3B 和 6.7B。输入需要按论文方式规范化汇编。", "targets": [ "binary" ], "title": "Nova: Generative Language Models for Assembly Code with Hierarchical Attention and Contrastive Learning", "title_zh": "Nova：结合层次注意力与对比学习的汇编代码生成式语言模型", "url": "https://proceedings.iclr.cc/paper_files/paper/2025/hash/ef283d62b4bce30854a8d4827f331229-Abstract-Conference.html", "venue": "ICLR 2025", "verification": "source-reviewed", "verified_at": "2026-10-18", "why_fits_en": "Adds an assembly-specialized foundation model evaluated on both decompilation and binary code similarity, complementing the decompilation-specific LLM papers in this section.", "why_fits_zh": "补充一个面向汇编的基础模型，同时评测反编译与二进制代码相似性，与本节专注反编译的大语言模型论文互补。", "year": 2025 }, { "arxiv_id": "2406.05590", "arxiv_version_reviewed": "v3", "authors": [ "Minghao Shao", "Sofija Jancheska", "Meet Udeshi", "Brendan Dolan-Gavitt", "Haoran Xi", "Kimberly Milner", "Boyuan Chen", "Max Yin", "Siddharth Garg", "Prashanth Krishnamurthy", "Farshad Khorrami", "Ramesh Karri", "Muhammad Shafique" ], "code_url": "https://github.com/NYU-LLM-CTF/NYU_CTF_Bench", "date_basis": "The official NeurIPS proceedings and publisher-deposited Crossref metadata identify publication year 2024; the proceedings page’s citation_publication_date metadata reads 2024-12-16, but neither Crossref nor a publisher statement confirms that day, so only the year is recorded. The first arXiv submission date is recorded separately.", "date_basis_zh": "NeurIPS 官方论文集与出版方提交的 Crossref 元数据标明出版年份为 2024；论文集页面的 citation_publication_date 元数据为 2024-12-16，但 Crossref 与出版方说明均未确认该日期，因此仅记录年份。首次提交 arXiv 的日期另行记录。", "date_precision": "year", "description_en": "NYU CTF Bench packages 200 manually validated challenges from CSAW CTF qualifying and final rounds held between 2017 and 2023, spanning cryptography, forensics, pwn, reverse engineering, web and miscellaneous tasks, with challenge.json metadata and Docker images for server-side challenges. The paper also presents an automated framework that gives LLMs function-calling tools for shell commands, file creation, Ghidra disassembly and decompilation, flag checking and giving up. It evaluates five LLMs and compares their scores with human teams at CSAW 2022 and 2023.", "description_zh": "NYU CTF Bench 收录 2017–2023 年 CSAW CTF 资格赛与决赛中经人工验证的 200 道题目，涵盖密码学、取证、二进制漏洞利用、逆向工程、Web 与杂项任务，并为题目提供 challenge.json 元数据，为需要服务端的题目提供 Docker 镜像。论文还提出一个自动化框架，通过函数调用为大语言模型提供执行 Shell 命令、创建文件、使用 Ghidra 反汇编与反编译、检查 flag 和放弃求解等工具。论文评测了五种大语言模型，并将其得分与 CSAW 2022 和 2023 的人类参赛队伍比较。", "doi": "10.52202/079017-1832", "entry_url": "https://awesomerea.org/papers/paper-nyu-ctf-bench/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-nyu-ctf-bench/", "evidence_urls": [ "https://proceedings.neurips.cc/paper_files/paper/2024/hash/69d97a6493fbf016fff0a751f253ad18-Abstract-Datasets_and_Benchmarks_Track.html", "https://proceedings.neurips.cc/paper_files/paper/2024/file/69d97a6493fbf016fff0a751f253ad18-Paper-Datasets_and_Benchmarks_Track.pdf", "https://api.crossref.org/works/10.52202/079017-1832", "https://arxiv.org/abs/2406.05590", "https://arxiv.org/pdf/2406.05590v3", "https://github.com/NYU-LLM-CTF/NYU_CTF_Bench/blob/4c5744f55a31a58e03d6118c9dbb1c18e5bbdfa9/README.md", "https://github.com/NYU-LLM-CTF/NYU_CTF_Bench/blob/4c5744f55a31a58e03d6118c9dbb1c18e5bbdfa9/LICENSE", "https://github.com/NYU-LLM-CTF/nyuctf_agents/blob/612190f298ae9e604f00370019beed4ba1f372f6/README.md", "https://zenodo.org/records/13930622" ], "first_arxiv_date": "2024-06-08", "id": "paper-nyu-ctf-bench", "kind": "research", "metadata_notes": "The 13-author order follows the NeurIPS proceedings page, the PDF, arXiv and Crossref. NeurIPS volume 37 lists pages 57472–57498; arXiv v3 (2025-02-18) matches the reviewed proceedings text. The NeurIPS checklist gives the Zenodo software DOI 10.5281/zenodo.13930622 for the v20241008 benchmark release; it is an artifact identifier, not the paper DOI. The reviewed NYU_CTF_Bench snapshot (2025-09-22) is GPL-2.0, holds the 200-challenge test split and a 55-challenge development split, and is installed through the nyuctf Python package, which clones the repository; challenges need Docker. The paper’s llm_ctf_automation link now redirects to NYU-LLM-CTF/nyuctf_agents, whose reviewed 2026-07-17 snapshot is MIT-licensed and also contains the later D-CIPHER multi-agent system alongside the baseline. Challenge files keep their original authors’ terms. No code or experiments were run.", "metadata_notes_zh": "13 位作者的顺序以 NeurIPS 论文集页面、PDF、arXiv 与 Crossref 为准。NeurIPS 第 37 卷列出页码 57472–57498；arXiv v3（2025-02-18）与所审阅的论文集文本一致。NeurIPS 检查清单给出 Zenodo 软件 DOI 10.5281/zenodo.13930622，对应 v20241008 基准发布版本；它是研究产物标识符，并非论文 DOI。所审阅的 NYU_CTF_Bench 快照（2025-09-22）采用 GPL-2.0，包含 200 道题的测试集和 55 道题的开发集，通过会克隆该仓库的 nyuctf Python 包安装，题目需要 Docker。论文中的 llm_ctf_automation 链接现重定向至 NYU-LLM-CTF/nyuctf_agents；其所审阅的 2026-07-17 快照采用 MIT 许可证，除基线外还包含后来的 D-CIPHER 多智能体系统。题目文件沿用原作者的条款。本次未运行代码或实验。", "pdf_url": "https://proceedings.neurips.cc/paper_files/paper/2024/file/69d97a6493fbf016fff0a751f253ad18-Paper-Datasets_and_Benchmarks_Track.pdf", "project_url": "https://nyu-llm-ctf.github.io/", "publication_date": null, "publication_status": "conference-paper", "runtime_tested": false, "scope_limitations_en": "Only 51 of the 200 challenges are reverse engineering (31 qualifying and 20 final), so overall solve rates are not reverse-engineering accuracy. All challenges come from one competition series, categories are imbalanced, and the remaining 367 of the initial 567 challenges, including incident-response tasks, are excluded pending validation. The baseline counts a challenge as solved if any of five attempts succeeds, within a 48-hour limit per model; no statistical tests were run. Among GPT-3.5, GPT-4, Claude 3, Mixtral and LLaMA, the best reverse-engineering rate was 9.80% (GPT-4), and the open models solved nothing. The human comparison uses competition scores from four CSAW events, and the public repository has continued to change after publication, so later runs may not match the paper’s challenge set or framework.", "scope_limitations_zh": "200 道题中只有 51 道为逆向工程题（资格赛 31 道、决赛 20 道），因此总体解题率并不等于逆向工程准确率。所有题目均来自同一系列赛事，各类别数量不均衡；最初 567 道题中其余 367 道（包括事件响应类任务）因尚未完成验证而未收录。基线评测中，五次尝试中任意一次成功即算解出，每个模型限时 48 小时，且未进行统计检验。在 GPT-3.5、GPT-4、Claude 3、Mixtral 与 LLaMA 中，逆向工程类最佳解题率为 9.80%（GPT-4），两个开源模型未解出任何题目。与人类的比较基于四场 CSAW 赛事的比赛得分；公开仓库在论文发表后仍持续变化，后续运行未必与论文中的题目集或框架一致。", "targets": [ "binary" ], "title": "NYU CTF Bench: A Scalable Open-Source Benchmark Dataset for Evaluating LLMs in Offensive Security", "title_zh": "NYU CTF Bench：用于评估大语言模型攻击性安全能力的可扩展开源基准数据集", "url": "https://proceedings.neurips.cc/paper_files/paper/2024/hash/69d97a6493fbf016fff0a751f253ad18-Abstract-Datasets_and_Benchmarks_Track.html", "venue": "NeurIPS 2024 Datasets and Benchmarks", "verification": "source-reviewed", "verified_at": "2026-10-18", "why_fits_en": "Supplies a public, dockerized CTF challenge set with a reverse-engineering subset; later agent work such as EnIGMA evaluates on it.", "why_fits_zh": "提供一个容器化的公开 CTF 题目集，其中包含逆向工程子集；EnIGMA 等后续智能体研究在其上开展评测。", "year": 2024 }, { "arxiv_id": "2605.25923", "arxiv_version_reviewed": "v3", "authors": [ "Fangtian Zhong", "Zhuoyun Qian", "Yili Jiang", "Jiaqi Huang", "Yunming Pang", "Xiuzhen Cheng" ], "code_url": null, "date_basis": "First arXiv submission was 2026-05-25; reviewed v3 was revised on 2026-10-19. No formal publication was verified.", "date_basis_zh": "arXiv 首次提交为 2026-05-25；所审阅 v3 修订于 2026-10-19。未核实正式出版。", "date_precision": "day", "description_en": "Uses unpacking outcomes as reference evidence to assess packer labels, normalizes heterogeneous tool results, and evaluates complementary signature/heuristic pools with static predicates derived from unpacker implementations. It traces how identification errors affect later unpacking and malware classification.", "description_zh": "以脱壳结果作为参考证据评估壳标签，规范化不同工具的输出，并评估互补签名／启发式规则池及从脱壳器实现提取的静态判定条件；同时追踪识别错误对后续脱壳和恶意软件分类的影响。", "doi": "10.48550/arxiv.2605.25923", "entry_url": "https://awesomerea.org/papers/paper-packer-identification-semantic-validation/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-packer-identification-semantic-validation/", "evidence_urls": [ "https://arxiv.org/abs/2605.25923", "https://arxiv.org/html/2605.25923v3", "https://api.datacite.org/dois/10.48550/arxiv.2605.25923", "https://arxiv.org/pdf/2605.25923v3", "https://arxiv.org/abs/2605.25923v2" ], "first_arxiv_date": "2026-05-25", "id": "paper-packer-identification-semantic-validation", "kind": "research", "metadata_notes": "Reviewed the October v3 while retaining the May first-submission date. Its six-author list agrees across the current abstract, versioned PDF and updated DataCite record; v2 lists seven authors and is not combined with v3. The article is CC BY-SA 4.0, which does not license malware samples or third-party tools. Reviewed sources and focused search did not establish a paper-specific public release or its license. No malware samples, unpackers or experiment code were downloaded or executed.", "metadata_notes_zh": "已审阅十月 v3，同时保留五月首投日期。当前摘要、固定版本 PDF 与已更新 DataCite 记录的六位作者名单一致；v2 列七位作者，不与 v3 混用。文章采用 CC BY-SA 4.0，不构成恶意软件样本或第三方工具的许可。所审阅来源及定向检索未确立论文专属公开发布或其许可。本次未下载或运行恶意软件样本、脱壳器或实验代码。", "pdf_url": "https://arxiv.org/pdf/2605.25923v3", "project_url": null, "publication_date": "2026-05-25", "publication_status": "preprint", "runtime_tested": false, "scope_limitations_en": "The corpus is approximately 160,000 Windows PE samples, split into roughly 130,000 for analysis/rule construction and 30,000 for testing. Unpacker failures or partial recovery can compromise the derived reference labels. Family-identification improvements use common pooled-rule configurations, not independently validated patches to seven separate tools. Repair evaluation excludes proprietary implementations and graph/learning-based methods. Results do not establish coverage of other executable formats, all packer families or general semantic equivalence.", "scope_limitations_zh": "语料约含 160,000 个 Windows PE 样本，其中约 130,000 个用于分析与构造规则，约 30,000 个用于测试。脱壳失败或仅部分恢复可能影响由此生成的参考标签。壳家族识别改进采用公共规则池配置，并非对七个独立工具分别验证补丁。修正评测不涵盖专有实现及基于图或学习的方法；结果不证明覆盖其他可执行格式、所有壳家族或一般语义等价。", "targets": [ "binary" ], "title": "Semantic Validation of Packer Identification Tools: Characterization, Repair, and Downstream Impact", "title_zh": "加壳识别工具的语义验证：特征分析、修正与下游影响", "url": "https://arxiv.org/abs/2605.25923", "venue": "arXiv", "verification": "source-reviewed", "verified_at": "2026-10-20", "why_fits_en": "Examines the reliability of packer identification as a prerequisite for recovering analyzable binary content; it is a foundation-tool evaluation rather than an agent benchmark.", "why_fits_zh": "评估加壳识别作为恢复可分析二进制内容的前置步骤是否可靠；它属于基础工具评估，而非智能体基准。", "year": 2026 }, { "arxiv_id": "2610.25071", "arxiv_version_reviewed": "v1", "authors": [ "Huaijin Wang", "Tongda Wang", "Zhibo Liu", "Yue Zhang", "Shuai Wang", "Pengfei Hu", "Jianzhong Liu", "Fangtian Zhong", "Shaohua Wang" ], "code_url": null, "date_basis": "First arXiv v1 submission; no formal venue publication was verified.", "date_basis_zh": "采用 arXiv v1 首次提交日期；未核实正式会议或期刊出版。", "date_precision": "day", "description_en": "Locates patch-relevant code in stripped binaries using instruction-aligned retrieval and caller/callee context, then uses an LLM to screen candidate matches and compare patch-specific behavior with vulnerable and patched references.", "description_zh": "结合指令对齐检索及调用者／被调用者上下文，在剥离符号的二进制中定位补丁相关代码，再由 LLM 筛选候选匹配并对照漏洞版与修复版参考程序判断补丁特定行为。", "doi": "10.48550/arxiv.2610.25071", "entry_url": "https://awesomerea.org/papers/paper-patchalign/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-patchalign/", "evidence_urls": [ "https://arxiv.org/abs/2610.25071", "https://arxiv.org/html/2610.25071v1", "https://api.datacite.org/dois/10.48550/arxiv.2610.25071" ], "first_arxiv_date": "2026-10-18", "id": "paper-patchalign", "kind": "research", "metadata_notes": "Reviewed the nine-author v1 abstract and full text. The article uses the arXiv non-exclusive license. Its data-availability section promises code, models, data and instructions upon publication; no paper-specific public artifact or artifact license was verified in the reviewed text and focused search. Cited baseline tools are not the PatchAlign release. DataCite registered the matching arXiv DOI on 2026-10-20, despite the abstract page still saying pending. No binary, model or experiment was executed.", "metadata_notes_zh": "已审阅九位作者的 v1 摘要与全文。文章采用 arXiv 非独占许可。数据可用性部分承诺在出版时发布代码、模型、数据及说明；所审阅全文和定向检索未核实论文专属公开产物或其许可，引用的基线工具不等于 PatchAlign 发布。DataCite 于 2026-10-20 登记匹配的 arXiv DOI，尽管摘要页仍标为待注册。本次未执行二进制、模型或实验。", "pdf_url": "https://arxiv.org/pdf/2610.25071v1", "project_url": null, "publication_date": "2026-10-18", "publication_status": "preprint", "runtime_tested": false, "scope_limitations_en": "Requires the known source patch and vulnerable/patched reference binaries; it is not source recovery or undisclosed-vulnerability discovery. Evaluation covers 62 CVEs from four C/C++ projects, 124 reference and 496 target binaries, restricted to x86-64, GCC/Clang configurations and one reported reasoning model. Balanced labels do not reproduce deployment prevalence; public patches may be in training data. Uncertain and missing-localization outcomes are reported separately, but binary metrics map them to vulnerable and negative outcomes, respectively; selected accuracy excludes both.", "scope_limitations_zh": "需要已知源码补丁以及漏洞版／修复版参考二进制，并非源码恢复或未公开漏洞发现。评测覆盖四个 C/C++ 项目的 62 个 CVE、124 个参考二进制及 496 个目标二进制，限于 x86-64、指定 GCC／Clang 配置和一个报告的推理模型。标签平衡不代表实际部署分布；公开补丁可能出现在训练数据中。不确定与定位失败结果虽单独报告，但二分类指标分别将其计为仍有漏洞的正类及负类；选定子集准确率则排除两者。", "targets": [ "binary" ], "title": "Locate, Then Reason: End-to-End Patch Presence Testing in Stripped Binaries", "title_zh": "先定位再推理：剥离符号二进制中的端到端补丁存在性测试", "url": "https://arxiv.org/abs/2610.25071", "venue": "arXiv", "verification": "source-reviewed", "verified_at": "2026-10-20", "why_fits_en": "Studies evidence-guided localization and semantic comparison of binary code, including the limits of decompiler-inferred types when judging small fixes.", "why_fits_zh": "研究由证据引导的二进制代码定位与语义比较，并展示反编译器推断类型在判断小规模修复时的局限。", "year": 2026 }, { "arxiv_id": null, "arxiv_version_reviewed": null, "authors": [ "Andrew Fasano", "Zachary Estrada", "Luke Craig", "Ben Levy", "Jordan McLeod", "Jacques Becker", "Caden Kline", "Elysia Witham", "Cole DiLorenzo", "Ali Bobi", "Dinko Dermendzhiev", "Tim Leek", "Wil Robertson" ], "code_url": "https://github.com/rehosting/penguin", "date_basis": "The Internet Society’s Crossref deposit gives publication year 2025. The PDF footer names the 28 February 2025 workshop; no finer publication date is asserted from the event date.", "date_basis_zh": "Internet Society 向 Crossref 提交的元数据给出出版年份 2025。PDF 页脚标注研讨会于 2025 年 2 月 28 日举行；不据此推定更精确的出版日期。", "date_precision": "year", "description_en": "Penguin rehosts embedded Linux firmware from an extracted filesystem by deriving an editable configuration of emulation transformations, such as file changes, pseudofiles, NVRAM values and network interfaces, from static analysis. Dynamic-analysis plugins expose failures so the configuration can be refined for each target, and a minimizer identifies which transformations a working rehosting needs.", "description_zh": "Penguin 以提取出的固件文件系统为输入，通过静态分析生成可编辑的仿真变换配置（如文件修改、伪文件、NVRAM 值和网络接口），用于重托管嵌入式 Linux 固件。动态分析插件揭示运行失败，便于针对具体目标完善配置；配置最小化工具则找出可用的重托管所必需的变换。", "doi": "10.14722/bar.2025.23010", "entry_url": "https://awesomerea.org/papers/paper-penguin/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-penguin/", "evidence_urls": [ "https://www.ndss-symposium.org/ndss-paper/auto-draft-634/", "https://www.ndss-symposium.org/wp-content/uploads/bar2025-final10.pdf", "https://doi.org/10.14722/bar.2025.23010", "https://api.crossref.org/works/10.14722/bar.2025.23010", "https://www.ndss-symposium.org/ndss-program/bar-2025/", "https://github.com/rehosting/penguin/blob/b645cd23852a41781181a651779b82a48c0c3fd3/README.md", "https://github.com/rehosting/penguin/blob/b645cd23852a41781181a651779b82a48c0c3fd3/LICENSE", "https://github.com/rehosting/penguin/releases/tag/v3.1.21" ], "first_arxiv_date": null, "id": "paper-penguin", "kind": "research", "metadata_notes": "BAR 2025 is a workshop co-located with NDSS Symposium 2025, not the NDSS main track. The 13-author order and the name ‘Wil Robertson’ follow the PDF and the Internet Society’s Crossref deposit; the NDSS paper and program pages list ‘William Robertson’ and place Caden Kline after Cole DiLorenzo. The DOI resolves directly to the PDF, whose footer gives ISBN 979-8-9919276-4-2; no page range was verified. The conclusion says 13,650 images where the abstract and appendix say 13,649. The PDF’s availability section points to rehosting/penguin but names no evaluated release; the curated tool record reviews v3.1.21 (2026-10-06), which postdates the paper. The repository is GPL-2.0-or-later at the pinned commit, and the paper does not describe its firmware corpus as released. Experiments were not rerun for this collection.", "metadata_notes_zh": "BAR 2025 是与 NDSS Symposium 2025 同期举办的研讨会，并非 NDSS 主会。13 位作者的顺序及“Wil Robertson”的写法以 PDF 和 Internet Society 向 Crossref 提交的元数据为准；NDSS 论文页和日程页写作“William Robertson”，并将 Caden Kline 排在 Cole DiLorenzo 之后。该 DOI 直接解析到 PDF，PDF 页脚标注 ISBN 979-8-9919276-4-2；未核实页码范围。论文结论写作 13,650 个镜像，摘要和附录则为 13,649 个。PDF 的“可用性”一节指向 rehosting/penguin 仓库，但未注明评测所用版本；精选工具条目审阅的 v3.1.21（2026-10-06）晚于论文发表。固定提交中的仓库采用 GPL-2.0-or-later，论文也未说明公开其固件语料。本合集未重新运行实验。", "pdf_url": "https://www.ndss-symposium.org/wp-content/uploads/bar2025-final10.pdf", "project_url": null, "publication_date": null, "publication_status": "conference-paper", "runtime_tested": false, "scope_limitations_en": "Targets embedded Linux firmware through whole-system emulation with kernel replacement, as in Firmadyne and FirmAE; the implementation covers x86, ARM and MIPS and relies on the Linux syscall ABI. In the FirmAE comparison, success means a process binds port 80 or 443; a non-empty HTTP response is a stricter check, and the authors note neither shows full functionality. The 75% gain over FirmAE is author-reported on their own corpus of 13,649 images from vendor websites. Refinement still needs an analyst, and nondeterministic runs were repeated up to ten times. It builds an analysis environment, not a faithful device reproduction or source recovery.", "scope_limitations_zh": "面向嵌入式 Linux 固件，沿用 Firmadyne 和 FirmAE 的思路，采用替换内核的整机仿真；实现支持 x86、ARM 和 MIPS，并依赖 Linux 系统调用 ABI。与 FirmAE 对比时，判定成功的标准是有进程绑定 80 或 443 端口，更严格的检查是 HTTP 返回非空响应；作者指出两者都不代表系统功能完整。比 FirmAE 多出 75% 的结果由作者在其自建语料（13,649 个取自厂商网站的镜像）上报告。完善配置仍需分析人员参与；运行结果不完全确定，作者对配置最多重复运行十次。该工作构建的是分析环境，不代表忠实复现设备或恢复源代码。", "targets": [ "firmware" ], "title": "Target-Centric Firmware Rehosting with Penguin", "title_zh": "使用 Penguin 进行以目标为中心的固件重托管", "url": "https://www.ndss-symposium.org/ndss-paper/auto-draft-634/", "venue": "Workshop on Binary Analysis Research (BAR) 2025", "verification": "source-reviewed", "verified_at": "2026-10-17", "why_fits_en": "Makes firmware rehosting an explicit, shareable per-target configuration refined from runtime evidence, a reproducible way to rebuild an analyzable execution environment without the original hardware.", "why_fits_zh": "将固件重托管表达为明确、可共享并针对具体目标的配置，依据运行时证据逐步完善，以可复现的方式在脱离原始硬件的条件下重建可分析的执行环境。", "year": 2025 }, { "arxiv_id": "1705.07962", "arxiv_version_reviewed": "v2", "authors": [ "Tony Beltramelli" ], "code_url": "https://github.com/tonybeltramelli/pix2code", "date_basis": "ACM-deposited Crossref proceedings metadata: online and print publication on 19 June 2018; arXiv first submitted 22 May 2017.", "date_basis_zh": "ACM 向 Crossref 提交的论文集元数据：在线与印刷版均于 2018 年 6 月 19 日出版；arXiv 首次提交于 2017 年 5 月 22 日。", "date_precision": "day", "description_en": "Learns screenshot-to-DSL generation for native Android XML, iOS Storyboards and web HTML/CSS interfaces, then compiles the DSL into platform UI code.", "description_zh": "学习从界面截图生成领域专用语言（DSL），再编译为原生 Android XML、iOS Storyboard 或网页 HTML/CSS 界面代码。", "doi": "10.1145/3220134.3220135", "entry_url": "https://awesomerea.org/papers/paper-pix2code/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-pix2code/", "evidence_urls": [ "https://arxiv.org/abs/1705.07962", "https://api.crossref.org/works/10.1145/3220134.3220135", "https://arxiv.org/html/1705.07962v2", "https://uizard.io/research#pix2code", "https://github.com/tonybeltramelli/pix2code/blob/eab4816e397e7491b92bdcb78d9d7195afa412b3/README.md", "https://github.com/tonybeltramelli/pix2code/blob/eab4816e397e7491b92bdcb78d9d7195afa412b3/requirements.txt", "https://github.com/tonybeltramelli/pix2code/blob/eab4816e397e7491b92bdcb78d9d7195afa412b3/LICENSE" ], "first_arxiv_date": "2017-05-22", "id": "paper-pix2code", "kind": "research", "metadata_notes": "The published EICS 2018 proceedings article follows the 2017 arXiv release; this record reviews arXiv v2 dated 19 September 2017. The linked author repository is the implementation identified by that version, reviewed at a current pinned commit rather than claimed to be an unchanged historical release. It contains compiler code and split dataset archives; the actual LICENSE declares Apache 2.0, while the README license badge has a stale filename.", "metadata_notes_zh": "2017 年 arXiv 版本之后，论文发表于 EICS 2018 论文集；本条目审阅的是 2017 年 9 月 19 日的 arXiv v2。所链接作者仓库由该版本明确指定，本次核查固定到当前提交，并不声称其仍与历史发布完全相同。仓库包含编译器代码和分卷数据集压缩包；实际 LICENSE 文件声明 Apache 2.0，README 许可证徽章则使用了过时的文件名。", "pdf_url": "https://arxiv.org/pdf/1705.07962v2", "project_url": "https://uizard.io/research#pix2code", "publication_date": "2018-06-19", "publication_status": "conference-paper", "runtime_tested": false, "scope_limitations_en": "Evaluation uses synthetic screenshot/code pairs: 1,500 training and 250 test instances per platform. Reported accuracy concerns DSL tokens, not complete apps or behavior. Text labels are ignored; platform datasets train separate models using the same architecture. The task covers layout, components and relationships, not application logic or backend recovery. The repository describes an educational research prototype; its older dependencies were not runtime-tested.", "scope_limitations_zh": "评测采用合成的截图与代码配对，每个平台含 1,500 个训练实例和 250 个测试实例。报告的准确率针对 DSL 词元，不代表完整应用或行为复现成功率。方法忽略文本标签内容，并以相同架构分别训练各平台模型；范围是布局、组件及其关系，不包括应用逻辑或后端恢复。仓库将其定位为教育用途的研究原型；本条目未对其较旧依赖进行运行测试。", "targets": [ "app", "website" ], "title": "pix2code: Generating Code from a Graphical User Interface Screenshot", "title_zh": "pix2code：从图形用户界面截图生成代码", "url": "https://doi.org/10.1145/3220134.3220135", "venue": "EICS 2018", "verification": "source-reviewed", "verified_at": "2026-10-16", "why_fits_en": "Adds an early learned screenshot-to-code approach spanning native mobile and web UI reconstruction.", "why_fits_zh": "补充一种早期基于学习的截图到代码方法，覆盖原生移动端与网页界面重建。", "year": 2018 }, { "arxiv_id": null, "arxiv_version_reviewed": null, "authors": [ "Juan Caballero", "Heng Yin", "Zhenkai Liang", "Dawn Song" ], "code_url": null, "date_basis": "ACM’s Crossref deposit records both print and online publication on 2007-10-28. This entry uses that date, not the October 29–November 2 conference dates printed on the paper.", "date_basis_zh": "ACM 提交的 Crossref 元数据将纸质与在线出版日期均记为 2007-10-28。本条目采用该日期，而非论文所印 10 月 29 日至 11 月 2 日的会议日期。", "date_precision": "day", "description_en": "Polyglot infers the format of a message that a program receives by monitoring how the program binary processes it, an approach the authors call shadowing. An execution monitor taints network input and records an instruction trace; offline analyses then find direction fields, such as length and pointer fields, from tainted memory accesses and loop conditions, separators from comparisons between tainted bytes and constants, multi-byte fixed-length fields from how instructions group input bytes, and protocol keywords from successful comparisons. It works on stripped IA-32 binaries without source code or debugging information.", "description_zh": "Polyglot 通过监测程序二进制如何处理接收到的报文来推断其格式，作者称这一方法为“影随”（shadowing）。执行监控器对网络输入施加污点标记并记录指令轨迹；离线分析再依据受污点数据参与的内存访问与循环条件识别长度字段、指针字段等指向字段，依据受污点字节与常量之间的比较识别分隔符，依据指令如何组合输入字节识别多字节定长字段，并依据成功的比较提取协议关键字。该方法适用于剥离符号的 IA-32 二进制，无需源码或调试信息。", "doi": "10.1145/1315245.1315286", "entry_url": "https://awesomerea.org/papers/paper-polyglot/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-polyglot/", "evidence_urls": [ "https://dl.acm.org/doi/10.1145/1315245.1315286", "https://api.crossref.org/works/10.1145/1315245.1315286", "https://people.eecs.berkeley.edu/~dawnsong/papers/2007%20p317-caballero.pdf", "https://www.cs.ucr.edu/~heng/pubs/polyglot-ccs07.pdf" ], "first_arxiv_date": null, "id": "paper-polyglot", "kind": "research", "metadata_notes": "Crossref records the title as “Polyglot” with the lowercase subtitle “automatic extraction of protocol message format using dynamic binary analysis”, the four-author order and pages 317–329; this entry follows the capitalization printed on the paper. dl.acm.org refused automated requests during this review, so the text was checked in the 13-page ACM-formatted copy hosted on Dawn Song’s Berkeley site, which carries the CCS’07 copyright notice and page numbers from 317. A 15-page author version with appendices is hosted at UC Riverside and says the definitive version was published at CCS’07. The execution monitor is cited as the authors’ earlier work and is not released with the paper. The paper gives no code or project link, so both stay null, and nothing was run.", "metadata_notes_zh": "Crossref 将标题记为“Polyglot”，副标题为小写的“automatic extraction of protocol message format using dynamic binary analysis”，并记录四位作者顺序及页码 317–329；本条目采用论文所印的大小写。审阅期间 dl.acm.org 拒绝自动请求，因此正文核对依据托管在 Dawn Song 伯克利网站上的 13 页 ACM 排版副本，该副本载有 CCS’07 版权声明，页码从 317 起。加州大学河滨分校托管有一份含附录的 15 页作者版本，注明正式版本发表于 CCS’07。执行监控器引自作者此前的工作，并未随论文发布。论文未提供代码或项目链接，因此两者均为 null；本次未运行任何内容。", "pdf_url": "https://dl.acm.org/doi/pdf/10.1145/1315245.1315286", "project_url": null, "publication_date": "2007-10-28", "publication_status": "conference-paper", "runtime_tested": false, "scope_limitations_en": "It extracts the format of one received message at a time and only of messages given to the analysis; messages that never appear stay unknown, and messages the program sends are not analyzed. It does not infer the protocol state machine. The evaluation covers eleven 2007-era programs implementing DNS, HTTP, IRC, ICQ and Samba, mostly Windows servers plus an ICQ client and a Linux Samba server, with one representative message per protocol, compared against Wireshark 0.99.5 dissectors. Field formats omit data types and encodings, analysis is at byte granularity so sub-byte flags are missed, and field semantics are limited to direction fields; timestamps, checksums and addresses are not identified. Message boundaries rely on assuming a synchronous protocol, unused fixed-length fields after an ICQ length field were merged into the variable-length field, and the authors state that the techniques are not fully resistant against obfuscation.", "scope_limitations_zh": "方法每次提取一条接收报文的格式，且只覆盖提供给分析的报文；从未出现的报文仍然未知，程序发送的报文也不在分析范围内。它不推断协议状态机。评测覆盖 11 个 2007 年前后的程序，实现 DNS、HTTP、IRC、ICQ 与 Samba 五种协议，以 Windows 服务端为主，另含一个 ICQ 客户端和一个 Linux 上的 Samba 服务端；每种协议选取一条代表性报文，并与 Wireshark 0.99.5 的解析器对比。字段格式不包括数据类型与编码；分析以字节为粒度，因此会遗漏不足一字节的标志位；字段语义仅限于指向字段，不识别时间戳、校验和或地址。报文边界依赖同步协议这一假设；ICQ 长度字段之后未使用的定长字段被并入了变长字段。作者也说明这些技术尚不能完全抵御混淆。", "targets": [ "protocol" ], "title": "Polyglot: Automatic Extraction of Protocol Message Format using Dynamic Binary Analysis", "title_zh": "Polyglot：基于动态二进制分析的协议报文格式自动提取", "url": "https://dl.acm.org/doi/10.1145/1315245.1315286", "venue": "ACM CCS 2007", "verification": "source-reviewed", "verified_at": "2026-10-19", "why_fits_en": "Adds binary-analysis inference of protocol message formats from a running implementation, the line of work that the collection's BinPRE record continues, complementing its trace-based protocol research.", "why_fits_zh": "补充依据运行中的实现、以二进制分析推断协议报文格式的研究，合集中的 BinPRE 条目延续了这一方向，并与合集里基于流量的协议研究互补。", "year": 2007 }, { "arxiv_id": "2609.23583", "arxiv_version_reviewed": "v1", "authors": [ "Pouya Narimani", "Kseniia Rogova", "Addison Crump", "Martin Mohl", "Meng Wang", "Ulysse Planta", "Pansilu Pitigalaarachchi", "Ali Abbasi" ], "code_url": null, "date_basis": "First arXiv submission; the reviewed version is v1, not a verified proceedings publication.", "date_basis_zh": "采用 arXiv 首次提交日期；审阅版本为 v1，并非已经核实的会议录出版。", "date_precision": "day", "description_en": "Builds a noise-tolerant pseudo execution-flow graph from one power trace per test input, using newly observed behavior as LibAFL feedback. It explores embedded firmware without access to its binary, source or instrumentation.", "description_zh": "根据每个测试输入的一条功耗轨迹构建可容忍噪声的近似执行流图，将新观察到的行为用作 LibAFL 反馈；无需取得固件二进制、源码或插桩即可探索嵌入式固件。", "doi": null, "entry_url": "https://awesomerea.org/papers/paper-pozzer/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-pozzer/", "evidence_urls": [ "https://arxiv.org/abs/2609.23583", "https://arxiv.org/html/2609.23583v1" ], "first_arxiv_date": "2026-09-20", "id": "paper-pozzer", "kind": "research", "metadata_notes": "The first submission is September 20, not the later announcement date. Reviewed the full eight-author v1 list. Open Science promises code and results after acceptance; no dedicated public artifact or license was verified. No target, fuzzer or hardware was run.", "metadata_notes_zh": "首次提交日期为 9 月 20 日，而非后续公告日期；采用 v1 完整八位作者列表。Open Science 段承诺录用后发布代码和结果，本次未核实专用公开产物或许可；未运行目标、模糊测试器或硬件。", "pdf_url": "https://arxiv.org/pdf/2609.23583v1", "project_url": null, "publication_date": "2026-09-20", "publication_status": "preprint", "runtime_tested": false, "scope_limitations_en": "Requires physical power measurement, known input pins and setup calibration. Evaluation covers 15 targets on two Cortex-M platforms and two commercial devices; benchmark coverage is measured by later instrumented replay, not recovered directly from power traces. Results depend on seeds and hardware, and long traces reduce throughput. The graph is not a proven control-flow graph or recovered program. Real-device harnesses are withheld.", "scope_limitations_zh": "需要物理功耗测量、已知输入引脚和实验装置校准。评测覆盖两个 Cortex-M 平台上的 15 个目标及两个商用设备；基准覆盖率通过事后插桩回放测量，并非直接由功耗轨迹恢复。结果受种子和硬件影响，长轨迹会降低吞吐量；该图不是经过证明的控制流图或恢复出的程序。真实设备测试框架未公开。", "targets": [ "firmware", "binary" ], "title": "POZZER: A Power Side Channel-guided Fuzzer for Black-Box Embedded Systems", "title_zh": "POZZER：面向黑盒嵌入式系统的功耗侧信道引导模糊测试器", "url": "https://arxiv.org/abs/2609.23583", "venue": "arXiv", "verification": "source-reviewed", "verified_at": "2026-10-20", "why_fits_en": "Provides evidence-driven behavior exploration when firmware bytes and conventional tracing are unavailable.", "why_fits_zh": "在无法取得固件字节或常规执行轨迹时，提供基于证据的行为探索方法。", "year": 2026 }, { "arxiv_id": "2610.20538", "arxiv_version_reviewed": "v1", "authors": [ "Qiushi Sun", "Jingyang Gong", "Yang Liu", "Qiaosheng Chen", "Zhangyue Yin", "Zixian Huang", "Hanxu Hu", "Jing Xiong", "Fangzhi Xu", "Haochen Tan", "Haoli Bai", "Lifeng Shang", "Xiaoguang Li", "Ben Kao", "Qipeng Guo", "Lingpeng Kong", "Jiahui Gao" ], "code_url": null, "date_basis": "First arXiv submission; no reviewed venue publication is established.", "date_basis_zh": "采用首次 arXiv 提交日期；未确立正式期刊或会议出版。", "date_precision": "day", "description_en": "Trains visual-code models using separate code and rendered-output rubrics for data filtering and reinforcement learning. Relevant evaluations include rebuilding webpages, charts and vector graphics from images.", "description_zh": "以代码与渲染结果的独立评分准则筛选数据并训练视觉代码模型，相关评测包括根据图像重建网页、图表和矢量图。", "doi": "10.48550/arxiv.2610.20538", "entry_url": "https://awesomerea.org/papers/paper-prismacoder/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-prismacoder/", "evidence_urls": [ "https://arxiv.org/abs/2610.20538v1", "https://arxiv.org/html/2610.20538v1", "https://api.datacite.org/dois/10.48550/arxiv.2610.20538", "https://qiushisun.github.io/PrismaCoder-Home/", "https://huggingface.co/collections/QiushiSun/prismacoder", "https://huggingface.co/QiushiSun/PrismaCoder-9B/tree/d5743a565f9f9b55da0798c4636059074f21602a", "https://huggingface.co/QiushiSun/PrismaCoder-35B-A3B-SFT/tree/e2df1e846cbfe5a2aebc860917b02c742007c62e" ], "first_arxiv_date": "2026-10-14", "id": "paper-prismacoder", "kind": "research", "metadata_notes": "Work in progress. DataCite confirms the DOI despite the arXiv pending label. The project code link is pending; the dataset API returned HTTP 401 anonymously. Reviewed model inventories include 9B and 35B-A3B-SFT with MIT card metadata. No weights were downloaded.", "metadata_notes_zh": "仍在进行中的工作。DataCite 已确认 DOI，arXiv 的待注册标记未同步。项目代码链接待发布，匿名数据集 API 返回 HTTP 401。已查模型文件清单包括 9B、35B-A3B-SFT，模型卡声明 MIT；未下载权重。", "pdf_url": "https://arxiv.org/pdf/2610.20538v1", "project_url": "https://qiushisun.github.io/PrismaCoder-Home/", "publication_date": "2026-10-14", "publication_status": "preprint", "runtime_tested": false, "scope_limitations_en": "Combines visual reconstruction with text-driven generation. Judge scores do not establish behavioral equivalence. Training and evaluation share some judge families; the human check uses 100 samples. Instruction n-gram filtering cannot exclude all pretraining exposure.", "scope_limitations_zh": "同时涵盖视觉重建与文本生成，裁判评分不证明行为等价。训练与评测部分共用裁判模型家族，人工检查使用 100 个样本；指令 n-gram 过滤不能排除所有预训练接触。", "targets": [ "website", "app" ], "title": "PrismaCoder: Pushing the Boundaries of Open Multimodal Code Intelligence through Decomposed Rubric Synthesis", "title_zh": "PrismaCoder：通过分解式评分准则生成提升开放多模态代码能力", "url": "https://arxiv.org/abs/2610.20538", "venue": "arXiv", "verification": "source-reviewed", "verified_at": "2026-10-20", "why_fits_en": "Provides a recent approach to reconstruction from rendered evidence.", "why_fits_zh": "补充依据渲染结果进行重建的近期方法。", "year": 2026 }, { "arxiv_id": "2605.03546", "arxiv_version_reviewed": "v1", "authors": [ "John Yang", "Kilian Lieret", "Jeffrey Ma", "Parth Thakkar", "Dmitrii Pedchenko", "Sten Sootla", "Emily McMilin", "Pengcheng Yin", "Rui Hou", "Gabriel Synnaeve", "Diyi Yang", "Ofir Press" ], "code_url": "https://github.com/facebookresearch/ProgramBench", "date_basis": "The official NeurIPS 2026 poster listing verifies conference acceptance; no proceedings publication date is asserted.", "date_basis_zh": "NeurIPS 2026 官方海报列表确认会议接收；不推定论文集的出版日期。", "date_precision": "year", "description_en": "Evaluates black-box program reconstruction across 200 tasks: agents query an executable and read its documentation, then independently implement a codebase whose behavior is checked by generated tests.", "description_zh": "通过 200 项任务评估黑盒程序重建：智能体运行可执行文件进行探测并阅读文档，再独立实现代码库，由生成的测试检查其行为。", "doi": "10.48550/arXiv.2605.03546", "entry_url": "https://awesomerea.org/papers/paper-programbench/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-programbench/", "evidence_urls": [ "https://arxiv.org/abs/2605.03546", "https://arxiv.org/html/2605.03546v1", "https://neurips.cc/virtual/2026/poster/139090", "https://neurips.cc/Downloads/2026", "https://dl4c.github.io/papers/", "https://dl4c.github.io/callforpapers/", "https://programbench.com/", "https://github.com/facebookresearch/ProgramBench/blob/895f65916bc5ba34a915d36da321fde0301125ad/README.md", "https://github.com/facebookresearch/ProgramBench/blob/895f65916bc5ba34a915d36da321fde0301125ad/docs/README.md", "https://github.com/facebookresearch/ProgramBench/blob/895f65916bc5ba34a915d36da321fde0301125ad/pyproject.toml", "https://github.com/facebookresearch/ProgramBench/blob/895f65916bc5ba34a915d36da321fde0301125ad/LICENSE", "https://huggingface.co/datasets/programbench/ProgramBench-Tests/blob/de0ddfb637590c7ecb54fa0b5301f6dc7dfbcee5/README.md" ], "first_arxiv_date": "2026-05-05", "id": "paper-programbench", "kind": "research", "metadata_notes": "NeurIPS lists a December 2026 poster; this records acceptance, not proceedings publication. The July 2026 DL4C oral was a separate non-archival workshop appearance. The DOI identifies the arXiv preprint. The pinned harness is version 1.2.5 under MIT; its generated-test dataset preserves per-task attribution and upstream license terms, including copyleft obligations for derivative portions.", "metadata_notes_zh": "NeurIPS 列出 2026 年 12 月的海报报告；本条记录接收状态，不视为论文集已出版。2026 年 7 月的 DL4C 口头报告属于另一次非存档研讨会展示。DOI 指向 arXiv 预印本。固定版本的评测程序为 1.2.5，采用 MIT 许可；生成测试数据集保留逐任务署名与上游许可条款，包括衍生部分的 copyleft 义务。", "pdf_url": "https://arxiv.org/pdf/2605.03546v1", "project_url": "https://programbench.com/", "publication_date": null, "publication_status": "conference-accepted", "runtime_tested": false, "scope_limitations_en": "Binary inspection, decompilation, and internet access are forbidden during inference. Passing finite tests does not prove complete behavioral equivalence or recovery of the original source. Later live-leaderboard runs are separate from the reviewed arXiv results.", "scope_limitations_zh": "推理阶段禁止检查二进制内容、反编译和访问互联网。通过有限测试不能证明完整行为等价或恢复了原始源码。实时榜单中的后续运行结果应与所审阅 arXiv 版本的结果区分。", "targets": [ "binary", "app" ], "title": "ProgramBench: Can Language Models Rebuild Programs From Scratch?", "title_zh": "ProgramBench：语言模型能否从零重建程序？", "url": "https://arxiv.org/abs/2605.03546", "venue": "NeurIPS 2026", "verification": "source-reviewed", "verified_at": "2026-10-16", "why_fits_en": "Provides an executable benchmark for recovering software behavior through experiments, complementing benchmarks that permit static binary analysis.", "why_fits_zh": "为通过实验恢复软件行为提供可执行基准，与允许静态二进制分析的评测互为补充。", "year": 2026 }, { "arxiv_id": "2609.18805", "arxiv_version_reviewed": "v1", "authors": [ "Jeonghye Kim", "Minseon Kim", "Young Jin Kim", "Matheus Pereira", "Marc-Alexandre Côté", "Alessandro Sordoni", "Xingdi Yuan", "Zhengyan Shi" ], "code_url": "https://huggingface.co/datasets/microsoft/ProgramDistill", "date_basis": "arXiv v1 submission history; the earlier author blog date is separate.", "date_basis_zh": "采用 arXiv v1 的首次提交日期；作者博客的较早发布日期另行区分。", "date_precision": "day", "description_en": "Evaluates recovery of web-app behavior from a live reference with hidden source. It provides 4,063 feature-restoration tasks across 26 applications and a separate 12-application reconstruction setting, scored by replaying dependent browser workflows.", "description_zh": "评测智能体从源码不可见的运行参考中恢复 Web 应用行为的能力，提供覆盖 26 个应用的 4,063 项功能恢复任务，以及独立的 12 应用重建设置，通过重放具有依赖关系的浏览器工作流评分。", "doi": "10.48550/arXiv.2609.18805", "entry_url": "https://awesomerea.org/papers/paper-programdistill/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-programdistill/", "evidence_urls": [ "https://arxiv.org/abs/2609.18805", "https://arxiv.org/html/2609.18805v1", "https://microsoft.github.io/debug-gym/blog/2026/09/programdistill/", "https://huggingface.co/datasets/microsoft/ProgramDistill/blob/dc782f7003ae00738260996d02d77920d08a5db1/README.md", "https://huggingface.co/datasets/microsoft/ProgramDistill/blob/dc782f7003ae00738260996d02d77920d08a5db1/tasks/full-reconstruction/README.md", "https://huggingface.co/datasets/microsoft/ProgramDistill/blob/dc782f7003ae00738260996d02d77920d08a5db1/tasks/full-reconstruction/baserow_baserow/tests/scorer/trace_schema.py", "https://huggingface.co/datasets/microsoft/ProgramDistill/blob/dc782f7003ae00738260996d02d77920d08a5db1/tasks/full-reconstruction/baserow_baserow/tests/scorer/trace_replay_validator.py", "https://api.datacite.org/dois/10.48550/arXiv.2609.18805", "https://openreview.net/forum?id=FbKJFN0R5L", "https://github.com/iab-agents/iab-agents.github.io/blob/0437015a568d8d541e277833c68ffd213b117c53/src/App.jsx", "https://github.com/iab-agents/iab-agents.github.io/blob/0437015a568d8d541e277833c68ffd213b117c53/src/data/siteData.js" ], "first_arxiv_date": "2026-09-16", "id": "paper-programdistill", "kind": "research", "metadata_notes": "The DOI resolves and DataCite records registration on 2026-09-17, despite arXiv’s stale pending banner. Separately, the paper was accepted to the non-archival Workshop on Interpreting Agent Behavior (IAB) at NeurIPS 2026, scheduled for December 12, 2026; its OpenReview record was published on 2026-10-04. That record and the workshop listing put Xingdi Yuan before Alessandro Sordoni; the authors here follow arXiv v1. The public release contains executable benchmark packages, not the mining, task-generation or orchestration pipeline. ProgramDistill-authored artifacts declare MIT; included applications and assets retain upstream terms. The paper and later packaged release are distinguished; no experiments were reproduced.", "metadata_notes_zh": "DOI 已可解析，DataCite 记载其于 2026-09-17 注册，尽管 arXiv 仍显示过时的待注册提示。此外，该论文已被 NeurIPS 2026 的 Interpreting Agent Behavior（IAB）非存档研讨会接收，研讨会定于 2026 年 12 月 12 日举行；其 OpenReview 记录于 2026-10-04 发布。该记录与研讨会论文列表将 Xingdi Yuan 排在 Alessandro Sordoni 之前，本条目作者顺序以 arXiv v1 为准。公开版本包含可执行基准任务包，但不包含行为挖掘、任务生成或编排流水线。ProgramDistill 自有产物声明 MIT 许可，所含应用与资源仍适用上游条款。论文与后续任务包发布分开记录，本次未复现实验。", "pdf_url": "https://arxiv.org/pdf/2609.18805v1", "project_url": "https://microsoft.github.io/debug-gym/blog/2026/09/programdistill/", "publication_date": "2026-09-16", "publication_status": "preprint", "runtime_tested": false, "scope_limitations_en": "Tests cover finite, model-mined behaviors in self-contained apps, including SaaS clones. Persistence failures can be detected through replayed workflows, but passing does not establish all backend or database invariants. Evaluated agents receive structured browser observations without screenshots; visual fidelity is not measured. Public verifiers and reference solutions are not a contamination-resistant test set.", "scope_limitations_zh": "测试限于自包含应用（包括 SaaS 克隆）中由模型挖掘的有限行为。重放工作流可发现持久化失败，但通过测试不能证明全部后端或数据库不变量成立。被评测智能体接收不含截图的结构化浏览器观察，未衡量视觉保真度。公开验证器与参考解答也不构成抗污染测试集。", "targets": [ "website" ], "title": "ProgramDistill: From Interactive Web Apps to Verifiable Reference-Guided SWE Tasks", "title_zh": "ProgramDistill：将交互式 Web 应用转化为可验证的参考驱动软件工程任务", "url": "https://arxiv.org/abs/2609.18805", "venue": "arXiv", "verification": "source-reviewed", "verified_at": "2026-10-17", "why_fits_en": "Directly studies reference-guided behavioral reconstruction beyond screenshot-to-HTML, including dependent state changes and fresh verification of submitted implementations.", "why_fits_zh": "直接研究超越截图到 HTML 的参考驱动行为重建，涵盖有依赖关系的状态变化，并在全新验证环境中检查提交的实现。", "year": 2026 }, { "arxiv_id": null, "arxiv_version_reviewed": null, "authors": [ "Paolo Milani Comparetti", "Gilbert Wondracek", "Christopher Kruegel", "Engin Kirda" ], "code_url": null, "date_basis": "IEEE’s Crossref deposit and an archived copy of the IEEE Xplore page give May 2009, represented at month precision. The symposium dates are not substituted for a publication day.", "date_basis_zh": "IEEE 提交的 Crossref 元数据及 IEEE Xplore 页面存档副本均给出 2009 年 5 月，本条目按月精度记录，不以研讨会日期替代具体出版日。", "date_precision": "month", "description_en": "Prospex infers message formats and a protocol state machine from execution traces of a Linux server handling client sessions. Dynamic taint analysis splits each session into messages and recovers their formats; messages are then clustered into types by input-format, execution and server-impact similarity, such as the system calls, outputs and file paths a message triggers. The observed type sequences form an augmented prefix tree acceptor, which prerequisite and end-state heuristics label before Exbar computes a minimal consistent automaton. The resulting specifications are translated for the Peach fuzzer to reach later protocol states. The evaluation covers the Agobot command-and-control protocol, SMTP on Sendmail, SMB on Samba and SIP on Asterisk.", "description_zh": "Prospex 从 Linux 服务端处理客户端会话时的执行轨迹推断报文格式与协议状态机。它利用动态污点分析把每个会话切分为报文并恢复其格式；再依据输入格式、执行过程及对服务端影响（如报文触发的系统调用、输出与文件路径）的相似度将报文聚类为不同类型。观察到的类型序列构成增广前缀树接受器，先由前置条件与结束状态启发式标注，再用 Exbar 求出一致的最小自动机。所得规范被转换供 Peach 模糊测试器使用，以到达协议的后续状态。评测覆盖 Agobot 命令与控制协议、Sendmail 上的 SMTP、Samba 上的 SMB 以及 Asterisk 上的 SIP。", "doi": "10.1109/SP.2009.14", "entry_url": "https://awesomerea.org/papers/paper-prospex/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-prospex/", "evidence_urls": [ "https://ieeexplore.ieee.org/document/5207640", "https://web.archive.org/web/20251007214632/https://ieeexplore.ieee.org/document/5207640/", "https://api.crossref.org/works/10.1109/SP.2009.14", "https://sites.cs.ucsb.edu/~chris/research/doc/oakland09_prospex.pdf" ], "first_arxiv_date": null, "id": "paper-prospex", "kind": "research", "metadata_notes": "Crossref and the archived IEEE Xplore page agree on the four authors, the 2009 30th IEEE Symposium on Security and Privacy proceedings, pages 110–125 and May 2009; Xplore does not mark the paper open access. The PDF is the 16-page copy on Christopher Kruegel’s UCSB site, with the same title and author order; its file metadata shows a September 2008 creation date and a 2009 IEEE PDF eXpress certification, and IEEE Xplore holds the version of record. The paper reports that its Peach statefulness extensions were integrated into Peach release 2.2 but links no Prospex code, traces or reference state machines. No code or experiments were run.", "metadata_notes_zh": "Crossref 与 IEEE Xplore 页面存档在四位作者、2009 年第 30 届 IEEE 安全与隐私研讨会论文集、第 110–125 页及 2009 年 5 月等信息上一致；Xplore 未将该论文标为开放获取。PDF 为 Christopher Kruegel 在 UCSB 网站上提供的 16 页副本，标题与作者顺序相同；其文件元数据显示创建于 2008 年 9 月，并带有 2009 年的 IEEE PDF eXpress 认证信息，版本记录以 IEEE Xplore 为准。论文称其为 Peach 增加的状态支持已并入 Peach 2.2 版，但未链接 Prospex 代码、轨迹或参考状态机。本次未运行代码或实验。", "pdf_url": "https://sites.cs.ucsb.edu/~chris/research/doc/oakland09_prospex.pdf", "project_url": null, "publication_date": "2009-05", "publication_status": "conference-paper", "runtime_tested": false, "scope_limitations_en": "Prospex traces one endpoint, the server, and its taint tool runs only on Linux, so only Linux server binaries were analyzed. It cannot handle encrypted traffic: TLS sessions made up the 6.5% of 31,903 Postfix sessions that the inferred SMTP specification could not parse. Training sets are small (for example 16 SMTP and 31 SMB sessions), and the inferred machines cover only behavior exercised during training; two SMB states are artifacts of limited training variety, and SMB recall against the reference automaton is 0.58. Reference state machines were built manually by the authors, and soundness was checked with 50,000 random walks per protocol; the sk-strings and beams baselines are state-machine learners, not full protocol reverse-engineering systems. The fuzzing case studies found previously known issues in an older Samba release and in Asterisk, not new vulnerabilities in the latest Samba or Windows XP SMB versions tested.", "scope_limitations_zh": "Prospex 只跟踪服务端一侧，其污点工具仅在 Linux 上运行，因此只分析了 Linux 服务端二进制。它无法处理加密流量：在 31,903 个 Postfix 会话中，推断的 SMTP 规范无法解析的 6.5% 均为 TLS 会话。训练集规模较小（例如 16 个 SMTP 会话、31 个 SMB 会话），推断出的状态机只覆盖训练中出现过的行为；两个 SMB 状态是训练数据多样性不足造成的伪状态，SMB 相对参考自动机的召回率为 0.58。参考状态机由作者手工构建，可靠性检验对每种协议进行 50,000 次随机游走；sk-strings 与 beams 基线是状态机学习算法，并非完整的协议逆向系统。模糊测试案例发现的是旧版 Samba 与 Asterisk 中已知的问题，而非所测最新 Samba 或 Windows XP SMB 实现中的新漏洞。", "targets": [ "protocol" ], "title": "Prospex: Protocol Specification Extraction", "title_zh": "Prospex：协议规范提取", "url": "https://ieeexplore.ieee.org/document/5207640", "venue": "IEEE S&P 2009", "verification": "source-reviewed", "verified_at": "2026-10-19", "why_fits_en": "Adds an execution-based method that extracts both message formats and protocol state machines from observed sessions, complementing the collection’s active state-machine learning and format-only protocol inference research.", "why_fits_zh": "补充一种基于执行、可从观察到的会话中同时提取报文格式与协议状态机的方法，与合集中的主动状态机学习及仅推断格式的协议研究互补。", "year": 2009 }, { "arxiv_id": "2608.16403", "arxiv_version_reviewed": "v2", "authors": [ "Chuan Sheng", "Shan Jiang", "Jianming Zhao", "Yu Yao" ], "code_url": null, "date_basis": "The official CCS 2026 accepted-paper list and arXiv v2 establish acceptance; a publication date was not verified.", "date_basis_zh": "CCS 2026 官方录用名单与 arXiv v2 确认录用；未核实正式出版日期。", "date_precision": "year", "description_en": "PVParser recovers process-variable layouts from industrial traffic and historian records. Periodic-pattern detection locates relevant payloads; a modified Monte Carlo tree search proposes field boundaries, types and endianness, then aligns decoded sequences with observed process variables.", "description_zh": "PVParser 根据工业流量与历史过程记录恢复过程变量布局：周期模式检测定位相关载荷，改进的蒙特卡洛树搜索推断字段边界、类型和字节序，再将解码序列与已观察的过程变量对齐。", "doi": null, "entry_url": "https://awesomerea.org/papers/paper-pvparser/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-pvparser/", "evidence_urls": [ "https://arxiv.org/abs/2608.16403v2", "https://arxiv.org/html/2608.16403v2", "https://www.sigsac.org/ccs/CCS2026/program/accepted-papers.html" ], "first_arxiv_date": "2026-08-17", "id": "paper-pvparser", "kind": "research", "metadata_notes": "ArXiv v2 and the CCS 2026 accepted list name four authors; v1 listed eight. The author-supplied DOI 10.1145/3830454.3846584 did not resolve at review, and no publication date or proceedings container was verified. The anonymous review-artifact implementation and license were not inspected.", "metadata_notes_zh": "arXiv v2 与 CCS 2026 录用名单均列四位作者，v1 则列八位。作者提供的 DOI 10.1145/3830454.3846584 在复核时未解析成功，正式出版日期及论文集信息尚未核实；匿名评审产物的实现与许可也未检查。", "pdf_url": "https://arxiv.org/pdf/2608.16403v2", "project_url": null, "publication_date": null, "publication_status": "conference-accepted", "runtime_tested": false, "scope_limitations_en": "Payload localization uses SCADA-N, SWaT and WADI; field/semantic recovery uses SWaT and WADI. Recovery depends on traffic and historian observations plus recurrent, stable plaintext byte layouts. Encrypted traffic, bit-level buses and event-driven messages whose PV lists vary are outside scope. It complements protocol dissectors; results were not independently reproduced.", "scope_limitations_zh": "载荷定位评测采用 SCADA-N、SWaT 与 WADI；字段及语义恢复评测采用 SWaT 与 WADI。恢复依赖流量和历史记录，以及重复出现、布局稳定的明文字节载荷；加密流量、位级总线及变量列表动态变化的事件消息不在范围内。该方法补充协议解析器，本次未独立复现实验。", "targets": [ "protocol" ], "title": "Recovering Process Variables from Industrial Network Traffic via Search-Based Optimization", "title_zh": "基于搜索优化从工业网络流量恢复过程变量", "url": "https://arxiv.org/abs/2608.16403", "venue": "CCS 2026", "verification": "source-reviewed", "verified_at": "2026-10-20", "why_fits_en": "Infers deployment-specific message fields and semantics from observed communication instead of supplied format specifications.", "why_fits_zh": "从通信观测中推断部署相关的消息字段和语义，而非依赖既有格式说明。", "year": 2026 }, { "arxiv_id": "2606.06838", "arxiv_version_reviewed": "v1", "authors": [ "Neil Archibald", "Ruben Thijssen" ], "code_url": null, "date_basis": "arXiv v1 submission date.", "date_basis_zh": "arXiv v1 首次提交日期。", "date_precision": "day", "description_en": "Uses a composite Quantitative Readability Score (QRS) to guide agents refining decompiled C. Lexical familiarity, structural simplicity and coding idioms are combined with a binary-structure similarity gate. Experiments compare refinement with and without shell access on 210 simple C binaries.", "description_zh": "用综合量化可读性分数（QRS）引导智能体改进反编译 C 代码，将词汇熟悉度、结构简洁度和编程惯用法与二进制结构相似性门槛结合，在 210 个简单 C 二进制程序上比较有无 shell 访问的迭代。", "doi": null, "entry_url": "https://awesomerea.org/papers/paper-qrs-readability/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-qrs-readability/", "evidence_urls": [ "https://arxiv.org/abs/2606.06838v1", "https://arxiv.org/html/2606.06838v1" ], "first_arxiv_date": "2026-06-05", "id": "paper-qrs-readability", "kind": "research", "metadata_notes": "Reviewed the v1 abstract and full HTML. No implementation artifact identified; experiments were not rerun.", "metadata_notes_zh": "审阅了 v1 摘要与完整 HTML；未确认实现产物，也未复现实验。", "pdf_url": "https://arxiv.org/pdf/2606.06838v1", "project_url": null, "publication_date": "2026-06-05", "publication_status": "preprint", "runtime_tested": false, "scope_limitations_en": "Structural similarity does not prove semantic equivalence. QRS both guides and evaluates refinement; human readability validation remains future work. The selected synthetic corpus limits generalization. Recovering compilable, behaviorally correct code from difficult binaries is outside the claimed contribution.", "scope_limitations_zh": "结构相似性不能证明语义等价。QRS 同时用于指导和评价改进，仍缺少人工可读性验证；经过筛选的合成语料限制了泛化。处理困难二进制并恢复可编译、行为正确代码，不属于本文的贡献范围。", "targets": [ "binary" ], "title": "LLM Agent-Assisted Reverse Engineering with Quantitative Readability Metrics", "title_zh": "以量化可读性指标引导 LLM 智能体辅助逆向工程", "url": "https://arxiv.org/abs/2606.06838", "venue": "arXiv", "verification": "source-reviewed", "verified_at": "2026-10-19", "why_fits_en": "Connects agent feedback design with the readability of recovered code.", "why_fits_zh": "把智能体反馈机制与恢复代码的可读性联系起来。", "year": 2026 }, { "arxiv_id": "2610.05012", "arxiv_version_reviewed": "v1", "authors": [ "Pingchuan Ma", "Zhantong Xue", "Zongjie Li", "Qixin Zhang", "Yuxuan Du", "Zhaoyu Wang", "Yuguang Zhou", "Shuai Wang", "Xiaoqin Zhang" ], "code_url": null, "date_basis": "First arXiv submission; no formal proceedings publication was verified.", "date_basis_zh": "采用首次 arXiv 提交日期，未核实正式会议录出版。", "date_precision": "day", "description_en": "Quelle recovers library calls, loops, functions and symbolic parameters from compiled OpenQASM. It removes routing artifacts, proposes structured reconstructions and checks them against circuit semantics, retaining gate-level fallbacks when recovery fails.", "description_zh": "Quelle 从编译后的 OpenQASM 恢复库调用、循环、函数及符号参数，通过消除路由痕迹、提出结构化重建并核对电路语义，在恢复失败时保留门级表示。", "doi": "10.48550/arxiv.2610.05012", "entry_url": "https://awesomerea.org/papers/paper-quelle/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-quelle/", "evidence_urls": [ "https://arxiv.org/abs/2610.05012v1", "https://arxiv.org/html/2610.05012v1", "https://api.datacite.org/dois/10.48550/arxiv.2610.05012" ], "first_arxiv_date": "2026-10-04", "id": "paper-quelle", "kind": "research", "metadata_notes": "Reviewed October 4 v1 and DataCite identity. The article is CC BY 4.0. No dedicated author-linked implementation or artifact release was verified from the manuscript and targeted searches; this does not establish software licensing. No circuit, checker or model was run.", "metadata_notes_zh": "已复核 10 月 4 日 v1 与 DataCite 身份，文章采用 CC BY 4.0。手稿及定向检索中未核实作者关联的专用实现或产物发布，不能由此推定软件许可。本次未运行电路、检查器或模型。", "pdf_url": "https://arxiv.org/pdf/2610.05012v1", "project_url": null, "publication_date": "2026-10-04", "publication_status": "preprint", "runtime_tested": false, "scope_limitations_en": "Scope is quantum circuits with ideal-device semantics, not original-source identity. Dense checks use a 1e-6 tolerance; larger circuits additionally trust rewrite bookkeeping, an unchecked wide H-conjugation identity and QCEC. Dynamic circuits and timed-out checks remain unverified. Algorithm naming needs templates, and deliberate obfuscation is outside the evaluated scope.", "scope_limitations_zh": "范围限于理想设备语义下的量子电路，不保证恢复原作者源码。稠密检查采用 1e-6 容差，大电路还依赖可信重写记录、未检查的宽区域 H 共轭恒等式及 QCEC；动态电路及超时检查保持未验证。算法命名需要模板，刻意混淆不在评估范围内。", "targets": [ "binary" ], "title": "Decompiling Quantum Assembly into Structured Programs", "title_zh": "将量子汇编反编译为结构化程序", "url": "https://arxiv.org/abs/2610.05012", "venue": "arXiv", "verification": "source-reviewed", "verified_at": "2026-10-20", "why_fits_en": "Adds compiler-output structure recovery with explicit correctness-check boundaries in quantum software.", "why_fits_zh": "补充量子软件编译产物的结构恢复方法，并明确正确性检查的边界。", "year": 2026 }, { "arxiv_id": null, "arxiv_version_reviewed": null, "authors": [ "Ruoyu Wang", "Yan Shoshitaishvili", "Antonio Bianchi", "Aravind Machiry", "John Grosen", "Paul Grosen", "Christopher Kruegel", "Giovanni Vigna" ], "code_url": null, "date_basis": "Internet Society-deposited Crossref metadata supplies only publication year 2017; the publisher PDF separately identifies the 26 February–1 March 2017 symposium, which is not used to assert a publication month or day.", "date_basis_zh": "Internet Society 向 Crossref 提交的元数据仅给出出版年份 2017；出版方 PDF 另列研讨会日期为 2017 年 2 月 26 日至 3 月 1 日，本条目不据此推定出版月份或日期。", "date_precision": "year", "description_en": "Ramblr produces reassembleable disassembly: assembly recovered from a stripped binary that can be edited and assembled again with an off-the-shelf assembler. Starting from angr's CFG recovery, it classifies the contents of data regions, then decides which immediates and data values are references to code or data that must become symbols. Base-pointer reattribution handles compiler-optimized references that point outside their target object, and sanity checks let Ramblr refuse to reassemble a binary it cannot handle safely, such as one that encrypts pointers. The authors evaluate 106 GNU Coreutils programs for x86 and x86-64 and 143 DARPA Cyber Grand Challenge binaries at six optimization levels. They report that Uroboros broke 22.64% of 32-bit Coreutils binaries at -O0 and 56.61% at -O1, while Ramblr broke none, and that Ramblr reassembled over 98% of CGC binaries at every level.", "description_zh": "Ramblr 生成可重汇编的反汇编结果，即从去除符号的二进制中恢复出、可以修改并用现成汇编器重新汇编的汇编代码。它以 angr 的控制流图恢复为基础，对数据区内容进行分类，再判断哪些立即数和数据值是对代码或数据的引用、必须转换为符号。基址指针重归属用于处理经编译器优化后指向目标对象之外的引用；健全性检查则使 Ramblr 能够拒绝重汇编无法安全处理的二进制，例如对指针进行加密的程序。作者在为 x86 与 x86-64 编译的 106 个 GNU Coreutils 程序，以及 143 个 DARPA 网络超级挑战赛（CGC）二进制上，按六种优化级别进行评测。他们报告，Uroboros 会破坏 22.64% 的 -O0 及 56.61% 的 -O1 32 位 Coreutils 二进制，而 Ramblr 一个也未破坏；在 CGC 二进制上，Ramblr 在每种优化级别下的重汇编成功率均超过 98%。", "doi": "10.14722/ndss.2017.23225", "entry_url": "https://awesomerea.org/papers/paper-ramblr/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-ramblr/", "evidence_urls": [ "https://www.ndss-symposium.org/ndss2017/ndss-2017-programme/ramblr-making-reassembly-great-again/", "https://api.crossref.org/works/10.14722/ndss.2017.23225", "https://www.ndss-symposium.org/wp-content/uploads/2017/09/ndss2017_10-5_Wang_paper_0.pdf", "https://github.com/angr/angr/blob/ae9f5786fd94410ca400063bf21719aa8b564d3e/angr/analyses/reassembler.py" ], "first_arxiv_date": null, "id": "paper-ramblr", "kind": "research", "metadata_notes": "Crossref gives the title, the eight-author order and year 2017 with no pages; the DOI resolves to the NDSS programme page, which links the 15-page PDF and slides. The PDF footer identifies NDSS ’17, 26 February–1 March 2017, San Diego. The paper says the entire Ramblr toolchain is open source, with Ramblr included in angr as a Python analysis and other parts in the Patcherex binary-patching platform, but it gives no repository URL, version or commit. angr currently ships a Reassembler analysis (reviewed at commit ae9f578), but that source never names Ramblr or the paper, so neither angr nor Patcherex is recorded as the paper’s code_url. The evaluation ran under PyPy 5.3.1 on Ubuntu Server 16.04. Nothing was installed or run.", "metadata_notes_zh": "Crossref 给出标题、八位作者顺序及年份 2017，未列页码；DOI 解析至 NDSS 会议议程页面，该页面链接 15 页 PDF 与幻灯片。PDF 页脚标明 NDSS ’17 于 2017 年 2 月 26 日至 3 月 1 日在圣迭戈举行。论文称整个 Ramblr 工具链均已开源，Ramblr 以 Python 分析模块的形式包含在 angr 中，其余部分包含在二进制修补平台 Patcherex 中，但未给出仓库地址、版本或提交。angr 目前提供一个 Reassembler 分析（审阅于提交 ae9f578），但其源码从未提及 Ramblr 或该论文，因此 angr 与 Patcherex 均未被记为论文的 code_url。评测在 Ubuntu Server 16.04 上的 PyPy 5.3.1 中进行。本次未安装或运行任何内容。", "pdf_url": "https://www.ndss-symposium.org/wp-content/uploads/2017/09/ndss2017_10-5_Wang_paper_0.pdf", "project_url": null, "publication_date": null, "publication_status": "conference-paper", "runtime_tested": false, "scope_limitations_en": "The prototype handles x86 and x86-64 ELF binaries produced by GCC or Clang, whose code regions contain no inline data; binaries from compilers such as MSVC, which place jump tables inline, need further work. The authors stress that static content classification is infeasible in general: Ramblr is an empirical approach that is likely to fail if, for example, a binary is linked at a base address chosen so its addresses collide with ordinary constants. The Uroboros comparison covers only 32-bit binaries and, on Coreutils, only -O0 and -O1, because Uroboros failed on 64-bit inputs and its failure rate above -O1 was not meaningful. Correctness is measured by symbolization against linker ground truth and by each program's test cases, which do not prove full equivalence. Results are from 2017 versions of angr and the evaluated toolchains.", "scope_limitations_zh": "原型适用于由 GCC 或 Clang 生成的 x86 与 x86-64 ELF 二进制，这类二进制的代码区不含内联数据；MSVC 等编译器会把跳转表放在代码中，处理其生成的二进制仍需进一步工作。作者强调静态内容分类在一般情况下不可行：Ramblr 是一种经验性方法，例如当二进制被链接到特定基址、使其地址与普通常量冲突时，很可能失败。与 Uroboros 的比较只覆盖 32 位二进制，在 Coreutils 上也只比较 -O0 与 -O1，因为 Uroboros 无法处理 64 位输入，且在高于 -O1 时的失败率已无比较意义。正确性依据相对链接器真实信息的符号化结果以及各程序的测试用例衡量，不能证明完全等价。这些结果基于 2017 年时的 angr 及所评测的工具链。", "targets": [ "binary" ], "title": "Ramblr: Making Reassembly Great Again", "title_zh": "Ramblr：让二进制重汇编重新可行", "url": "https://www.ndss-symposium.org/ndss2017/ndss-2017-programme/ramblr-making-reassembly-great-again/", "venue": "NDSS 2017", "verification": "source-reviewed", "verified_at": "2026-10-19", "why_fits_en": "Adds reassembleable disassembly, the basis of static binary rewriting that emits modifiable assembly instead of patching bytes, alongside the collection's decompilation and binary-recovery research.", "why_fits_zh": "补充可重汇编反汇编研究，这是一种输出可修改汇编代码而非直接修补字节的静态二进制改写基础技术，与合集中的反编译及二进制恢复研究并列。", "year": 2017 }, { "arxiv_id": "1802.02312", "arxiv_version_reviewed": "v2", "authors": [ "Kevin Moran", "Carlos Bernal-Cárdenas", "Michael Curcio", "Richard Bonett", "Denys Poshyvanyk" ], "citation": { "container_title": "IEEE Transactions on Software Engineering", "issue": "2", "pages": "196-221", "publisher": "Institute of Electrical and Electronics Engineers (IEEE)", "sources": [ "https://api.crossref.org/works/10.1109/TSE.2018.2844788" ], "volume": "46" }, "code_url": null, "date_basis": "Publisher-deposited print issue date in Crossref (2020-02-01), represented at month precision.", "date_basis_zh": "出版方向 Crossref 登记的纸本刊期日期为 2020-02-01，本目录采用月份精度。", "date_precision": "month", "description_en": "ReDraw turns screenshots or design mock-ups into native Android GUI prototypes by detecting components, classifying widget types with a CNN, and assembling a plausible view hierarchy with a data-driven nearest-neighbor method.", "description_zh": "ReDraw 通过组件检测、CNN 控件类型分类及数据驱动的近邻层级组装，将截图或设计稿转换为原生 Android 图形界面原型。", "doi": "10.1109/TSE.2018.2844788", "entry_url": "https://awesomerea.org/papers/paper-redraw/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-redraw/", "evidence_urls": [ "https://api.crossref.org/works/10.1109/TSE.2018.2844788", "https://ieeexplore.ieee.org/document/8374985", "https://arxiv.org/abs/1802.02312", "https://arxiv.org/html/1802.02312v2", "https://www.cs.wm.edu/~denys/pubs/TSE%2718-ReDraw.pdf", "https://www.android-dev-tools.com/redraw", "https://2018.fseconference.org/details/fse-2018-Journal-First/3/Machine-Learning-Based-Prototyping-of-Graphical-User-Interfaces-for-Mobile-Apps", "https://zenodo.org/records/2530277", "https://zenodo.org/api/records/2530277" ], "first_arxiv_date": "2018-02-07", "id": "paper-redraw", "kind": "research", "metadata_notes": "IEEE TSE 46(2), pages 196–221, February 2020. The author-hosted accepted manuscript and arXiv v2 are dated 2018; ESEC/FSE 2018 was a journal-first presentation, not the journal publication. Crossref creation on 2018-06-07 is a deposit date, not an independently verified online publication date. The author project page describes a rewritten implementation as forthcoming in Winter 2020; no original code repository was verified. The separately archived ReDraw dataset is dated 2019-01-02 (Zenodo 2530277).", "metadata_notes_zh": "发表于 IEEE TSE 第 46 卷第 2 期，196–221 页，刊期为 2020 年 2 月。作者托管的接收稿及 arXiv v2 为 2018 年版本；ESEC/FSE 2018 是期刊优先展示，不是该期刊论文的出版时间。Crossref 的 2018-06-07 创建日期为元数据登记日期，并非已独立核实的在线出版日期。作者项目页仍说明重写实现计划于 2020 年冬季发布；未核实原始代码仓库。单独归档的 ReDraw 数据集日期为 2019-01-02（Zenodo 2530277）。", "pdf_url": "https://arxiv.org/pdf/1802.02312v2", "project_url": "https://www.android-dev-tools.com/redraw", "publication_date": "2020-02", "publication_status": "journal-article", "runtime_tested": false, "scope_limitations_en": "The implementation covers 15 Android component classes and one screen at a time; multiple screens require manual combination, and hierarchy construction is tied to the mined screen size. Evaluation concerns appearance and view hierarchy, not recovery of original app logic or backends. Screenshots and reconstructed mock-ups served as proxies for real design artifacts; results were not independently reproduced here.", "scope_limitations_zh": "实现覆盖 15 类 Android 组件，每次生成单个屏幕；多屏需要人工组合，层级构建受采集时屏幕尺寸约束。评估关注外观和视图层级，不代表恢复原始应用逻辑或后端。实验以截图和重新制作的设计稿代替真实设计产物；本目录未独立复现实验。", "targets": [ "app" ], "title": "Machine Learning-Based Prototyping of Graphical User Interfaces for Mobile Apps", "title_zh": "基于机器学习的移动应用图形用户界面原型生成", "url": "https://doi.org/10.1109/TSE.2018.2844788", "venue": "IEEE Transactions on Software Engineering", "verification": "source-reviewed", "verified_at": "2026-10-16", "why_fits_en": "Adds a data-driven foundation for recovering native widget types and plausible structure from pixels, complementing the existing REMAUI entry.", "why_fits_zh": "补充从像素恢复原生控件类型及合理界面结构的数据驱动基础方法，与现有 REMAUI 条目互补。", "year": 2020 }, { "arxiv_id": null, "arxiv_version_reviewed": null, "authors": [ "Andrew Fasano", "Tiemoko Ballo", "Marius Muench", "Tim Leek", "Alexander Bulekov", "Brendan Dolan-Gavitt", "Manuel Egele", "Aurélien Francillon", "Long Lu", "Nick Gregory", "Davide Balzarotti", "William Robertson" ], "code_url": "https://github.com/rehosting/rehosting_sok", "date_basis": "ACM-deposited Crossref print-publication date; the online-publication date is recorded separately in metadata notes. The June 7–11 conference dates are not used.", "date_basis_zh": "采用 ACM 在 Crossref 登记的印刷出版日期；在线出版日期在元数据说明中单独记录。本条目不采用 6 月 7—11 日的会议日期。", "date_precision": "day", "description_en": "Systematizes rehosting: moving embedded firmware from its physical hardware into a virtual environment that models enough hardware behavior for dynamic analysis such as fuzzing and symbolic execution. The authors measure why whole-system emulation does not scale using 2,574 hardware configurations, 1,956 device tree blobs from Linux 5.11.4 and 618 vendor ARM Cortex SVD files. They compare corpus CPU models with QEMU support, count unique peripherals, use driver source lines as a complexity proxy, and run a Monte Carlo simulation of adding peripheral models SoC by SoC. Supporting a random 10% of the SoCs would need about 3,947 peripherals for the Linux corpus and 1,730 for the ARM Cortex corpus, against 1,083 implemented in QEMU 5.2. The paper then classifies prior systems by how they emulate, replace, symbolically model, pass through to hardware or leave each layer unmodified, describes an iterative rehosting process with fidelity evaluation, and sets out open problems.", "description_zh": "系统化梳理“重托管”：把嵌入式固件从实体硬件迁移到虚拟环境中，该环境对硬件行为的建模足以支持模糊测试、符号执行等动态分析。作者以 2,574 个硬件配置衡量全系统仿真为何难以扩展，包括来自 Linux 5.11.4 的 1,956 个设备树二进制文件（DTB）和 618 个厂商提供的 ARM Cortex SVD 文件。他们将语料中的 CPU 型号与 QEMU 的支持情况对比，统计不同外设的数量，以驱动源码行数作为复杂度的近似指标，并以蒙特卡罗模拟逐个 SoC 添加外设模型。若要支持随机抽取的 10% SoC，Linux 语料约需 3,947 种外设，ARM Cortex 语料约需 1,730 种，而 QEMU 5.2 实现的外设为 1,083 种。论文随后按各系统在每一层采用仿真、替换、符号建模、透传至硬件或保持不变的方式对既有工作分类，描述含保真度评估的迭代式重托管流程，并列出开放问题。", "doi": "10.1145/3433210.3453093", "entry_url": "https://awesomerea.org/papers/paper-rehosting-sok/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-rehosting-sok/", "evidence_urls": [ "https://dl.acm.org/doi/10.1145/3433210.3453093", "https://api.crossref.org/works/10.1145/3433210.3453093", "https://web.archive.org/web/20250427221838/https://dl.acm.org/doi/pdf/10.1145/3433210.3453093", "https://github.com/rehosting/rehosting_sok/blob/499b625c8aa60020f311df97a6253820982f20d4/README.md", "https://github.com/rehosting/rehosting_sok/blob/499b625c8aa60020f311df97a6253820982f20d4/LICENSE", "https://github.com/rehosting/rehosting_sok/blob/499b625c8aa60020f311df97a6253820982f20d4/Dockerfile" ], "first_arxiv_date": null, "id": "paper-rehosting-sok", "kind": "research", "metadata_notes": "ACM metadata records print publication on 2021-05-24 and online publication on 2021-06-04, pages 687–701, with the twelve-author order shown here. The paper is published under CC BY 4.0. dl.acm.org refused automated requests during this review, so the 15-page ACM PDF was read from a Wayback Machine capture of its own URL. Footnote 3 links igloo-re/rehosting_sok, which now redirects to rehosting/rehosting_sok. The reviewed 2021-06-08 commit is MIT-licensed and builds an Ubuntu 20.04 Docker image with QEMU 5.2.0, generates the 1,956 DTBs and prints the data behind Tables 1–3 and the Monte Carlo results. Its SVD analysis clones the current posborne/cmsis-svd repository, and the README warns that results change slightly as that repository grows. The repository reproduces these measurements; it is not a rehosting tool. Nothing was built or run.", "metadata_notes_zh": "ACM 元数据记载印刷出版于 2021-05-24，在线出版于 2021-06-04，页码为 687–701，十二位作者顺序如本条目所列。论文以 CC BY 4.0 许可发布。审阅期间 dl.acm.org 拒绝自动请求，因此 15 页 ACM PDF 依据 Wayback Machine 对其原地址的存档副本阅读。脚注 3 链接 igloo-re/rehosting_sok，现已重定向至 rehosting/rehosting_sok。所审阅的 2021-06-08 提交采用 MIT 许可，构建基于 Ubuntu 20.04、含 QEMU 5.2.0 的 Docker 镜像，生成 1,956 个 DTB，并输出表 1–3 与蒙特卡罗模拟结果所依据的数据。其 SVD 分析会克隆最新的 posborne/cmsis-svd 仓库，README 提醒结果会随该仓库更新而略有变化。该仓库用于复现上述测量，并非重托管工具。本次未构建或运行任何内容。", "pdf_url": "https://dl.acm.org/doi/pdf/10.1145/3433210.3453093", "project_url": null, "publication_date": "2021-05-24", "publication_status": "conference-paper", "runtime_tested": false, "scope_limitations_en": "This is a systematization with a measurement study, not a new rehosting tool. The measurements use hardware descriptions rather than firmware images: device trees cover Linux-based (Type-1) systems and SVD files cover only ARM Cortex hardware, and only architectures or vendors with ten or more samples are counted. Driver source lines are an explicitly rough proxy for the effort of modeling a peripheral, and closed-source drivers are assigned an architecture average. The conclusion that manually written hardware emulators will not scale rests on these proxies and on QEMU 5.2 and OVPsim as of early 2021. The authors note that rehosting fidelity lacks a formal definition and that no large-scale fidelity evaluations exist, so the taxonomy compares approaches qualitatively; a concurrent survey covers fidelity in more detail.", "scope_limitations_zh": "这是一项结合测量研究的系统化综述，并非新的重托管工具。测量基于硬件描述而非固件镜像：设备树覆盖基于 Linux 的（Type-1）系统，SVD 文件只涵盖 ARM Cortex 硬件，且只统计样本数不少于十个的架构或厂商。驱动源码行数被明确作为外设建模工作量的粗略近似，闭源驱动则按所属架构的平均值计。“手工编写的硬件仿真器难以扩展”这一结论依赖于这些近似指标以及 2021 年初的 QEMU 5.2 与 OVPsim。作者指出，重托管保真度缺乏正式定义，也没有大规模保真度评估，因此分类法只对各方法作定性比较；同期的另一篇综述对保真度有更详细的讨论。", "targets": [ "firmware" ], "title": "SoK: Enabling Security Analyses of Embedded Systems via Rehosting", "title_zh": "SoK：通过重托管实现嵌入式系统的安全分析", "url": "https://dl.acm.org/doi/10.1145/3433210.3453093", "venue": "ACM ASIA CCS 2021", "verification": "source-reviewed", "verified_at": "2026-10-19", "why_fits_en": "Adds a field-defining survey of firmware rehosting, giving the collection's individual rehosting systems such as Firmadyne, FirmAE and HALucinator a shared vocabulary and taxonomy.", "why_fits_zh": "补充一篇界定固件重托管领域的综述，为合集中的 Firmadyne、FirmAE、HALucinator 等具体重托管系统提供共同的术语与分类框架。", "year": 2021 }, { "arxiv_id": null, "arxiv_version_reviewed": null, "authors": [ "Tuan Anh Nguyen", "Christoph Csallner" ], "code_url": "https://github.com/soumikmohianuta/pixtoapp", "date_basis": "IEEE/Crossref proceedings publication month and author bibliography; conference dates 9–13 November 2015", "date_basis_zh": "IEEE／Crossref 论文集出版月份与作者书目；会议于 2015 年 11 月 9—13 日举行。", "date_precision": "month", "description_en": "Reconstructs native Android UI code from screenshots or design bitmaps using OCR, computer vision, and layout heuristics; evaluates visual similarity and view hierarchies on 488 screenshots from over 100 Android and iOS applications.", "description_zh": "利用 OCR、计算机视觉和布局启发式规则，从截图或设计位图重建原生 Android 界面代码，并使用来自 100 多款 Android 与 iOS 应用的 488 张截图评估视觉相似性和视图层级。", "doi": "10.1109/ASE.2015.32", "entry_url": "https://awesomerea.org/papers/paper-remaui/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-remaui/", "evidence_urls": [ "https://ieeexplore.ieee.org/abstract/document/7372013", "https://api.crossref.org/works/10.1109/ASE.2015.32", "https://c.csallner.org/papers/nguyen15reverse.pdf", "https://pixeltoapp.com/", "https://github.com/soumikmohianuta/pixtoapp", "https://github.com/soumikmohianuta/pixtoapp/blob/f103a580e015ef7779998f14c9533a238a4bf1d1/README.md" ], "first_arxiv_date": null, "id": "paper-remaui", "kind": "research", "metadata_notes": "IEEE and Crossref include the technical-paper marker “(T)” in the title; the author PDF omits it. The January 2016 IEEE indexing date differs from the November 2015 publication. Pixel to App explicitly identifies the linked repository as REMAUI v2.", "metadata_notes_zh": "IEEE 和 Crossref 在标题中保留技术论文标记“(T)”，作者 PDF 未包含该标记。IEEE 于 2016 年 1 月收录的日期与 2015 年 11 月的出版日期不同。Pixel to App 明确将所链接仓库标为 REMAUI v2。", "pdf_url": "https://c.csallner.org/papers/nguyen15reverse.pdf", "project_url": "https://pixeltoapp.com/", "publication_date": "2015-11", "publication_status": "conference-paper", "runtime_tested": false, "scope_limitations_en": "The output is Android UI code; iOS screenshots are inputs, not evidence of native iOS output. Original logic and backend behavior are not recovered, and multi-screen transitions were future work. OCR/layout heuristics can misidentify content. The linked REMAUI v2 repository has older dependencies and is not the exact verified 2015 artifact.", "scope_limitations_zh": "输出为 Android 界面代码；iOS 截图属于输入，不代表生成原生 iOS 代码。方法不恢复原始逻辑和后端行为，多屏切换当时仍属后续工作。OCR／布局启发式规则可能误识别内容。所链接的 REMAUI v2 仓库采用较旧依赖，并非已核实的 2015 年原始产物。", "targets": [ "app" ], "title": "Reverse Engineering Mobile Application User Interfaces with REMAUI (T)", "title_zh": "使用 REMAUI 逆向重建移动应用用户界面", "url": "https://ieeexplore.ieee.org/abstract/document/7372013", "venue": "ASE 2015", "verification": "source-reviewed", "verified_at": "2026-10-16", "why_fits_en": "Adds foundational native mobile-interface reconstruction research alongside the existing binary and website papers.", "why_fits_zh": "在现有二进制与网站论文之外，补充原生移动界面重建的基础研究。", "year": 2015 }, { "arxiv_id": "2606.25550", "arxiv_version_reviewed": "v1", "authors": [ "Alexander Korn", "Jone Bartel", "Max Unterbusch", "Andreas Vogelsang" ], "citation": { "container_title": "2026 IEEE 34th International Requirements Engineering Conference Workshops (REW)", "pages": "94-103", "publisher": "IEEE", "sources": [ "https://api.crossref.org/works/10.1109/REW72749.2026.00023" ] }, "code_url": null, "date_basis": "IEEE-deposited Crossref proceedings month; first arXiv submission was June 24, 2026.", "date_basis_zh": "采用 IEEE 向 Crossref 登记的会议录出版月份；首次 arXiv 提交为 2026 年 6 月 24 日。", "date_precision": "month", "description_en": "Studies a RAG-based, human-supervised pipeline for recovering requirements and code traces from two projects. It also tests deliberate generation of unimplemented requirements and requirements smells (potential quality issues), exposing verification and labeling difficulties.", "description_zh": "研究以 RAG 和人工监督从两个项目恢复需求与代码追踪关系的流程，并测试刻意生成未实现需求及需求异味（潜在质量问题），揭示验证与标注的困难。", "doi": "10.1109/rew72749.2026.00023", "entry_url": "https://awesomerea.org/papers/paper-requirements-generation-viability/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-requirements-generation-viability/", "evidence_urls": [ "https://arxiv.org/abs/2606.25550", "https://arxiv.org/html/2606.25550v1", "https://api.crossref.org/works/10.1109/REW72749.2026.00023", "https://aire-ws.github.io/aire26/program.html", "https://alexkorn.de/papers/generation", "https://api.figshare.com/v2/articles/32393787", "https://ndownloader.figshare.com/files/64911339" ], "first_arxiv_date": "2026-06-24", "id": "paper-requirements-generation-viability", "kind": "research", "metadata_notes": "Publication identity is verified through IEEE-deposited Crossref metadata and the official AIRE program; direct IEEE access returned an empty HTTP 202 response. Fulltext review uses arXiv v1. Figshare v4 declares CC BY 4.0 and its README describes data, prompts and an implementation. No archive or notebook was executed.", "metadata_notes_zh": "通过 IEEE 登记的 Crossref 元数据及 AIRE 官方议程核实出版身份；直接访问 IEEE 返回空 HTTP 202 响应。全文复核采用 arXiv v1。Figshare v4 声明 CC BY 4.0，其 README 介绍数据、提示及实现；本次未执行归档或笔记本。", "pdf_url": "https://arxiv.org/pdf/2606.25550v1", "project_url": "https://doi.org/10.6084/m9.figshare.32393787.v4", "publication_date": "2026-08", "publication_status": "conference-paper", "runtime_tested": false, "scope_limitations_en": "The 188 generated requirements come from a student web application and Mattermost Desktop, using one model and PhD evaluators. Prompt choices, accumulated feedback and author-resolved labels affect validity. Findings concern this small experience study, not all code-to-requirements methods.", "scope_limitations_zh": "188 条生成需求来自学生网页应用与 Mattermost Desktop，使用单一模型及博士生评估者。提示选择、累积反馈及作者裁定的标签影响有效性；结论限于这一小规模经验研究，不代表所有代码到需求方法。", "targets": [ "app" ], "title": "On the Viability of Requirements Generation from Code: An Experience Report", "title_zh": "从代码生成需求是否可行：一份经验报告", "url": "https://doi.org/10.1109/REW72749.2026.00023", "venue": "IEEE REW 2026 / AIRE", "verification": "source-reviewed", "verified_at": "2026-10-20", "why_fits_en": "Adds negative evidence and validation limits for recovering application specifications from code.", "why_fits_zh": "为从代码恢复应用规格补充负面证据及验证局限。", "year": 2026 }, { "arxiv_id": "2608.27889", "arxiv_version_reviewed": "v1", "authors": [ "Zhiping Zhou", "Xiaohong Li", "Ruitao Feng", "Yao Zhang", "Yuekang Li", "Wenbu Feng" ], "code_url": null, "date_basis": "arXiv v1 first-submission date.", "date_basis_zh": "arXiv v1 首次提交日期。", "date_precision": "day", "description_en": "ReSource refines decompiled functions affected by compiler optimization and obfuscation. Its stages retrieve guidance from a Semantic Distortion Database, predict a control-flow skeleton, and refine names and formatting. Evaluation measures code similarity and retrieval of the corresponding original function from a source corpus.", "description_zh": "ReSource 针对受编译优化与混淆影响的反编译函数进行修复：先从语义失真数据库检索指导信息，再预测控制流骨架，最后调整名称与格式。评估衡量代码相似性，以及能否从源码语料中检索到对应的原始函数。", "doi": null, "entry_url": "https://awesomerea.org/papers/paper-resource/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-resource/", "evidence_urls": [ "https://arxiv.org/abs/2608.27889v1", "https://arxiv.org/html/2608.27889v1", "https://arxiv.org/pdf/2608.27889v1", "https://sites.google.com/view/resource4binary", "https://sites.google.com/view/resource4binary/dataset-source-code" ], "first_arxiv_date": "2026-08-28", "id": "paper-resource", "kind": "research", "metadata_notes": "Title, six-author order and preprint status agree across arXiv metadata and v1 full text. The project page links an anonymous artifact that returned HTTP 403 during review; code_url remains unset. No code, dataset or model was downloaded or run.", "metadata_notes_zh": "arXiv 元数据与 v1 正文的标题、六位作者顺序及预印本状态一致。项目页面链接的匿名产物在审阅时返回 HTTP 403，因此 code_url 留空。本次未下载或运行代码、数据集及模型。", "pdf_url": "https://arxiv.org/pdf/2608.27889v1", "project_url": "https://sites.google.com/view/resource4binary", "publication_date": "2026-08-28", "publication_status": "preprint", "runtime_tested": false, "scope_limitations_en": "Function-level similarity and retrieval are proxies; they do not establish compilability, executable equivalence or complete program recovery. Section 5.2 notes missing global context and untested custom obfuscation. The author-linked artifact page describes a simplified dataset and explicitly says the database-construction and control-flow-prediction modules are not yet available.", "scope_limitations_zh": "函数级相似性与检索指标属于替代指标，不能证明代码可编译、可执行等价或完整程序恢复。第 5.2 节指出全局上下文缺失，以及定制混淆尚未测试。作者链接的产物页面介绍了简化数据集，并明确说明数据库构建与控制流预测模块尚未提供。", "targets": [ "binary" ], "title": "Decoupling is a Necessity: Transformation-Agnostic Decompiled Code Recovery under Optimization and Obfuscation", "title_zh": "解耦的必要性：面向优化与混淆、无需识别具体变换的反编译代码恢复", "url": "https://arxiv.org/abs/2608.27889", "venue": "arXiv", "verification": "source-reviewed", "verified_at": "2026-10-19", "why_fits_en": "Adds staged refinement of optimized and obfuscated decompiler output, with explicit limits on what retrieval-based evaluation establishes.", "why_fits_zh": "补充对优化及混淆后反编译代码的分阶段修复研究，并明确检索评估能够支持的结论边界。", "year": 2026 }, { "arxiv_id": null, "arxiv_version_reviewed": null, "authors": [ "Danning Xie", "Zhuo Zhang", "Nan Jiang", "Xiangzhe Xu", "Lin Tan", "Xiangyu Zhang" ], "citation": { "container_title": "Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security", "pages": "4554-4568", "publisher": "ACM", "sources": [ "https://api.crossref.org/works/10.1145/3658644.3670340" ] }, "code_url": "https://github.com/lt-asset/resym", "date_basis": "ACM-deposited Crossref print-publication date; the October 14–18 CCS 2024 conference week is not used as the publication date.", "date_basis_zh": "采用 ACM 在 Crossref 登记的印刷出版日期；不将 CCS 2024 于 10 月 14—18 日举行的会议周作为出版日期。", "date_precision": "day", "description_en": "Combines two fine-tuned language models with Prolog-based cross-function reasoning to infer local-variable symbols and user-defined data structures from stripped-binary decompilation.", "description_zh": "结合两个微调语言模型与基于 Prolog 的跨函数推理，从去符号二进制的反编译结果中推断局部变量符号及用户自定义数据结构。", "doi": "10.1145/3658644.3670340", "entry_url": "https://awesomerea.org/papers/paper-resym/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-resym/", "evidence_urls": [ "https://doi.org/10.1145/3658644.3670340", "https://api.crossref.org/works/10.1145/3658644.3670340", "https://www.cs.purdue.edu/homes/lintan/publications/resym-ccs24.pdf", "https://github.com/lt-asset/resym", "https://github.com/lt-asset/resym/blob/437b4acac21a5a60edecf0c4423f7172f991271f/README.md", "https://dnxie.github.io/", "https://zenodo.org/records/13917253" ], "first_arxiv_date": null, "id": "paper-resym", "kind": "research", "metadata_notes": "ACM metadata records print publication on 2024-12-02 and online publication on 2024-12-09, pages 4554–4568. The author-hosted published PDF identifies the event as CCS ’24, held October 14–18, 2024 in Salt Lake City. The DOI, title, six authors and venue agree with the publisher record and the official author artifact.", "metadata_notes_zh": "ACM 元数据记载印刷出版于 2024-12-02，在线出版于 2024-12-09，页码为 4554–4568。作者托管的正式 PDF 标注 CCS ’24 于 2024 年 10 月 14—18 日在盐湖城举行，该日期仅为会议举办时间。DOI、标题、六位作者及会议均与出版方记录和官方作者研究产物一致。", "pdf_url": "https://www.cs.purdue.edu/homes/lintan/publications/resym-ccs24.pdf", "project_url": null, "publication_date": "2024-12-02", "publication_status": "conference-paper", "runtime_tested": false, "scope_limitations_en": "The method depends on underlying decompilation and learned predictions over C/C++ data. Cross-checking reduces conflicting predictions but does not prove that recovered names or layouts match the unavailable source. The public artifact includes models, processed data, and evaluation code.", "scope_limitations_zh": "该方法依赖底层反编译结果及针对 C/C++ 数据学习的预测。交叉检查可减少预测冲突，但不能证明恢复的名称或布局与缺失源码完全一致。公开研究产物包含模型、处理后的数据与评估代码。", "targets": [ "binary" ], "title": "ReSym: Harnessing LLMs to Recover Variable and Data Structure Symbols from Stripped Binaries", "title_zh": "ReSym：利用大语言模型恢复去符号二进制中的变量与数据结构符号", "url": "https://doi.org/10.1145/3658644.3670340", "venue": "ACM CCS 2024", "verification": "source-reviewed", "verified_at": "2026-10-17", "why_fits_en": "A concrete hybrid approach for grounding LLM-generated reverse-engineering annotations in program analysis.", "why_fits_zh": "展示如何结合程序分析，为 LLM 生成的逆向工程注释提供依据。", "year": 2024 }, { "arxiv_id": null, "arxiv_version_reviewed": null, "authors": [ "Sushant Dinesh", "Nathan Burow", "Dongyan Xu", "Mathias Payer" ], "code_url": "https://github.com/HexHive/retrowrite", "date_basis": "IEEE’s Crossref deposit and the IEEE Xplore record give only May 2020 as the publication date. Xplore separately records insertion on 30 July 2020, and the May 18–21 symposium dates are not used to assert a day.", "date_basis_zh": "IEEE 提交的 Crossref 元数据及 IEEE Xplore 记录只给出出版日期 2020 年 5 月。Xplore 另记载该文于 2020 年 7 月 30 日收录，本条目不据 5 月 18—21 日的研讨会日期推定具体日期。", "date_precision": "month", "description_en": "RetroWrite statically rewrites 64-bit position-independent Linux binaries by generating reassembleable assembly, so instrumentation can be inserted as if at compile time. Instead of heuristics, it symbolizes references from the binary's own metadata: control-flow operands, PC-relative addressing that position-independent code must use, and data relocations become assembler labels, which separates references from scalars. On this base the authors build AFL coverage instrumentation and a binary-only AddressSanitizer. They report fuzzing throughput matching compiler instrumentation and 4.5x faster than AFL's QEMU mode, with more bugs found on LAVA-M, and binary ASan that runs 3x faster than Valgrind memcheck on SPEC CPU2006 and detects 80% more bugs in their evaluation, whose coverage tests use Juliet memory-corruption cases.", "description_zh": "RetroWrite 通过生成可重汇编的汇编代码，对 64 位位置无关的 Linux 二进制进行静态改写，从而像在编译时一样插入插桩代码。它不依赖启发式规则，而是依据二进制自身的元数据进行符号化：控制流操作数、位置无关代码必须使用的 PC 相对寻址以及数据重定位均被转换为汇编标签，从而区分引用与标量。作者在此基础上实现了 AFL 覆盖率插桩和仅针对二进制的 AddressSanitizer。他们报告其模糊测试吞吐量与编译器插桩相当，比 AFL 的 QEMU 模式快 4.5 倍，并在 LAVA-M 上发现更多缺陷；在 SPEC CPU2006 上，二进制 ASan 比 Valgrind memcheck 快 3 倍，并在作者的评测中多检测出 80% 的缺陷，其检测覆盖率测试采用 Juliet 内存破坏用例。", "doi": "10.1109/SP40000.2020.00009", "entry_url": "https://awesomerea.org/papers/paper-retrowrite/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-retrowrite/", "evidence_urls": [ "https://ieeexplore.ieee.org/document/9152762", "https://api.crossref.org/works/10.1109/SP40000.2020.00009", "https://web.archive.org/web/20220803033228/https://ieeexplore.ieee.org/document/9152762", "https://hexhive.epfl.ch/publications/files/20Oakland.pdf", "https://nebelwelt.net/publications/files/20Oakland.pdf", "https://github.com/HexHive/retrowrite/blob/3b1e366ff8d2449a4f4c3157dd95c6f39c0a310b/README.md", "https://github.com/HexHive/retrowrite/blob/3b1e366ff8d2449a4f4c3157dd95c6f39c0a310b/LICENSE" ], "first_arxiv_date": null, "id": "paper-retrowrite", "kind": "research", "metadata_notes": "Crossref gives the four-author order, pages 1497–1511 and May 2020; IEEE Xplore, read through a Wayback Machine capture because the live page served a bot challenge, gives the same pages and month and a 30 July 2020 insertion date. The 15-page HexHive PDF is byte-identical to the nebelwelt.net copy that the repository README links; it lacks IEEE page numbers and is used as the author-hosted copy. The paper names github.com/HexHive/retrowrite and says its results can be reproduced with the repository’s Docker image. At the reviewed 2025-04-26 commit, the repository has an MIT LICENSE file, though GitHub reports no recognized license, and the README lists Python 3.6 with pyelftools and capstone. Its feature table marks stripped binaries, non-PIE binaries and C++ as unsupported for the x64 rewriter and points to a separate thesis for the aarch64 version. The repository is already in the automated scan index and links to this entry through code_url. Nothing was installed or run.", "metadata_notes_zh": "Crossref 给出四位作者顺序、页码 1497–1511 及 2020 年 5 月；IEEE Xplore 的实时页面返回机器人验证，因此通过 Wayback Machine 存档阅读，其页码与月份相同，并记载 2020 年 7 月 30 日收录。HexHive 托管的 15 页 PDF 与仓库 README 所链接的 nebelwelt.net 副本逐字节相同；该副本没有 IEEE 页码，作为作者托管副本使用。论文给出 github.com/HexHive/retrowrite，并称其结果可借助仓库的 Docker 镜像复现。在所审阅的 2025-04-26 提交中，仓库包含 MIT LICENSE 文件，但 GitHub 未识别出许可证；README 列出 Python 3.6 以及 pyelftools 与 capstone。其功能表将去除符号的二进制、非 PIE 二进制与 C++ 标为 x64 改写器尚不支持，并为 aarch64 版本指向另一篇学位论文。该仓库已收录在自动扫描索引中，并通过 code_url 与本条目关联。本次未安装或运行任何内容。", "pdf_url": "https://hexhive.epfl.ch/publications/files/20Oakland.pdf", "project_url": null, "publication_date": "2020-05", "publication_status": "conference-paper", "runtime_tested": false, "scope_limitations_en": "The method depends on position-independent code; the paper's implementation targets Linux x86-64 and uses the symbol table for function starts and sizes, so stripped binaries need function boundaries from another tool. It cannot safely rewrite C++ binaries with exception handling, because the DWARF unwind information is not symbolized, and it does not address obfuscated or adversarial binaries. Binary ASan instruments the stack only at stack-frame granularity and adds no redzones around globals, so it misses some overflows that compiler ASan catches, and it remains slower than compiler ASan. Results are from 2019–2020 tool versions on the authors' benchmarks. The repository's later aarch64 rewriter, described in a separate thesis, uses a different algorithm, and the paper's x86-64 results do not apply to it.", "scope_limitations_zh": "该方法依赖位置无关代码；论文的实现面向 Linux x86-64，并借助符号表确定函数起点与大小，因此去除符号的二进制需要由其他工具提供函数边界。由于未对 DWARF 栈展开信息进行符号化，它无法安全改写含异常处理的 C++ 二进制，也不处理混淆或对抗性二进制。二进制 ASan 对栈只按栈帧粒度插桩，也不在全局变量周围添加红区，因此会遗漏部分编译器 ASan 能发现的溢出，且仍慢于编译器 ASan。这些结果基于 2019—2020 年的工具版本和作者的基准。仓库中后来加入的 aarch64 改写器在另一篇学位论文中描述，采用不同的算法，论文中的 x86-64 结果不适用于它。", "targets": [ "binary" ], "title": "RetroWrite: Statically Instrumenting COTS Binaries for Fuzzing and Sanitization", "title_zh": "RetroWrite：为模糊测试与内存检测静态插桩商用现成二进制", "url": "https://ieeexplore.ieee.org/document/9152762", "venue": "IEEE S&P 2020", "verification": "source-reviewed", "verified_at": "2026-10-19", "why_fits_en": "Adds static binary rewriting through reassembleable assembly, which reconstructs symbolized assembly so new code can be inserted without source, complementing the collection's decompilation and binary-recovery research.", "why_fits_zh": "补充基于可重汇编汇编代码的静态二进制改写研究：重建符号化的汇编代码，从而在没有源码的情况下插入新代码，与合集中的反编译及二进制恢复研究互补。", "year": 2020 }, { "arxiv_id": "2606.26094", "arxiv_version_reviewed": "v1", "authors": [ "Babak Rahmani", "Sebastian Dziadzio", "Joschka Strüber", "Sergio Hernández-Gutiérrez", "Matthias Bethge" ], "code_url": "https://github.com/bethgelab/revenge-bench", "date_basis": "arXiv v1 submission history; the non-archival AIWILD workshop acceptance does not create a separate publication date.", "date_basis_zh": "采用 arXiv v1 的首次提交日期；AIWILD 非存档研讨会接收不构成另一出版日期。", "date_precision": "day", "description_en": "Tests whether agents can recover executable decision policies from behavioral traces and self-designed opponent probes, using 75 synthetic policies across five game arenas and measuring held-out action agreement and downstream competitive value.", "description_zh": "使用五种游戏环境中的 75 个合成策略，测试智能体能否通过行为轨迹和自行设计的对手探测恢复可执行决策策略，并衡量留出状态上的动作一致性及后续对抗价值。", "doi": "10.48550/arXiv.2606.26094", "entry_url": "https://awesomerea.org/papers/paper-revengebench/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-revengebench/", "evidence_urls": [ "https://arxiv.org/abs/2606.26094", "https://arxiv.org/html/2606.26094v1", "https://github.com/bethgelab/revenge-bench", "https://github.com/bethgelab/revenge-bench/blob/090048696b4c7287e4cd05a728d4bba10fc8d421/README.md", "https://joschkastrueber.github.io/publications/", "https://openreview.net/forum?id=KTnZYPgaQz", "https://icml.cc/virtual/2026/workshop/54082", "https://agentwild-workshop.github.io/icml2026/" ], "first_arxiv_date": "2026-06-24", "id": "paper-revengebench", "kind": "research", "metadata_notes": "Accepted to the non-archival Second Workshop on Agents in the Wild (AIWILD) at ICML 2026: its OpenReview record was published on 2026-05-23 and is linked from the ICML page for the July 11, 2026 workshop. The workshop call states a non-archival policy, so this entry keeps the arXiv preprint and first-submission date. The repository and an author’s publication page also report the acceptance. The artifact is official, but its documented omitted experiments are not treated as released.", "metadata_notes_zh": "已被 ICML 2026 的第二届 Agents in the Wild（AIWILD）非存档研讨会接收：其 OpenReview 记录于 2026-05-23 发布，并由 2026 年 7 月 11 日研讨会的 ICML 页面链接。研讨会征稿说明采用非存档政策，因此本条目保留 arXiv 预印本及首次提交日期。仓库与一位作者的发表列表也记载了该接收信息。产物属于官方项目，但文档明确未包含的实验不视为已发布。", "pdf_url": "https://arxiv.org/pdf/2606.26094v1", "project_url": "https://revengebench.com/", "publication_date": "2026-06-24", "publication_status": "preprint", "runtime_tested": false, "scope_limitations_en": "The targets are fixed synthetic policies, not full games or adaptive adversaries. Agreement on finitely evaluated states does not uniquely identify source code, and some arenas have substantial variance. The public package omits some paper-only plotting and ablation suites; reproduction also needs CodeClash, a container runtime, and model access.", "scope_limitations_zh": "目标是固定的合成策略，不是完整游戏或自适应对手。有限评测状态上的动作一致性不能唯一确定源码，部分环境的方差较大。公开包未包含部分仅用于论文的绘图与消融实验；复现还需要 CodeClash、容器运行时和模型访问。", "targets": [ "game" ], "title": "RevengeBench: Reverse Engineering Code-Space Policies from Behavioral Experiments", "title_zh": "RevengeBench：通过行为实验逆向恢复代码形式的策略", "url": "https://arxiv.org/abs/2606.26094", "venue": "arXiv", "verification": "source-reviewed", "verified_at": "2026-10-17", "why_fits_en": "Provides a game-domain benchmark for agent-assisted behavioral reverse engineering and active experimental design.", "why_fits_zh": "为智能体辅助的行为逆向工程与主动实验设计提供游戏领域基准。", "year": 2026 }, { "arxiv_id": "2609.01185", "arxiv_version_reviewed": "v1", "authors": [ "Hadjer Benkraouda", "Hongyu Cai", "Berkay Celik", "Gang Wang" ], "code_url": null, "date_basis": "First arXiv submission; no reviewed venue publication is established.", "date_basis_zh": "采用首次 arXiv 提交日期；未确立正式期刊或会议出版。", "date_precision": "day", "description_en": "Evaluates reverse-engineering agent traces through flag recovery, eight analysis milestones and action profiles. Deterministic checks and an outcome-blinded LLM judge help locate failures beyond a single solve-rate score.", "description_zh": "从旗标恢复、八个分析阶段和操作特征评估逆向智能体轨迹，通过确定性检查与不知道最终结果的模型裁判定位失败环节。", "doi": "10.48550/arxiv.2609.01185", "entry_url": "https://awesomerea.org/papers/paper-reveree/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-reveree/", "evidence_urls": [ "https://arxiv.org/abs/2609.01185v1", "https://arxiv.org/html/2609.01185v1", "https://api.datacite.org/dois/10.48550/arxiv.2609.01185" ], "first_arxiv_date": "2026-09-01", "id": "paper-reveree", "kind": "research", "metadata_notes": "Reviewed arXiv v1 and registered DOI. The paper announces a release, but the reviewed manuscript does not identify a dedicated artifact URL. No code, challenge binaries or experiments were run.", "metadata_notes_zh": "已核对 arXiv v1 及注册 DOI。论文宣布发布，但所查手稿未给出专用产物链接。本次未运行代码、题目二进制或实验。", "pdf_url": "https://arxiv.org/pdf/2609.01185v1", "project_url": null, "publication_date": "2026-09-01", "publication_status": "preprint", "runtime_tested": false, "scope_limitations_en": "Uses 88 public CTF challenges and nine models; all four prompting strategies are compared on four models. Evaluation fixes the D-CIPHER harness and uses one attempt per setting. One expert checks 15 traces; agreement on judged comprehension stages is 53/60. Recall and surface-perturbation probes do not eliminate contamination.", "scope_limitations_zh": "涵盖 88 个公开 CTF 题和九种模型，仅其中四种比较全部四种提示策略；固定 D-CIPHER 框架，每配置仅一次尝试。一位专家检查 15 条轨迹，理解阶段一致为 53/60；记忆与表面扰动探测不能消除数据污染。", "targets": [ "binary" ], "title": "Reveree: Diagnosing LLM Reverse-Engineering Agents", "title_zh": "Reveree：诊断大语言模型逆向工程智能体", "url": "https://arxiv.org/abs/2609.01185", "venue": "arXiv", "verification": "source-reviewed", "verified_at": "2026-10-20", "why_fits_en": "Adds process-level evaluation for binary-analysis agents.", "why_fits_zh": "补充二进制分析智能体的过程评测。", "year": 2026 }, { "arxiv_id": "2609.36161", "arxiv_version_reviewed": "v1", "authors": [ "Tianyu Liu", "Dingyuan Dai", "Yufan Du", "Zhen Yang" ], "code_url": null, "date_basis": "First arXiv v1 submission; no formal venue publication was verified.", "date_basis_zh": "采用 arXiv v1 首次提交日期；未核实正式会议或期刊出版。", "date_precision": "day", "description_en": "ReviveBench evaluates repair of nonrunning software and source-unavailable implementation of bounded computational and transactional engines from open specifications, using hidden reference-based checks. It also audits grading defects that can wrongly accept or reject reconstructions.", "description_zh": "ReviveBench 利用隐藏的参考检查，评估无法运行的软件修复，以及依据公开规范、在无法访问目标源码时实现限定范围的计算与事务引擎；同时审计可能误收或误拒重建结果的评分缺陷。", "doi": "10.48550/arxiv.2609.36161", "entry_url": "https://awesomerea.org/papers/paper-revivebench/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-revivebench/", "evidence_urls": [ "https://arxiv.org/abs/2609.36161", "https://arxiv.org/html/2609.36161v1", "https://api.datacite.org/dois/10.48550/arxiv.2609.36161" ], "first_arxiv_date": "2026-09-28", "id": "paper-revivebench", "kind": "research", "metadata_notes": "The four-author v1 identity matches arXiv and DataCite, which registered the arXiv DOI on 2026-09-30. The article uses the arXiv non-exclusive license. No author-linked public benchmark/verifier package or its code/data license was verified in the reviewed full text and focused search. No software packages, model weights, benchmark tasks or experiments were downloaded or executed.", "metadata_notes_zh": "四位作者的 v1 身份与 arXiv、DataCite 一致；后者于 2026-09-30 登记 arXiv DOI。文章采用 arXiv 非独占许可。所审阅全文及定向检索未核实作者链接的公开基准／验证器包或其代码／数据许可。本次未下载或运行软件包、模型权重、基准任务或实验。", "pdf_url": "https://arxiv.org/pdf/2609.36161v1", "project_url": null, "publication_date": "2026-09-28", "publication_status": "preprint", "runtime_tested": false, "scope_limitations_en": "Studies ten revival and thirteen bounded engine tasks; reconstruction receives public specifications and three worked examples. Most model/task cells have one or two seeds; the reconstruction matrix reports the best eligible run. Excluded infrastructure failures and differing API adapters limit comparisons. Task-level pass thresholds do not require every check to pass, and CFD passes cannot establish numerical-solver capability. Verifier audits and contamination controls do not prove general equivalence or rule out prior exposure.", "scope_limitations_zh": "研究十个软件恢复任务及十三个限定范围的引擎任务；重建时提供公开规范与三个示例。大多数模型／任务组合只有一两个随机种子；重建结果矩阵报告符合条件的最佳运行。排除基础设施失败及使用不同 API 适配器会限制比较。任务通过阈值不要求每项检查全部通过，CFD 通过结果也不能证明数值求解器能力。验证器审计与污染控制不构成一般等价证明，也无法排除先前接触相关内容。", "targets": [ "app" ], "title": "From Dead Code and Static Requirements to Working Engines: Software Revival with Coding Agents", "title_zh": "从失效代码与静态需求到可运行引擎：利用编程智能体恢复软件", "url": "https://arxiv.org/abs/2609.36161", "venue": "arXiv", "verification": "source-reviewed", "verified_at": "2026-10-20", "why_fits_en": "Connects software reconstruction with audits of the tests used to judge its correctness.", "why_fits_zh": "将软件重建与用于判断其正确性的测试审计联系起来。", "year": 2026 }, { "arxiv_id": null, "arxiv_version_reviewed": null, "authors": [ "Alessandro Di Federico", "Mathias Payer", "Giovanni Agosta" ], "code_url": "https://github.com/revng/revng", "date_basis": "ACM’s Crossref deposit records both print and online publication on 2017-02-05. This entry uses that date, not the conference schedule.", "date_basis_zh": "ACM 提交的 Crossref 元数据将纸质与在线出版日期均记为 2017-02-05。本条目采用该日期，而非会议日程。", "date_precision": "day", "description_en": "rev.ng lifts binaries to LLVM IR through QEMU's tiny code generator, so one front end covers every architecture QEMU supports and the output is compilable IR. On that IR the authors build architecture-independent analyses that recover a program's control-flow graph and function boundaries without symbols or debugging information. A value-range analysis (OSRA) bounds indirect jump targets such as switch tables, and further analyses handle predicated instructions, noreturn functions, tail calls and context-dependent control flow. On coreutils built for MIPS, ARM and x86-64 with GCC and clang at -O2, -O3 and -Os, its function-boundary accuracy is close to IDA Pro and better than BAP/ByteWeight and angr.", "description_zh": "rev.ng 借助 QEMU 的微型代码生成器（TCG）将二进制提升为 LLVM 中间表示，因此同一前端可覆盖 QEMU 支持的全部架构，输出的是可编译的中间表示。作者在此基础上构建与架构无关的分析，在没有符号或调试信息的情况下恢复程序的控制流图与函数边界。一种值域分析（OSRA）用于限定 switch 跳转表等间接跳转的目标，其他分析则处理谓词执行指令、noreturn 函数、尾调用以及依赖上下文的控制流。在为 MIPS、ARM 与 x86-64 构建、分别使用 GCC 与 clang 以 -O2、-O3 和 -Os 编译的 coreutils 上，其函数边界恢复的准确度接近 IDA Pro，并优于 BAP/ByteWeight 与 angr。", "doi": "10.1145/3033019.3033028", "entry_url": "https://awesomerea.org/papers/paper-revng/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-revng/", "evidence_urls": [ "https://dl.acm.org/doi/10.1145/3033019.3033028", "https://api.crossref.org/works/10.1145/3033019.3033028", "https://nebelwelt.net/publications/files/17CC.pdf", "https://rev.ng/", "https://github.com/revng/revng/blob/57d81a3b0d946ccaa9fed8a13c9871dc36b94747/README.md" ], "first_arxiv_date": null, "id": "paper-revng", "kind": "research", "metadata_notes": "Crossref gives the three-author order and pages 131–141; Crossref writes the title in lowercase, and this entry follows the capitalization of the author-hosted 11-page PDF, the same length as the ACM version. The paper reports a C++ prototype of 8,011 lines built on LLVM 3.8 and QEMU 2.5.0, and its acknowledgements give https://rev.ng/ as the Free Software release. The revng/revng repository has since become the full rev.ng decompiler: at the commit the curated revng record pins (57d81a3), the README describes a decompiler developed by rev.ng Labs, licensed GPLv2 as a whole with individual files under MIT. Those behavior and license notes describe the current project, not the evaluated 2017 prototype. Nothing was built or run.", "metadata_notes_zh": "Crossref 给出三位作者的顺序及页码 131–141；Crossref 的标题为小写，本条目采用作者托管的 11 页 PDF 中的大小写，其页数与 ACM 版本相同。论文报告的原型为 8,011 行 C++ 代码，基于 LLVM 3.8 与 QEMU 2.5.0；致谢部分给出 https://rev.ng/ 作为其自由软件发布地址。revng/revng 仓库此后已发展为完整的 rev.ng 反编译器：在已收录的 revng 条目所固定的提交（57d81a3）中，README 将其描述为由 rev.ng Labs 开发的反编译器，整体采用 GPLv2 许可，单个文件采用 MIT 许可。这些功能与许可说明针对当前项目，而非 2017 年接受评测的原型。本次未构建或运行任何内容。", "pdf_url": "https://nebelwelt.net/publications/files/17CC.pdf", "project_url": "https://rev.ng/", "publication_date": "2017-02-05", "publication_status": "conference-paper", "runtime_tested": false, "scope_limitations_en": "The evaluation measures function boundaries, not the CFG directly: the authors could not collect CFG ground truth from GCC or LLVM, so boundary accuracy (Jaccard index against ELF function symbols) is presented as a lower bound on CFG quality. It covers 105 statically linked, stripped coreutils programs for Linux on three of the architectures QEMU supports; the other architectures and dynamically linked binaries were not evaluated. The prototype misses some nested-switch jump tables on x86-64 and jump-table addresses spilled to the stack on MIPS, needs more memory than the other tools on ARM and MIPS, and does not report dead code that IDA Pro finds through prologue heuristics, which the authors treat as a design choice. Baselines are IDA Pro 6.6, BAP 0.9.9 and angr as of November 2016. The paper does not decompile to C.", "scope_limitations_zh": "评测衡量的是函数边界，而非直接衡量控制流图：作者无法从 GCC 或 LLVM 获取控制流图的真实标签，因此以函数边界准确度（相对 ELF 函数符号的 Jaccard 指数）作为控制流图质量的下界。评测覆盖为 Linux 构建、静态链接并去除调试信息的 105 个 coreutils 程序，只涉及 QEMU 所支持架构中的三种；其他架构及动态链接二进制未经评测。原型会遗漏 x86-64 上部分嵌套 switch 的跳转表，以及 MIPS 上被溢出到栈中的跳转表地址；在 ARM 与 MIPS 上比其他工具占用更多内存；也不会报告 IDA Pro 凭借函数序言启发式找到的死代码，作者将此视为设计取舍。基线为 IDA Pro 6.6、BAP 0.9.9 以及 2016 年 11 月时的 angr。论文本身不涉及反编译为 C。", "targets": [ "binary" ], "title": "rev.ng: A Unified Binary Analysis Framework to Recover CFGs and Function Boundaries", "title_zh": "rev.ng：用于恢复控制流图与函数边界的统一二进制分析框架", "url": "https://dl.acm.org/doi/10.1145/3033019.3033028", "venue": "CC 2017", "verification": "source-reviewed", "verified_at": "2026-10-19", "why_fits_en": "Adds lifting of machine code to compiler IR with architecture-independent CFG and function-boundary recovery, the analysis layer beneath the collection's curated rev.ng decompiler.", "why_fits_zh": "补充将机器码提升为编译器中间表示，并以与架构无关的方式恢复控制流图与函数边界的研究，这一分析层是合集所收录 rev.ng 反编译器的基础。", "year": 2017 }, { "arxiv_id": "2609.13389", "arxiv_version_reviewed": "v1", "authors": [ "Anqi Chen", "Dan Goldwasser", "Cristina Nita-Rotaru" ], "code_url": "https://anonymous.4open.science/r/rfcllm", "date_basis": "Author arXiv record reports acceptance to Findings of EMNLP 2026; a proceedings publication date was not verified.", "date_basis_zh": "作者的 arXiv 记录报告已被 Findings of EMNLP 2026 录用，未核实论文集正式出版日期。", "date_precision": "year", "description_en": "Tests reasoning over protocol state machines using 1,482 questions across 16 protocols. Four context settings distinguish RFC retrieval from reasoning over supplied transitions; tasks cover next states, conditions, predecessor states and paths.", "description_zh": "以 16 种协议的 1,482 个问题评测协议状态机推理。四种上下文设置区分 RFC 检索与依据给定转换进行推理，任务涵盖后继状态、条件、前驱状态及路径。", "doi": null, "entry_url": "https://awesomerea.org/papers/paper-rfcllm/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-rfcllm/", "evidence_urls": [ "https://arxiv.org/abs/2609.13389v1", "https://arxiv.org/html/2609.13389v1", "https://anonymous.4open.science/r/rfcllm/README.md" ], "first_arxiv_date": "2026-09-11", "id": "paper-rfcllm", "kind": "research", "metadata_notes": "Reviewed September 11 v1. Acceptance is author-reported, not evidence of completed proceedings publication. The author-linked anonymous artifact exposes README, scripts and results; its UI lists access until December 16, 2026, but no full Git commit or root license was established. No model or benchmark was run.", "metadata_notes_zh": "复核 9 月 11 日 v1。录用信息来自作者，不代表论文集已正式出版。作者链接的匿名产物可读到 README、脚本及结果，界面列明开放至 2026 年 12 月 16 日，但未确立完整 Git 提交或根许可证。本次未运行模型或基准。", "pdf_url": "https://arxiv.org/pdf/2609.13389v1", "project_url": null, "publication_date": null, "publication_status": "conference-accepted", "runtime_tested": false, "scope_limitations_en": "Evaluates reasoning, not a new FSM extractor or implementation reconstruction. Gold FSMs were prepared by one author; judge agreement was checked on 50 instances by the three authors. Packet formats, error handling, configurations and real code mappings are outside scope. Results depend on context, judges and output budgets.", "scope_limitations_zh": "评测的是推理，并非新的状态机提取器或实现重建方法。标准状态机由一名作者构建，三位作者仅在 50 个样例上核对判定器一致性。报文格式、错误处理、配置及真实代码映射不在范围内；结果受上下文、判定器及输出预算影响。", "targets": [ "protocol" ], "title": "RFCLLM: Evaluating LLMs' Reasoning Ability of Network Protocol State Machines", "title_zh": "RFCLLM：评估大语言模型对网络协议状态机的推理能力", "url": "https://arxiv.org/abs/2609.13389", "venue": "Findings of EMNLP 2026", "verification": "source-reviewed", "verified_at": "2026-10-20", "why_fits_en": "Provides a bounded validation reference for using LLMs to interpret recovered or documented protocol models.", "why_fits_zh": "为使用 LLM 理解恢复所得或文档描述的协议模型提供有明确边界的验证参考。", "year": 2026 }, { "arxiv_id": "2610.06258", "arxiv_version_reviewed": "v1", "authors": [ "Ulysse Planta", "Julian Rederlechner", "Martin Strohmeier", "Mathias Fischer", "Ali Abbasi" ], "citation": { "container_title": "2026 IEEE Symposium on Security and Privacy (SP)", "pages": "2904-2921", "publisher": "IEEE", "sources": [ "https://api.crossref.org/works/10.1109/SP63933.2026.00213" ] }, "code_url": "https://github.com/EmsecCispa/SatBleed", "date_basis": "IEEE's Crossref publication date, corroborated by CISPA; October 5 is the later arXiv deposit.", "date_basis_zh": "采用 IEEE 提交至 Crossref、并由 CISPA 确认的出版日期；10 月 5 日是后续 arXiv 提交日期。", "date_precision": "day", "description_en": "Studies satellite communication modules through hardware inspection, firmware reverse engineering, protocol analysis, partial rehosting and targeted testing. A component-level threat model connects recovered data flows to security boundaries.", "description_zh": "通过硬件检查、固件逆向、协议分析、部分重托管及针对性测试研究卫星通信模块，以组件级威胁模型将恢复的数据流与安全边界联系起来。", "doi": "10.1109/SP63933.2026.00213", "entry_url": "https://awesomerea.org/papers/paper-satbleed/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-satbleed/", "evidence_urls": [ "https://arxiv.org/abs/2610.06258", "https://arxiv.org/html/2610.06258v1", "https://api.crossref.org/works/10.1109/SP63933.2026.00213", "https://www.ieee-security.org/TC/SP2026/accepted-papers.html", "https://cispa.de/en/research/publications/213033-satbleed-security-of-commoditized-communication-modules-in-satellites", "https://github.com/EmsecCispa/SatBleed/blob/e4d70e45dd6527d1f1171ede2c44a7e09cd2ffed/README.md" ], "first_arxiv_date": "2026-10-05", "id": "paper-satbleed", "kind": "research", "metadata_notes": "IEEE and CISPA establish May publication; the October arXiv v1 is the reviewed full text, not byte-verified against the publisher PDF. The pinned supplement README describes a trimmed fuzzer without case-specific oracles and STIX bundles. Working exploit payloads and the inferred mission list are withheld. No repository-wide license was verified; no hardware, RF or firmware experiment was performed here.", "metadata_notes_zh": "IEEE 与 CISPA 确认 5 月出版；本次读取 10 月提交的 arXiv v1 全文，未与出版方 PDF 逐字节比对。固定补充材料 README 描述裁剪后的模糊测试器及 STIX 包，其中不含案例专用判定器；可运行利用载荷和推断的任务名单未发布。未核实仓库整体许可，本次未进行硬件、射频或固件实验。", "pdf_url": "https://arxiv.org/pdf/2610.06258v1", "project_url": null, "publication_date": "2026-05-18", "publication_status": "conference-paper", "runtime_tested": false, "scope_limitations_en": "Detailed assessment covers three vendors in isolated laboratory setups, not operational satellite links. The reported 28 of 64 active missions are passively inferred as plausibly vulnerable, not actively compromised; encrypted or compressed telemetry is excluded. Manual analysis cannot establish completeness, and vendor-specific findings do not generalize to all modules. LLM use was editorial, not an evaluated reversing agent.", "scope_limitations_zh": "详细评估针对三个厂商的隔离实验环境，并未接触在轨卫星链路。所报告的 64 个活跃任务中有 28 个可能受影响，来自被动推断而非实际入侵；加密或压缩遥测被排除。人工分析不能证明完整性，厂商特定结果也不能推广到全部模块。大语言模型仅用于编辑，并非接受评测的逆向智能体。", "targets": [ "firmware", "protocol", "binary" ], "title": "SatBleed: Security of Commoditized Communication Modules in Satellites", "title_zh": "SatBleed：卫星商用通信模块的安全性", "url": "https://doi.org/10.1109/SP63933.2026.00213", "venue": "IEEE S&P 2026", "verification": "source-reviewed", "verified_at": "2026-10-20", "why_fits_en": "Documents firmware and undocumented-protocol recovery with explicit hardware and evidence constraints.", "why_fits_zh": "记录固件及未公开协议的恢复，并明确硬件与证据限制。", "year": 2026 }, { "arxiv_id": "2406.17233", "arxiv_version_reviewed": "v2", "authors": [ "Yunlong Feng", "Dechuan Teng", "Yang Xu", "Honglin Mu", "Xiao Xu", "Libo Qin", "Qingfu Zhu", "Wanxiang Che" ], "code_url": "https://github.com/AlongWY/sccdec", "date_basis": "The official ACL Anthology citation gives November 2024. Crossref records only the year; the November 12–16 conference dates printed in the PDF are not treated as a publication day.", "date_basis_zh": "ACL Anthology 官方引文给出 2024 年 11 月。Crossref 仅记录年份；PDF 中印有的 11 月 12–16 日会议日期不作为具体出版日。", "date_precision": "month", "description_en": "Adds two techniques to LLM decompilation of function-level x86-64 GCC assembly into C. Self-Constructed Context Decompilation (sc²dec) recompiles a model’s first compilable output and uses the resulting assembly–source pair as an in-context example for a second attempt, without fine-tuning. Fine-grained Alignment Enhancement (FAE) fine-tunes llm4decompile-6.7b with LoRA on statement-level assembly–C alignments derived from DWARF debug information. Combining both, the authors report 52.41% average re-executability on Decompile-Eval, against 48.60% for the base model.", "description_zh": "为大语言模型将函数级 x86-64 GCC 汇编反编译为 C 的流程增加两项技术。自构造上下文反编译（sc²dec）无需微调：把模型首次生成且可编译的结果重新编译，以得到的汇编—源码对作为上下文示例再次反编译。细粒度对齐增强（FAE）利用 DWARF 调试信息构造语句级汇编—C 对齐数据，以 LoRA 微调 llm4decompile-6.7b。两者结合后，作者报告在 Decompile-Eval 上的平均可重执行率为 52.41%，基础模型为 48.60%。", "doi": "10.18653/v1/2024.findings-emnlp.385", "entry_url": "https://awesomerea.org/papers/paper-sc2dec/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-sc2dec/", "evidence_urls": [ "https://aclanthology.org/2024.findings-emnlp.385/", "https://aclanthology.org/2024.findings-emnlp.385.pdf", "https://aclanthology.org/2024.findings-emnlp.385.bib", "https://api.crossref.org/works/10.18653/v1/2024.findings-emnlp.385", "https://arxiv.org/abs/2406.17233", "https://github.com/AlongWY/sccdec/blob/22745ea6249a4ae73d3d00fe9da2e0c7c78a748c/README.md", "https://github.com/AlongWY/sccdec/blob/22745ea6249a4ae73d3d00fe9da2e0c7c78a748c/LICENSE.txt", "https://github.com/AlongWY/sccdec/blob/22745ea6249a4ae73d3d00fe9da2e0c7c78a748c/pyproject.toml", "https://github.com/AlongWY/sccdec/blob/22745ea6249a4ae73d3d00fe9da2e0c7c78a748c/src/sccdec/eval.py", "https://huggingface.co/ylfeng/sccdec-lora", "https://huggingface.co/datasets/ylfeng/sccdec-dataset" ], "first_arxiv_date": "2024-06-25", "id": "paper-sc2dec", "kind": "research", "metadata_notes": "The title keeps the published spelling ‘Fined-grained’. The eight-author order follows the Anthology, PDF, Crossref and arXiv. arXiv v2 (2024-10-03) is labeled EMNLP 2024 Findings; v1 was submitted on 2024-06-25. The Anthology and Crossref give pages 6603–6614. The abstract’s ‘approximately 3.90%’ gain differs from the 3.81-point gap between Table 1’s 48.60% base result and 52.41%; this entry cites the table values. At the reviewed 2025-02-18 commit, the repository declares MIT, although LICENSE.txt keeps template placeholders for year and holders. It provides an evaluation script and GCC Decompile-Eval data, and links a LoRA adapter for LLM4Binary/llm4decompile-6.7b-v1.5 and a training dataset on Hugging Face, both tagged MIT; the base model and ExeBench keep their own terms. Its README results table adds readability scores and the authors’ later ReF Decompile, and its FAE-only averages differ slightly from the paper (51.07% versus 50.88%). The evaluator uses local gcc and objdump and, with --compiler, sends code to the public Compiler Explorer API. No weights or datasets were downloaded, and no code or experiments were run.", "metadata_notes_zh": "标题保留出版时的拼写“Fined-grained”。八位作者的顺序以 Anthology、PDF、Crossref 与 arXiv 为准。arXiv v2（2024-10-03）标注为 EMNLP 2024 Findings；v1 于 2024-06-25 提交。Anthology 与 Crossref 给出页码 6603–6614。摘要所称约 3.90% 的提升与表 1 中基础结果 48.60% 和 52.41% 之间 3.81 个百分点的差值不一致；本条目引用表中数值。在所审阅的 2025-02-18 提交中，仓库声明采用 MIT，但 LICENSE.txt 仍保留年份与版权人的模板占位符。仓库提供评估脚本和 GCC 版 Decompile-Eval 数据，并链接 Hugging Face 上基于 LLM4Binary/llm4decompile-6.7b-v1.5 的 LoRA 适配器与训练数据集，两者均标为 MIT；基础模型与 ExeBench 保留各自条款。README 的结果表另加入可读性分数和作者后续的 ReF Decompile，其中仅用 FAE 的平均值与论文略有不同（51.07% 对 50.88%）。评估器使用本地 gcc 与 objdump；指定 --compiler 时会把代码发送到公共 Compiler Explorer API。本次未下载权重或数据集，也未运行代码或实验。", "pdf_url": "https://aclanthology.org/2024.findings-emnlp.385.pdf", "project_url": null, "publication_date": "2024-11", "publication_status": "conference-paper", "runtime_tested": false, "scope_limitations_en": "Results are function-level re-executability on Decompile-Eval: 164 HumanEval-derived C problems compiled at O0–O3 and checked by recompilation and HumanEval test cases. Passing these tests is not whole-program or all-input equivalence, and the paper does not evaluate real-world binaries, other architectures or readability. sc²dec helps only when the first output recompiles, so low re-compilability limits its gains; the authors report 1–2% lower results when context is built at a mismatched optimization level, and clang-built contexts scored slightly below GCC. FAE used 10,000 ExeBench functions limited to the standard C library, one training epoch and a single 6.7B base model; the authors did not validate it on larger datasets or models, and it slightly lowered the 1-shot result. GPT-4 and DeepSeek baselines are API snapshots that may not be reproducible.", "scope_limitations_zh": "结果为 Decompile-Eval 上的函数级可重执行率：164 道源自 HumanEval 的 C 题目，分别以 O0–O3 编译，并通过重新编译和 HumanEval 测试用例检查。通过这些测试不代表完整程序或全部输入上的等价性；论文也未评估真实二进制、其他架构或可读性。只有首次输出能够重新编译时 sc²dec 才有帮助，因此可重编译率低会限制其收益；作者报告以不匹配的优化级别构造上下文会使结果降低 1–2%，用 clang 构造的上下文得分也略低于 GCC。FAE 仅使用 10,000 个只依赖 C 标准库的 ExeBench 函数，训练一个轮次，且只基于一个 6.7B 基础模型；作者未在更大数据集或模型上验证，它还使 1-shot 结果略有下降。GPT-4 与 DeepSeek 基线是 API 快照，未必可复现。", "targets": [ "binary" ], "title": "Self-Constructed Context Decompilation with Fined-grained Alignment Enhancement", "title_zh": "自构造上下文反编译与细粒度对齐增强", "url": "https://aclanthology.org/2024.findings-emnlp.385/", "venue": "Findings of EMNLP 2024", "verification": "source-reviewed", "verified_at": "2026-10-18", "why_fits_en": "Adds recompilation feedback and debug-information alignment to end-to-end LLM decompilation, complementing LLM4Decompile and execution-checked decompilation benchmarks.", "why_fits_zh": "为端到端大语言模型反编译补充重新编译反馈与调试信息对齐方法，与 LLM4Decompile 及基于执行检查的反编译基准互补。", "year": 2024 }, { "arxiv_id": "2609.39140", "arxiv_version_reviewed": "v1", "authors": [ "Guanning Zeng", "Jiani Wang", "Wenjie Ma", "Shaofeng Yin", "Chenyang Wang", "Shichen Liu", "Angjoo Kanazawa", "Wode Ni", "Xiuyu Li", "Andrea Zanette", "Haiwen Feng" ], "code_url": "https://github.com/guanning03/Schema", "date_basis": "arXiv v1 first-submission date; the July project announcement and October repository revision are separate.", "date_basis_zh": "采用 arXiv v1 首次提交日期；七月项目公告及十月仓库版本单独区分。", "date_precision": "day", "description_en": "Infers executable models of game state and transition rules from interaction. Agents revise these models against recorded history, search within them, and compare predicted observations with real outcomes while executing plans.", "description_zh": "通过交互推断可执行的游戏状态与转移规则模型。智能体依据已记录的历史修订模型，在模型中搜索方案，并在执行计划时将预测观察与真实结果比较。", "doi": "10.48550/arxiv.2609.39140", "entry_url": "https://awesomerea.org/papers/paper-schema-program-induction/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-schema-program-induction/", "evidence_urls": [ "https://arxiv.org/abs/2609.39140", "https://arxiv.org/html/2609.39140v1", "https://api.datacite.org/dois/10.48550/arxiv.2609.39140", "https://schema-harness.github.io/", "https://guanning03.github.io/schema-webpage/", "https://github.com/guanning03/Schema/blob/84c075fadfe937b97a3d1ad2acb42d1233f55ffe/README.md", "https://github.com/guanning03/Schema/blob/84c075fadfe937b97a3d1ad2acb42d1233f55ffe/LICENSE", "https://huggingface.co/datasets/schema-harness/arc-agi-3-schema-traces/blob/0a0858a9e61a68d1e83142d9e4e3d66fc779c403/README.md" ], "first_arxiv_date": "2026-09-30", "id": "paper-schema-program-induction", "kind": "research", "metadata_notes": "The eleven-author v1 list and title match arXiv and the current project. DataCite registered the arXiv DOI on 2026-10-01; the article uses arXiv’s non-exclusive distribution license. The author-linked MIT code was inspected at 84c075fadfe937b97a3d1ad2acb42d1233f55ffe. Benchmark engines/services retain separate requirements. The linked trace dataset README at 0a0858a9e61a68d1e83142d9e4e3d66fc779c403 describes 50 July ARC trajectories, including a mixed-model collection; it is not verified as the complete September-paper release. No trace-data license was verified. No trace archives, models or benchmark engines were downloaded or executed.", "metadata_notes_zh": "arXiv 与当前项目页面的标题及 v1 十一位作者名单一致。DataCite 于 2026-10-01 登记 arXiv DOI；论文使用 arXiv 非独占分发许可。作者链接的 MIT 代码固定核查于 84c075fadfe937b97a3d1ad2acb42d1233f55ffe，基准引擎与服务另有使用条件。所链轨迹数据集在 0a0858a9e61a68d1e83142d9e4e3d66fc779c403 的 README 描述七月的 50 条 ARC 轨迹，其中一组混用不同模型；未确认为九月论文的完整实验发布，也未核实轨迹数据许可。本次未下载或运行轨迹存档、模型或基准引擎。", "pdf_url": "https://arxiv.org/pdf/2609.39140v1", "project_url": "https://guanning03.github.io/schema-webpage/", "publication_date": "2026-09-30", "publication_status": "preprint", "runtime_tested": false, "scope_limitations_en": "Evaluation uses 25 public ARC-AGI-3 games, 21 public DiG-bench games and MazeBench. Matching recorded transitions establishes history consistency, not original-source recovery or correctness on unseen states. RHAE measures completion and environment-action efficiency, not elapsed time or total computation. Component ablations cover ten ARC games; MazeBench compares recorded trajectories with a leaderboard median rather than a controlled human experiment. Transfer to arbitrary software or stochastic environments is not demonstrated.", "scope_limitations_zh": "评测使用 25 个公开 ARC-AGI-3 游戏、21 个公开 DiG-bench 游戏及 MazeBench。匹配已记录的状态转移只说明与历史一致，不代表恢复原始源码或在未见状态上正确。RHAE 衡量完成度与环境动作效率，不是耗时或总计算量。组件消融覆盖十个 ARC 游戏；MazeBench 将记录轨迹与排行榜中位数比较，并非受控人类实验。对任意软件或随机环境的迁移尚未展示。", "targets": [ "game" ], "title": "Schema: Discovering Unknown Environments via Agentic Program Induction", "title_zh": "Schema：通过智能体程序归纳发现未知环境机制", "url": "https://arxiv.org/abs/2609.39140", "venue": "arXiv", "verification": "source-reviewed", "verified_at": "2026-10-20", "why_fits_en": "Provides a concrete observation-to-program-and-replay loop for black-box behavioral reconstruction, while distinguishing a useful predictive model from a complete game clone.", "why_fits_zh": "为黑盒行为重建提供具体的“观察—程序—回放”闭环，并区分有用的预测模型与完整游戏复刻。", "year": 2026 }, { "arxiv_id": "2507.22827", "arxiv_version_reviewed": "v2", "authors": [ "Yilei Jiang", "Yaozhi Zheng", "Yuxuan Wan", "Jiaming Han", "Qunzhong Wang", "Michael R. Lyu", "Xiangyu Yue" ], "code_url": "https://github.com/leigest519/ScreenCoder", "date_basis": "The official EMNLP 2026 detailed program lists a main-conference poster, verifying acceptance; no proceedings publication date is asserted.", "date_basis_zh": "EMNLP 2026 官方详细日程列出了该论文的主会海报报告，可确认已被接收；不推定论文集的出版日期。", "date_precision": "year", "description_en": "Splits screenshot-to-code generation among grounding, planning and generation agents that label UI regions, build a hierarchical layout tree and write HTML/CSS. The pipeline also produces the Screen-10K training pairs used for supervised and reinforcement fine-tuning, and the paper introduces the 1,000-page ScreenBench.", "description_zh": "将截图到代码的生成分配给定位、规划和生成三个智能体，分别标注界面区域、构建层级布局树并编写 HTML/CSS。该流程还生成了用于监督微调和强化学习的 Screen-10K 训练数据；论文另提出包含 1,000 个网页的 ScreenBench。", "doi": null, "entry_url": "https://awesomerea.org/papers/paper-screencoder/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-screencoder/", "evidence_urls": [ "https://arxiv.org/abs/2507.22827", "https://2026.emnlp.org/program/", "https://docs.google.com/spreadsheets/d/1aXGTy_7Xeh-OXIs3iJSbDpUsZ6YhbfA76b17kBZH0Yk/edit?gid=943432490#gid=943432490", "https://openreview.net/forum?id=29VraifZkB", "https://github.com/leigest519/ScreenCoder/blob/22816fdfb4ee5982973f9a09d67498a64823e65d/README.md", "https://github.com/leigest519/ScreenCoder/blob/22816fdfb4ee5982973f9a09d67498a64823e65d/LICENSE", "https://jimmyzhengyz.github.io/ScreenCoder-Project-Page/", "https://huggingface.co/datasets/Leigest/ScreenCoder/blob/b0e49d2a5d937e93f712d4c281d4036ec2652a30/README.md" ], "first_arxiv_date": "2025-07-30", "id": "paper-screencoder", "kind": "research", "metadata_notes": "The official EMNLP 2026 detailed program lists paper 7281-MAIN as a poster on 2026-10-26; this records acceptance, not proceedings publication. The arXiv v2 comment 'ScreenCoder-v2' is a version label, not a venue, and an earlier ICLR 2026 submission was withdrawn. The abstract-linked repository is Apache-2.0 at the pinned commit and bundles UIED, LLaMA-Factory and VLM-R1 code with their own license files. ScreenBench is published on Hugging Face under Apache-2.0.", "metadata_notes_zh": "EMNLP 2026 官方详细日程将论文 7281-MAIN 列为 2026-10-26 的海报报告；本条记录接收状态，不视为论文集已出版。arXiv v2 备注“ScreenCoder-v2”是版本标签而非会议名称；此前提交 ICLR 2026 的版本已撤回。摘要所链接的仓库在固定提交中采用 Apache-2.0 许可，并内含带有各自许可证文件的 UIED、LLaMA-Factory 与 VLM-R1 代码。ScreenBench 以 Apache-2.0 许可发布于 Hugging Face。", "pdf_url": "https://arxiv.org/pdf/2507.22827v2", "project_url": "https://jimmyzhengyz.github.io/ScreenCoder-Project-Page/", "publication_date": null, "publication_status": "conference-accepted", "runtime_tested": false, "scope_limitations_en": "Output is static HTML/CSS layout; interaction, JavaScript behavior and backend logic are not reconstructed. Results are visual-similarity scores (CLIP and OCR-matched text blocks) on ScreenBench and Design2Code, which do not establish code-level or functional equivalence. The released pipeline calls a hosted model API, Doubao by default. The reviewed text is arXiv v2; the accepted EMNLP version may differ.", "scope_limitations_zh": "输出为静态 HTML/CSS 布局，不重建交互、JavaScript 行为或后端逻辑。结果是 ScreenBench 与 Design2Code 上的视觉相似度分数（CLIP 及经 OCR 匹配的文本块），不能证明代码层面或功能上的等价。公开流程需调用托管模型 API，默认使用豆包（Doubao）。审阅文本为 arXiv v2，EMNLP 接收版本可能有所不同。", "targets": [ "website" ], "title": "ScreenCoder: Advancing Visual-to-Code Generation for Front-End Automation via Modular Multimodal Agents", "title_zh": "ScreenCoder：以模块化多模态智能体推进面向前端自动化的视觉到代码生成", "url": "https://arxiv.org/abs/2507.22827", "venue": "EMNLP 2026", "verification": "source-reviewed", "verified_at": "2026-10-17", "why_fits_en": "Represents staged, agent-based screenshot-to-code reconstruction for websites, separating visual grounding and layout planning from code synthesis.", "why_fits_zh": "代表分阶段、基于智能体的网站截图到代码重建方法，将视觉定位和布局规划与代码生成分开处理。", "year": 2026 }, { "arxiv_id": "2601.20679", "arxiv_version_reviewed": "v1", "authors": [ "Mingqiao Mo", "Yunlong Tan", "Hao Zhang", "Heng Zhang", "Yangfan He" ], "code_url": null, "date_basis": "Publication year stated by the official ICLR proceedings; no finer publication date is asserted. The proceedings page's citation date of 2026-04-20 is not adopted, and the arXiv date is not substituted.", "date_basis_zh": "采用 ICLR 官方论文集标明的出版年份，不主张更精确的出版日期。本条目不采用论文集页面中 2026-04-20 的引用日期，也不以 arXiv 日期替代。", "date_precision": "year", "description_en": "ShieldedCode studies software protection from the defender's side: it trains code language models on pairs of C source functions and their virtualization-protected (VMP) x86-64 code so that the models can generate, compare and rank protected variants. Training pairs come from AnghaBench functions compiled at O0–O3, protected at levels L0–L3 by a commercial VMP tool, then disassembled and normalized. The model adds attention masks for dependencies within, between adjacent and across virtual instructions, contrastive objectives for functional equivalence and protection strength, and a protection-effectiveness task that ranks variants of the same source. Continual pre-training starts from CodeLlama 34B and adds The Stack to the corpus, and fine-tuning uses 2.5 million source–VM pairs. On HumanEval-compile, VM code generation reaches 26.95% Pass@1 at level L0 (GPT-4o: 22.58%) and 14.71% at L3. On BinaryCorp-VirtualAssembly similarity detection, Recall@1 for the O0+L1 setting is 0.488, against 0.333 for jTrans with a linear probe. The authors also run a manual reverse-engineering study and pattern-matching and angr attacks on the generated protection.", "description_zh": "ShieldedCode 从防御方角度研究软件保护：它以 C 源代码函数及其经虚拟化保护（VMP）后的 x86-64 代码组成的配对数据训练代码语言模型，使模型能够生成、比较和排序受保护的变体。训练配对取自 AnghaBench 函数，经 O0–O3 编译后由一款商业 VMP 工具按 L0–L3 级别保护，再反汇编并规范化。模型为单条虚拟指令内部、相邻虚拟指令之间以及跨虚拟指令的依赖加入注意力掩码，采用面向功能等价和保护强度的对比学习目标，并设置对同一源代码不同变体排序的保护效果任务。持续预训练从 CodeLlama 34B 起步，语料另加入 The Stack；微调使用 250 万组源代码—虚拟机代码配对。在 HumanEval-compile 上，L0 级虚拟机代码生成的 Pass@1 为 26.95%（GPT-4o 为 22.58%），L3 级为 14.71%。在 BinaryCorp-VirtualAssembly 相似性检测中，O0+L1 设置下的 Recall@1 为 0.488，采用线性探针的 jTrans 为 0.333。作者还对生成的保护代码开展了人工逆向研究，以及模式匹配和 angr 攻击。", "doi": null, "entry_url": "https://awesomerea.org/papers/paper-shieldedcode/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-shieldedcode/", "evidence_urls": [ "https://proceedings.iclr.cc/paper_files/paper/2026/hash/286976486c9bbfa2c2069b01b259b19d-Abstract-Conference.html", "https://proceedings.iclr.cc/paper_files/paper/2026/file/286976486c9bbfa2c2069b01b259b19d-Paper-Conference.pdf", "https://arxiv.org/abs/2601.20679", "https://arxiv.org/pdf/2601.20679v1", "https://openreview.net/forum?id=9F9UFVcDkV" ], "first_arxiv_date": "2026-01-28", "id": "paper-shieldedcode", "kind": "research", "metadata_notes": "The ICLR proceedings page lists the five authors in this order, pages 23529–23552 and no DOI; its PDF carries the header \"Published as a conference paper at ICLR 2026\". arXiv has only v1, dated 2026-01-28, with the comment \"Accepted to ICLR 2026\". The OpenReview forum 9F9UFVcDkV returned a browser challenge to automated requests, so its presentation type is not recorded. Neither the paper nor the proceedings page links code, models or data; the reproducibility statement only says the implementation uses PyTorch and open-source libraries, and code_url is null. A same-name GitHub repository, Clon5676/ShieldedCode, is an unrelated Unreal Engine project and is not linked. The commercial tool used to build the training data is unnamed; VMProtect and Themida appear only as comparisons in the resistance study. No code or experiments were run.", "metadata_notes_zh": "ICLR 论文集页面按此顺序列出五位作者，页码为 23529–23552，没有 DOI；其 PDF 页眉为“Published as a conference paper at ICLR 2026”。arXiv 只有 v1，发布于 2026-01-28，注释为“Accepted to ICLR 2026”。OpenReview 论坛 9F9UFVcDkV 对自动请求返回浏览器验证，因此本条目不记录其报告类型。论文与论文集页面均未链接代码、模型或数据；可复现性声明只说明实现基于 PyTorch 与开源库，因此 code_url 为 null。GitHub 上同名仓库 Clon5676/ShieldedCode 是无关的 Unreal Engine 项目，未予链接。用于构建训练数据的商业工具未具名；VMProtect 与 Themida 仅作为抗逆向研究中的对照出现。本次未运行代码或实验。", "pdf_url": "https://proceedings.iclr.cc/paper_files/paper/2026/file/286976486c9bbfa2c2069b01b259b19d-Paper-Conference.pdf", "project_url": null, "publication_date": null, "publication_status": "conference-paper", "runtime_tested": false, "scope_limitations_en": "All data is x86-64, and every training pair is produced with one commercial VMP tool that the paper does not name, so results may not carry over to other architectures, protectors or virtual-instruction designs. Generated VM code is checked with HumanEval-compile test cases, not formal equivalence, and Pass@1 stays between 14.71% and 26.95% across protection levels. The similarity gain over jTrans holds only in the O0+L1 setting: in the other five BinaryCorp-VirtualAssembly settings the linear-probe jTrans has higher Recall@1 (for example 0.715 against 0.309 for O2+L1), and the paper's summaries of the comparison differ (a 10% gain in the abstract, 15.5 points in the introduction, competitive in the results). The ablation table reports scores for ContraBin, CLAP and CEBin that the paper says are estimated from their architectures rather than measured. Protection-strength claims rest on the authors' own attacks and manual study: 12 graduate students and 3 professional reverse engineers analyzing 20 functions for 30–45 minutes each, with 17% success on ShieldedCode output against 67% for VMProtect and 58% for Themida. ShieldedCode is not a devirtualizer or deobfuscator, and the paper links no code, models or generated training data.", "scope_limitations_zh": "全部数据均为 x86-64，所有训练配对都由论文未具名的同一款商业 VMP 工具生成，因此结果未必适用于其他架构、保护工具或虚拟指令设计。生成的虚拟机代码通过 HumanEval-compile 测试用例检验，而非形式化等价验证；各保护级别的 Pass@1 仅在 14.71% 至 26.95% 之间。相对 jTrans 的相似性优势只出现在 O0+L1 设置中：在 BinaryCorp-VirtualAssembly 的其余五种设置中，采用线性探针的 jTrans 的 Recall@1 更高（例如 O2+L1 下为 0.715，ShieldedCode 为 0.309）；论文对这一比较的概括也不一致（摘要称提升 10%，引言称提升 15.5 个百分点，结果部分则称性能相当）。消融表中 ContraBin、CLAP 与 CEBin 的得分据论文说明是依其架构估计而非实测。保护强度的结论依赖作者自行开展的攻击和人工研究：12 名研究生与 3 名专业逆向工程师分析 20 个函数，每个函数限时 30–45 分钟，对 ShieldedCode 输出的成功率为 17%，对 VMProtect 和 Themida 分别为 67% 与 58%。ShieldedCode 不是去虚拟化工具或反混淆工具，论文也未链接代码、模型或生成的训练数据。", "targets": [ "binary" ], "title": "ShieldedCode: Learning Robust Representations for Virtual Machine Protected Code", "title_zh": "ShieldedCode：学习虚拟机保护代码的鲁棒表示", "url": "https://proceedings.iclr.cc/paper_files/paper/2026/hash/286976486c9bbfa2c2069b01b259b19d-Abstract-Conference.html", "venue": "ICLR 2026", "verification": "source-reviewed", "verified_at": "2026-10-19", "why_fits_en": "Adds protection-side research that uses learned models to generate VM-protected code and to measure how it resists reversing, complementing the BAR 2026 protection study and SRE-Bench, which measure how agents cope with protected binaries.", "why_fits_zh": "补充保护方视角的研究：利用学习模型生成虚拟机保护代码并衡量其抗逆向能力，与 BAR 2026 保护研究和 SRE-Bench 这类衡量智能体如何应对受保护二进制的工作互补。", "year": 2026 }, { "arxiv_id": "2509.22114", "arxiv_version_reviewed": "v1", "authors": [ "Hanzhuo Tan", "Weihao Li", "Xiaolong Tian", "Siyi Wang", "Jiaming Liu", "Jing Li", "Yuqun Zhang" ], "code_url": "https://github.com/albertan017/LLM4Decompile/tree/85b364bf093eb2ee4f3687cfe38a203fca89f23e/sk2decompile", "date_basis": "Publication year stated by the official ICLR proceedings; no finer publication date is asserted.", "date_basis_zh": "采用 ICLR 官方论文集标明的出版年份，不推定更精确的出版日期。", "date_precision": "year", "description_en": "Splits LLM decompilation into two phases: a Structure Recovery model turns decompiler pseudocode into an identifier-free IR that keeps control flow and data structures, trained with compiler-based RL rewards, and an Identifier Naming model then restores names under a semantic-similarity reward. The authors report a 21.6% average re-executability gain over GPT-5-mini on HumanEval and a 29.4% average R2I improvement over Idioms on GitHub2025.", "description_zh": "将 LLM 反编译分为两个阶段：结构恢复模型把反编译器伪代码转换为保留控制流和数据结构、但不含标识符的中间表示，并以编译器反馈作为强化学习奖励；标识符命名模型再以语义相似度为奖励恢复名称。作者报告，其在 HumanEval 上的平均可重新执行率比 GPT-5-mini 高 21.6%，在 GitHub2025 上的平均 R2I 比 Idioms 提升 29.4%。", "doi": null, "entry_url": "https://awesomerea.org/papers/paper-sk2decompile/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-sk2decompile/", "evidence_urls": [ "https://proceedings.iclr.cc/paper_files/paper/2026/hash/9132583dd869acb0cafeb0ed25eb031a-Abstract-Conference.html", "https://proceedings.iclr.cc/paper_files/paper/2026/file/9132583dd869acb0cafeb0ed25eb031a-Paper-Conference.pdf", "https://openreview.net/forum?id=jSQPqdoidy", "https://iclr.cc/virtual/2026/poster/10007876", "https://arxiv.org/abs/2509.22114", "https://github.com/albertan017/LLM4Decompile/blob/85b364bf093eb2ee4f3687cfe38a203fca89f23e/sk2decompile/README.md", "https://github.com/albertan017/LLM4Decompile/blob/85b364bf093eb2ee4f3687cfe38a203fca89f23e/LICENSE", "https://github.com/albertan017/LLM4Decompile/blob/85b364bf093eb2ee4f3687cfe38a203fca89f23e/LICENSE-MODEL", "https://huggingface.co/LLM4Binary/sk2decompile-struct-6.7b/blob/3c173bebc9cf1d3a06b0607a743e0f0084d2a50b/README.md", "https://huggingface.co/LLM4Binary/sk2decompile-ident-6.7b/blob/62119d483580bff1a454ec2c774bad7c6086969e/README.md" ], "first_arxiv_date": "2025-09-26", "id": "paper-sk2decompile", "kind": "research", "metadata_notes": "Authors follow the proceedings PDF; the proceedings landing page writes the first author's given name as 'hanzhuo'. OpenReview lists the paper as an ICLR 2026 Poster. The September 2025 arXiv v1 is separate from ICLR 2026 publication, and the 32-page proceedings version adds appendix experiments. Code is the sk2decompile directory of the LLM4Decompile repository. License signals differ by source: the repository LICENSE is MIT, both 6.7B model cards are tagged MIT, and the repository also carries a DeepSeek LICENSE-MODEL; both models are initialized from LLM4Decompile-6.7B. No single license is asserted.", "metadata_notes_zh": "作者以论文集 PDF 为准；论文集网页将第一作者的名字写作小写的“hanzhuo”。OpenReview 将其列为 ICLR 2026 Poster。2025 年 9 月的 arXiv v1 与 ICLR 2026 发表分开记录，32 页的论文集版本增加了附录实验。代码位于 LLM4Decompile 仓库的 sk2decompile 目录。各来源的许可信息不同：仓库 LICENSE 为 MIT，两个 6.7B 模型卡均标注 MIT，仓库另附 DeepSeek LICENSE-MODEL；两个模型均从 LLM4Decompile-6.7B 初始化。本条不认定统一许可。", "pdf_url": "https://proceedings.iclr.cc/paper_files/paper/2026/file/9132583dd869acb0cafeb0ed25eb031a-Paper-Conference.pdf", "project_url": null, "publication_date": null, "publication_status": "conference-paper", "runtime_tested": false, "scope_limitations_en": "Training and main evaluation use function-level C compiled for x86-64 Linux with GCC and Clang at -O0 to -O3, with IDA Pro pseudocode as model input. Re-executability is measured only on HumanEval and MBPP; ExeBench and GitHub2025 use R2I readability and a GPT-5-mini judge. Appendix experiments extend to BringUpBench projects, macOS arm64 and Windows MSVC builds, and Obfuscator-LLVM, but the models are trained on C only and the paper expects them to degrade on features without C equivalents, such as C++ templates.", "scope_limitations_zh": "训练和主要评测均使用函数级 C 代码，以 GCC 和 Clang 在 -O0 至 -O3 下编译为 x86-64 Linux 二进制，并以 IDA Pro 伪代码作为模型输入。可重新执行率仅在 HumanEval 和 MBPP 上测量；ExeBench 与 GitHub2025 采用 R2I 可读性指标和 GPT-5-mini 评审。附录实验扩展到 BringUpBench 项目、macOS arm64 与 Windows MSVC 构建以及 Obfuscator-LLVM，但模型仅以 C 代码训练，论文预计遇到 C++ 模板等没有 C 对应物的语言特性时效果会下降。", "targets": [ "binary" ], "title": "SK2Decompile: LLM-based Two-Phase Binary Decompilation from Skeleton to Skin", "title_zh": "SK2Decompile：从骨架到皮肤的大语言模型两阶段二进制反编译", "url": "https://proceedings.iclr.cc/paper_files/paper/2026/hash/9132583dd869acb0cafeb0ed25eb031a-Abstract-Conference.html", "venue": "ICLR 2026", "verification": "source-reviewed", "verified_at": "2026-10-17", "why_fits_en": "Adds a recent LLM decompiler that separates structural correctness from identifier recovery, extending the LLM4Decompile line of work.", "why_fits_zh": "补充一种较新的 LLM 反编译方法，将结构正确性与标识符恢复分开处理，延续了 LLM4Decompile 系列工作。", "year": 2026 }, { "arxiv_id": "2305.12520", "arxiv_version_reviewed": "v3", "authors": [ "Jordi Armengol-Estapé", "Jackson Woodruff", "Chris Cummins", "Michael F. P. O'Boyle" ], "citation": { "container_title": "2024 IEEE/ACM International Symposium on Code Generation and Optimization (CGO)", "pages": "67-80", "publisher": "IEEE", "sources": [ "https://api.crossref.org/works/10.1109/CGO57630.2024.10444788", "https://www.research.ed.ac.uk/en/publications/slade-a-portable-small-language-model-decompiler-for-optimized-as/" ] }, "code_url": "https://zenodo.org/records/10205121", "date_basis": "IEEE’s Crossref deposit gives published/print date 2024-03-02. Edinburgh’s publication record instead gives 2024-02-28, also the DOI-creation date. This entry uses the publisher-deposited print date and does not infer it solely from the conference schedule.", "date_basis_zh": "IEEE 提交的 Crossref 元数据将 published／纸质出版日期记为 2024-03-02；爱丁堡大学出版记录则给出 2024-02-28，这也是 DOI 创建日期。本条目采用出版方提交的纸质出版日期，并非仅依据会议日程推定。", "date_precision": "day", "description_en": "SLaDe translates function-level assembly into C with a 200M-parameter encoder–decoder model, code-specific tokenization and PsycheC type completion. It studies x86 and ARM at -O0 and -O3, combining generated candidates with input/output checks. The input is assembly text, not raw machine bytes; disassembly is outside the method.", "description_zh": "SLaDe 使用 200M 参数的编码器—解码器模型、面向代码的分词及 PsycheC 类型补全，将函数级汇编转换为 C。研究覆盖 x86 与 ARM 的 -O0、-O3 设置，并结合生成候选与输入／输出检查。输入是汇编文本而非原始机器字节，反汇编不属于该方法。", "doi": "10.1109/CGO57630.2024.10444788", "entry_url": "https://awesomerea.org/papers/paper-slade/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-slade/", "evidence_urls": [ "https://ieeexplore.ieee.org/document/10444788", "https://api.crossref.org/works/10.1109/CGO57630.2024.10444788", "https://www.research.ed.ac.uk/en/publications/slade-a-portable-small-language-model-decompiler-for-optimized-as/", "https://conf.researchr.org/details/cgo-2024/cgo-2024-main-conference/17/SLaDe-A-Portable-Small-Language-Model-Decompiler-for-Optimized-Assembly", "https://arxiv.org/abs/2305.12520", "https://arxiv.org/pdf/2305.12520v3", "https://zenodo.org/records/10205121", "https://zenodo.org/api/records/10205121", "https://zenodo.org/api/records/10205121/files/LICENSE/content" ], "first_arxiv_date": "2023-05-21", "id": "paper-slade", "kind": "research", "metadata_notes": "Reviewed arXiv v3 dated 2024-02-15, the accepted CGO manuscript; publication metadata establishes the final venue and pages. Paper reference 65 links the Zenodo artifact. Its separate LICENSE restricts included code/data/models to paper reproducibility and calls it nonproduction research code; no permissive license is inferred. The 1.83 GB archive was not downloaded or inspected. Appendix prerequisites include Python 3.8, PyTorch 1.10.2, Transformers 4.22.2, PsycheC, Haskell Stack and an AArch64 GCC toolchain. BTC weights are not redistributed and ChatGPT outputs may change. These are documented historical requirements, not a verified installation; no code or experiments were run.", "metadata_notes_zh": "审阅 2024-02-15 发布的 arXiv v3，即 CGO 接收稿；出版元数据确认最终发表场所及页码。论文参考文献 65 链接至 Zenodo 产物，其独立 LICENSE 将所含代码／数据／模型限定用于论文复现，并说明这是不适合生产环境的研究代码，不能据此推定宽松许可。未下载或检查 1.83 GB 压缩包。附录列出的前提包括 Python 3.8、PyTorch 1.10.2、Transformers 4.22.2、PsycheC、Haskell Stack 及 AArch64 GCC 工具链。产物不再分发 BTC 权重，ChatGPT 输出也可能变化。这些是文档中的历史要求，并非已验证的安装环境；本次未运行代码或实验。", "pdf_url": "https://arxiv.org/pdf/2305.12520v3", "project_url": null, "publication_date": "2024-03-02", "publication_status": "conference-paper", "runtime_tested": false, "scope_limitations_en": "Evaluation covers about 4,000 ExeBench functions and a 112-program synthesis suite. Beam size 5 selects the first candidate passing finite I/O tests; generated functions are inserted into the original calling context. Passing these tests is not whole-program or all-input equivalence. Edit similarity is a readability proxy. Longer functions, external calls and incorrect type/operator predictions remain failure modes; the model has 1,024-position source and target windows. Historical baseline comparisons have different coverage and do not establish current rankings.", "scope_limitations_zh": "评测覆盖约 4,000 个 ExeBench 函数及含 112 个程序的合成基准。束宽为 5，并选择首个通过有限输入／输出测试的候选；生成函数被放回原始调用上下文。通过这些测试不代表完整程序或全部输入上的等价性。编辑相似度只是可读性的代理指标。较长函数、外部调用及错误的类型／运算符预测仍会导致失败；模型的输入和输出窗口均为 1,024 个位置。历史基线比较的覆盖范围不同，不能据此确立当前排名。", "targets": [ "binary" ], "title": "SLaDe: A Portable Small Language Model Decompiler for Optimized Assembly", "title_zh": "SLaDe：面向优化汇编的可移植小语言模型反编译器", "url": "https://ieeexplore.ieee.org/document/10444788", "venue": "IEEE/ACM CGO 2024", "verification": "source-reviewed", "verified_at": "2026-10-18", "why_fits_en": "Adds type-inference-assisted neural decompilation with explicit execution-based evaluation, complementing symbol recovery and later LLM decompilation studies.", "why_fits_zh": "补充结合类型推断与执行结果评测的神经反编译方法，与符号恢复及后续大语言模型反编译研究互补。", "year": 2024 }, { "arxiv_id": "2606.17398", "arxiv_version_reviewed": "v2", "authors": [ "Yujeong Kwon", "Yiyue Zhang", "Kexin Pei", "Dokyung Song", "Hyungjoon Koo" ], "code_url": null, "date_basis": "arXiv v1 submission; the reviewed v2 revision of 2026-09-04 does not change the first-submission date.", "date_basis_zh": "arXiv v1 首次提交日期；所审阅的 2026-09-04 v2 修订版不改变首次提交日期。", "date_precision": "day", "description_en": "A systematization-of-knowledge survey of machine-learning, LLM and agentic approaches to binary reversing. Version 2 collects 246 papers published since 2015, found through keyword searches of 11 security, software-engineering and AI venues plus citation snowballing, and organizes them into 22 domains by inference task: from code-boundary detection and recovery of function names, types and struct layouts to code similarity, malware and vulnerability analysis, and decompilation. Its taxonomy links conventional triage, static, dynamic and security-testing analyses to AI pipelines through the binary-derived artifacts they exchange, and it derives 12 insights and open directions such as binary-aligned ground truth and goal-driven agentic reversing.", "description_zh": "一篇系统化知识综述，梳理机器学习、大语言模型与智能体方法在二进制逆向中的应用。第二版通过关键词检索 11 个安全、软件工程与人工智能会议并辅以引文滚雪球，收集 2015 年以来的 246 篇论文，按推断任务归入 22 个领域：从代码边界检测，到函数名、类型与结构体布局恢复，再到代码相似性、恶意软件与漏洞分析以及反编译。其分类体系通过二进制派生的分析产物，把传统的初筛、静态分析、动态分析与安全测试同人工智能流程联系起来，并总结出 12 条洞见及若干开放方向，例如与二进制对齐的语义真值和目标驱动的智能体逆向。", "doi": null, "entry_url": "https://awesomerea.org/papers/paper-sok-ai-binary-reversing/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-sok-ai-binary-reversing/", "evidence_urls": [ "https://arxiv.org/abs/2606.17398v2", "https://arxiv.org/pdf/2606.17398v2", "https://arxiv.org/abs/2606.17398v1", "https://arxiv.org/pdf/2606.17398v1", "https://sok-aire.vercel.app" ], "first_arxiv_date": "2026-06-16", "id": "paper-sok-ai-binary-reversing", "kind": "research", "metadata_notes": "Reviewed arXiv v2 (2026-09-04; comment “21 pages, 7 tables, 4 figures”), which lists five authors and 246 papers; this record follows the v2 author list. v1 (2026-06-16; “20 pages, 7 tables, 3 figures”) listed six authors, Yujeong Kwon, Yiyue Zhang, Shakhzod Yuldoshkhujaev, Kexin Pei, Dokyung Song and Hyungjoon Koo, and analyzed 144 papers published between 2015 and 2025. Neither version states a venue or journal reference. Footnote 1 in both versions links the companion site, an interactive JavaScript table of the surveyed papers grouped by domain with links to their publications; no source repository is linked, so code_url is null. The site and its paper list may change after this review. No experiments or site code were run.", "metadata_notes_zh": "审阅 arXiv v2（2026-09-04；备注为“21 pages, 7 tables, 4 figures”），该版列出五位作者及 246 篇论文；本条目采用 v2 的作者列表。v1（2026-06-16；“20 pages, 7 tables, 3 figures”）列出六位作者：Yujeong Kwon、Yiyue Zhang、Shakhzod Yuldoshkhujaev、Kexin Pei、Dokyung Song 与 Hyungjoon Koo，并分析了 2015 至 2025 年发表的 144 篇论文。两个版本均未注明发表场所或期刊信息。两版的脚注 1 都链接到配套网站，这是一个按领域分组列出所综述论文并链接其出版页面的交互式 JavaScript 表格；未链接源码仓库，因此 code_url 为空。网站及其论文列表可能在本次审阅后变化。本次未运行任何实验或网站代码。", "pdf_url": "https://arxiv.org/pdf/2606.17398v2", "project_url": "https://sok-aire.vercel.app", "publication_date": "2026-06-16", "publication_status": "preprint", "runtime_tested": false, "scope_limitations_en": "A literature systematization with no new experiments, benchmark or tool; it classifies and summarizes reported results without reproducing them. The corpus covers papers available up to July 31, 2026, applies citation thresholds that fall from 12 for 2015–2016 papers to 2 for 2025–2026 papers, excludes methods that need source code at inference time, and leaves out Android and interpreted-language bytecode. Detailed per-stage tables draw on 88 top-venue studies rather than the full corpus. It is an arXiv preprint with no stated venue, and this record makes no claim of peer review. Papers it cites are not thereby part of this collection; each needs its own review.", "scope_limitations_zh": "这是一篇文献系统化综述，不包含新的实验、基准或工具；它对已报告的结果进行分类和总结，并未复现。语料涵盖截至 2026 年 7 月 31 日可获得的论文，引用量门槛从 2015—2016 年论文的 12 次逐步降至 2025—2026 年论文的 2 次，排除推断时需要源码的方法，也不包括 Android 与解释型语言字节码。各阶段的详细表格基于 88 项顶级会议研究，而非完整语料。它是未注明发表场所的 arXiv 预印本，本条目不声称其经过同行评审。其引用的论文并不因此纳入本合集，每篇都需要单独审阅。", "targets": [ "binary" ], "title": "SoK: AI-Augmented Binary Reversing", "title_zh": "SoK：人工智能增强的二进制逆向工程", "url": "https://arxiv.org/abs/2606.17398", "venue": "arXiv", "verification": "source-reviewed", "verified_at": "2026-10-18", "why_fits_en": "Provides a structured map of ML, LLM and agent research across binary reversing tasks, helping place the collection’s binary-analysis papers and locate related work that still needs individual review.", "why_fits_zh": "为跨二进制逆向任务的机器学习、大语言模型与智能体研究提供结构化地图，有助于定位本合集中的二进制分析论文，并找出仍需逐篇审阅的相关工作。", "year": 2026 }, { "arxiv_id": "2610.11556", "arxiv_version_reviewed": "v1", "authors": [ "Varun Kohli", "Lee Bing Cheng", "Nur Hazim Ghazali", "Gao Yuze", "Daryl Poon", "Dinil Mon Divakaran" ], "code_url": "https://anonymous.4open.science/r/decompbench-65CB/", "date_basis": "First arXiv submission date; no separate proceedings or journal publication was verified.", "date_basis_zh": "采用 arXiv 首次提交日期；未核实另行出版的会议论文集或期刊版本。", "date_precision": "day", "description_en": "This SoK organizes LLM-assisted source-recovery designs and separates compilation, readability, structural and behavioral metrics. Its controlled study varies architecture, compiler optimization and symbol availability, with smaller ablations for input representation, model roles and source language.", "description_zh": "该 SoK 组织 LLM 辅助源码恢复方案，并区分编译、可读性、结构与行为指标。受控研究改变架构、编译优化及符号状态，并以较小的消融实验考察输入表示、模型角色和源语言。", "doi": null, "entry_url": "https://awesomerea.org/papers/paper-sok-source-recovery-reliability/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-sok-source-recovery-reliability/", "evidence_urls": [ "https://arxiv.org/abs/2610.11556v1", "https://arxiv.org/html/2610.11556v1", "https://anonymous.4open.science/r/decompbench-65CB/README.md", "https://anonymous.4open.science/api/repo/decompbench-65CB/file/README.md?v=3a7167f7" ], "first_arxiv_date": "2026-10-08", "id": "paper-sok-source-recovery-reliability", "kind": "research", "metadata_notes": "The arXiv v1 article is CC BY 4.0. Its anonymous artifact was readable in a browser; the page shows an October 1 snapshot available until 2027-03-29, without a full Git commit. The inspected README says a fresh database cannot directly re-score shipped generation files; redrawing supplied CSV results is a separate step. Artifact licensing was not established from the inspected README/root list. No archive, model or experiment was run.", "metadata_notes_zh": "arXiv v1 文章采用 CC BY 4.0。匿名产物可在浏览器中读取，页面显示 10 月 1 日快照、开放至 2027-03-29，但未暴露完整 Git 提交。已读 README 说明新数据库无法直接对所附生成文件重新评分，重画已有 CSV 结果属于另一层步骤。所查 README 及根目录未确立产物许可。本次未运行归档、模型或实验。", "pdf_url": "https://arxiv.org/pdf/2610.11556v1", "project_url": null, "publication_date": "2026-10-08", "publication_status": "preprint", "runtime_tested": false, "scope_limitations_en": "The 45,000 cases are variants of 500 functions, not independent programs. Input/language ablations use 50 functions; translated language variants were produced with an LLM and checked using finite I/O tests. The study assumes a derivable call interface, is prompt-sensitive and cannot exclude ExeBench pretraining exposure. Test agreement and relocation-masked byte matching have different assumptions.", "scope_limitations_zh": "45,000 个案例是 500 个函数的变体，并非独立程序。输入／语言消融使用 50 个函数，跨语言变体由 LLM 翻译后以有限 I/O 测试检查。研究假设调用接口可推导，结果受提示影响，也无法排除 ExeBench 进入预训练。测试一致性与屏蔽重定位位置的字节匹配具有不同假设。", "targets": [ "binary" ], "title": "SoK: Are LLMs Reliable at Source Code Recovery? A Taxonomy and Empirical Evaluation", "title_zh": "SoK：LLM 恢复源码是否可靠？分类体系与实证评估", "url": "https://arxiv.org/abs/2610.11556", "venue": "arXiv", "verification": "source-reviewed", "verified_at": "2026-10-20", "why_fits_en": "Adds a recent evaluation taxonomy and controlled evidence for comparing source-recovery methods without collapsing distinct correctness signals.", "why_fits_zh": "补充近期评估分类与受控证据，用于比较源码恢复方法，并避免混同不同正确性信号。", "year": 2026 }, { "arxiv_id": "2604.18591", "arxiv_version_reviewed": "v1", "authors": [ "Yunshu Bai", "RuiHao Li", "Hao Zhang", "Chien Her Lim", "Ming Yan", "Mengtian Li" ], "code_url": null, "date_basis": "Crossref publisher-deposited online publication date", "date_basis_zh": "Crossref 中由出版方提供的在线出版日期。", "date_precision": "day", "description_en": "Transforms game-interface screenshots into editable engine assets through hierarchical YAML, visual grounding, asset extraction, and Unity UXML/USS synthesis, with evaluation on a curated game-UI benchmark and review by three senior UI/UX designers.", "description_zh": "通过层级化 YAML、视觉定位、素材提取和 Unity UXML／USS 生成，将游戏界面截图转化为可编辑的引擎资源，并在精选游戏界面基准上评估，由三位资深 UI／UX 设计师进行审阅。", "doi": "10.1145/3772363.3798742", "entry_url": "https://awesomerea.org/papers/paper-sprite-game-ui/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-sprite-game-ui/", "evidence_urls": [ "https://arxiv.org/abs/2604.18591", "https://arxiv.org/html/2604.18591v1", "https://api.crossref.org/works/10.1145/3772363.3798742", "https://baiyunshu.github.io/sprite.github.io/" ], "first_arxiv_date": "2026-03-18", "id": "paper-sprite-game-ui", "kind": "research", "metadata_notes": "Published as a CHI 2026 poster/extended abstract. The publisher title has “SPRITE:From” and “GameUI”; arXiv and the project page normalize these spaces. arXiv/Hugging Face report a March 18 first submission despite the 2604 identifier; the April 13 publication date is independently verified in Crossref. No implementation link is verified.", "metadata_notes_zh": "发表于 CHI 2026 海报／扩展摘要集。出版方标题使用“SPRITE:From”和“GameUI”，arXiv 与项目页采用常规空格。虽然编号以 2604 开头，arXiv／Hugging Face 记载首次提交为 3 月 18 日；4 月 13 日出版日期已在 Crossref 独立核实。未核实实现代码链接。", "pdf_url": "https://baiyunshu.github.io/sprite.github.io/Source/chiea26-516.pdf", "project_url": "https://baiyunshu.github.io/sprite.github.io/", "publication_date": "2026-04-13", "publication_status": "conference-paper", "runtime_tested": false, "scope_limitations_en": "The generated interactions cover basic hover, toggle, and click behavior. Complex temporal and drag-and-drop logic remain outside scope, and translucent overlap or ambiguous diegetic layouts can fail. This is game-UI prototyping, not complete gameplay reconstruction; the official page still labels code as coming soon.", "scope_limitations_zh": "生成的交互覆盖基本悬停、切换和点击行为，复杂时序与拖放逻辑仍不在范围内；半透明重叠元素或边界不明确的场景内界面可能处理失败。这是游戏界面原型重建，不是完整玩法重建；官方页面仍标注代码即将发布。", "targets": [ "game" ], "title": "SPRITE: From Static Mockups to Engine-Ready Game UI", "title_zh": "SPRITE：从静态设计稿重建可用于游戏引擎的界面", "url": "https://doi.org/10.1145/3772363.3798742", "venue": "CHI EA 2026 (poster/extended abstract)", "verification": "source-reviewed", "verified_at": "2026-10-16", "why_fits_en": "Adds game-specific screenshot-to-engine reconstruction while distinguishing visual and structural recovery from full game behavior.", "why_fits_zh": "补充游戏领域从截图到引擎的重建研究，并区分视觉与结构恢复和完整游戏行为。", "year": 2026 }, { "arxiv_id": "2608.11469", "arxiv_version_reviewed": "v2", "authors": [ "Jeremy Spence", "Nicholas Assaderaghi", "Feng Xiao", "Jinhao Zhu", "Nikil Ravi", "Xiangyu Qi", "Matthew Jagielski", "Raluca Ada Popa", "Eric Wallace", "Guannan Wei", "Yangruibo Ding", "Zhuo Zhang" ], "code_url": null, "date_basis": "arXiv v1 submission; summary and author list use revised v2", "date_basis_zh": "arXiv v1 首次提交日期；摘要与作者名单依据修订版 v2。", "date_precision": "day", "description_en": "Introduces SRE-Bench, with privately authored programs and protected binary variants, to study agent recovery of program semantics while reducing training-data contamination.", "description_zh": "提出 SRE-Bench，使用私有编写的程序及带保护机制的二进制变体，研究智能体恢复程序语义的能力，并减少训练数据污染。", "doi": null, "entry_url": "https://awesomerea.org/papers/paper-sre-bench/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-sre-bench/", "evidence_urls": [ "https://arxiv.org/abs/2608.11469", "https://arxiv.org/html/2608.11469v2" ], "first_arxiv_date": "2026-08-11", "id": "paper-sre-bench", "kind": "research", "metadata_notes": "Use the 12-author v2 list, revised 2026-10-01, rather than the older eight-author v1 search snippets. No conference venue or own public code repository was verified. AgentRE-Bench GitHub links in the bibliography refer to another benchmark.", "metadata_notes_zh": "使用 2026-10-01 修订的 v2 十二位作者名单，而非旧 v1 搜索摘要中的八位作者。未确认会议发表场所或论文自己的公开代码仓库。参考文献中的 AgentRE-Bench GitHub 链接属于另一项基准。", "pdf_url": "https://arxiv.org/pdf/2608.11469", "project_url": null, "publication_date": "2026-08-11", "publication_status": "preprint", "runtime_tested": false, "scope_limitations_en": "The revised study reports 19 programs, 262 binary instances, and 1,572 graded tasks. Binaries and task instances are not publicly released; access is through an evaluation service. Its contamination-control claim is the authors' methodology, not an independent guarantee.", "scope_limitations_zh": "修订版研究报告 19 个程序、262 个二进制实例和 1,572 个评分任务。二进制与任务实例未公开发布，只能通过评估服务访问。污染控制是作者的方法论主张，并非独立保证。", "targets": [ "binary" ], "title": "The Next Challenge for Agentic Cybersecurity: A Realistic, Contamination-Free Reverse Engineering Benchmark", "title_zh": "智能体网络安全的下一项挑战：真实场景且无训练数据污染的逆向工程基准", "url": "https://arxiv.org/abs/2608.11469", "venue": "arXiv", "verification": "source-reviewed", "verified_at": "2026-10-16", "why_fits_en": "Adds realistic-scale and contamination-aware evaluation context for agent-assisted reverse engineering without mislabeling a private corpus as open data.", "why_fits_zh": "为智能体辅助逆向补充真实规模和数据污染控制的评估背景，同时明确私有语料的访问限制。", "year": 2026 }, { "arxiv_id": "2406.04568", "arxiv_version_reviewed": "v1", "authors": [ "Weike Fang", "Zhejian Zhou", "Junzhou He", "Weihang Wang" ], "code_url": null, "date_basis": "PMLR states that Volume 235 was published on 08 July 2024, and the paper page gives the same citation date. The July 21–27 conference dates and the June 2024 arXiv submission are not used as the publication date.", "date_basis_zh": "PMLR 标明第 235 卷于 2024 年 7 月 8 日出版，论文页面给出的引用日期与此相同。本条目不以 7 月 21—27 日的会议日期或 2024 年 6 月的 arXiv 提交日期作为出版日期。", "date_precision": "day", "description_en": "StackSight decompiles WebAssembly text-format functions into C++ with LLM prompting. A static analysis annotates each WAT instruction with the virtual-stack state, using symbolic notation where branches diverge; a one-shot chain-of-thought prompt then asks the model to recover variable meanings, summarize the function and write C++. With GPT-4 the share of outputs passing all benchmark tests rises from 19.7% to 36.5% on HumanEval-X and from 42.4% to 59.6% on MBXP relative to one-shot prompting; GPT-3.5 and Code Llama-7B-Instruct are also evaluated.", "description_zh": "StackSight 借助大语言模型提示，将 WebAssembly 文本格式（WAT）函数反编译为 C++。它先通过静态分析为每条 WAT 指令标注虚拟栈状态，在分支分叉处使用符号记法；再用单样例思维链提示，要求模型恢复变量含义、总结函数功能并写出 C++。使用 GPT-4 时，与单样例提示相比，通过全部基准测试的输出比例在 HumanEval-X 上从 19.7% 升至 36.5%，在 MBXP 上从 42.4% 升至 59.6%；论文还评估了 GPT-3.5 与 Code Llama-7B-Instruct。", "doi": null, "entry_url": "https://awesomerea.org/papers/paper-stacksight/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-stacksight/", "evidence_urls": [ "https://proceedings.mlr.press/v235/fang24e.html", "https://proceedings.mlr.press/v235/", "https://raw.githubusercontent.com/mlresearch/v235/main/assets/fang24e/fang24e.pdf", "https://arxiv.org/abs/2406.04568v1" ], "first_arxiv_date": "2024-06-07", "id": "paper-stacksight", "kind": "research", "metadata_notes": "PMLR lists Proceedings of the 41st International Conference on Machine Learning, PMLR 235, pages 13010–13028; no DOI is given. arXiv has a single version, v1 of 2024-06-07, whose comment cites the ICML 2024 proceedings. The models are gpt-3.5-turbo-1106, gpt-4-0125-preview and Code Llama-7b-Instruct; GPT-4 was compared only with one-shot prompting, while the GPT-3.5 and Code Llama baselines also use 3-, 5- and 10-shot prompts. The appendix gives the emcc and wasm2wat commands and the prompts. The paper links third-party tools such as WABT and Emscripten but no author code, prompts repository or evaluation harness, and none was found. No code or experiments were run.", "metadata_notes_zh": "PMLR 列出 Proceedings of the 41st International Conference on Machine Learning、PMLR 第 235 卷第 13010–13028 页，未给出 DOI。arXiv 仅有 2024-06-07 的 v1，其备注引用 ICML 2024 论文集。所用模型为 gpt-3.5-turbo-1106、gpt-4-0125-preview 与 Code Llama-7b-Instruct；GPT-4 仅与单样例提示比较，GPT-3.5 与 Code Llama 的基线另含 3、5、10 样例提示。附录给出 emcc 与 wasm2wat 命令及提示词。论文链接了 WABT、Emscripten 等第三方工具，但未提供作者代码、提示词仓库或评测框架，本次也未找到。本次未运行代码或实验。", "pdf_url": "https://raw.githubusercontent.com/mlresearch/v235/main/assets/fang24e/fang24e.pdf", "project_url": null, "publication_date": "2024-07-08", "publication_status": "conference-paper", "runtime_tested": false, "scope_limitations_en": "Inputs are short exercise functions from the C++ splits of HumanEval-X (161 of 164 compiled) and MBXP (773 of 974), built as Emscripten 3.1.46 side modules at -Oz with function names kept by --profiling-funcs and converted with wasm2wat 1.0.33; minified, obfuscated or whole-application WebAssembly is not evaluated. Correctness is the share of outputs that compile and pass the benchmarks' test cases after a test oracle renames functions, inserts tests and adds namespace directives, with manual pass-by-value edits. Passing these tests is not proof of equivalence with the original module. Summaries are scored by BERTScore and SBERT; the user study had 15 participants on 20 snippets per dataset. wasm2c and an earlier neural decompiler were excluded for producing no compilable output, and results depend on specific hosted model versions.", "scope_limitations_zh": "输入是 HumanEval-X（164 个中 161 个可编译）与 MBXP（974 个中 773 个）C++ 子集中的简短练习函数，以 Emscripten 3.1.46 按 -Oz 编译为侧模块，通过 --profiling-funcs 保留函数名，再用 wasm2wat 1.0.33 转换；未评估经过压缩、混淆或完整应用规模的 WebAssembly。正确性指输出能够编译并通过基准测试用例的比例；测试判定器会重命名函数、插入测试并补充命名空间指令，按值传参则由人工修改。通过这些测试并不证明与原始模块等价。函数摘要以 BERTScore 和 SBERT 评分；用户研究有 15 名参与者，每个数据集 20 个代码片段。wasm2c 与一种早期神经反编译器因无法生成可编译输出而未纳入比较，结果也依赖特定版本的托管模型。", "targets": [ "binary", "website" ], "title": "StackSight: Unveiling WebAssembly through Large Language Models and Neurosymbolic Chain-of-Thought Decompilation", "title_zh": "StackSight：借助大语言模型与神经符号思维链反编译揭示 WebAssembly", "url": "https://proceedings.mlr.press/v235/fang24e.html", "venue": "ICML 2024", "verification": "source-reviewed", "verified_at": "2026-10-18", "why_fits_en": "Adds LLM-based WebAssembly decompilation guided by static stack analysis, covering the bytecode format shipped in web applications alongside the native-code decompilation papers in this section.", "why_fits_zh": "补充由静态栈分析引导的大语言模型 WebAssembly 反编译方法，覆盖网页应用所交付的字节码格式，与本节的原生代码反编译论文并列。", "year": 2024 }, { "arxiv_id": "2609.27058", "arxiv_version_reviewed": "v1", "authors": [ "Rong Feng", "Suman Saha" ], "code_url": null, "date_basis": "First arXiv submission; no formal proceedings publication was verified.", "date_basis_zh": "采用首次 arXiv 提交日期，未核实正式会议录出版。", "date_precision": "day", "description_en": "Uses intermediate Webcrack rewrites to supervise Coconut-style latent reasoning for JavaScript deobfuscation. Training exposes staged code transformations; inference receives obfuscated code and generates a cleaned program in one shot.", "description_zh": "利用 Webcrack 的中间重写结果监督 Coconut 式潜空间推理，以完成 JavaScript 去混淆。训练阶段提供分步代码转换，推理阶段仅接收混淆代码并一次生成清理后的程序。", "doi": "10.48550/arxiv.2609.27058", "entry_url": "https://awesomerea.org/papers/paper-stage-supervised-js-deobfuscation/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-stage-supervised-js-deobfuscation/", "evidence_urls": [ "https://arxiv.org/abs/2609.27058v1", "https://arxiv.org/html/2609.27058v1", "https://api.datacite.org/dois/10.48550/arxiv.2609.27058" ], "first_arxiv_date": "2026-09-22", "id": "paper-stage-supervised-js-deobfuscation", "kind": "research", "metadata_notes": "Reviewed September 22 v1, explicitly labeled WIP, with a registered arXiv DOI. Article license is CC BY 4.0. Webcrack is a cited upstream supervision tool, not this paper’s implementation release; no dedicated author code, weights or training-artifact license was verified. Nothing was executed.", "metadata_notes_zh": "已复核 9 月 22 日 v1，原文明确标为 WIP，arXiv DOI 已注册。文章许可为 CC BY 4.0；Webcrack 是引用的上游监督工具，不是本文的实现发布。未核实专用作者代码、权重或训练产物许可，本次未执行任何产物。", "pdf_url": "https://arxiv.org/pdf/2609.27058v1", "project_url": null, "publication_date": "2026-09-22", "publication_status": "preprint", "runtime_tested": false, "scope_limitations_en": "A work-in-progress study of one 3B backbone: 100 programs sampled from the 300 smallest benchmark inputs, split 60/20/20. Of 20 test outputs, 10 parsed and 8 matched teacher-derived outputs; the reported 80% is conditional on valid syntax. Semantic checks include manual inspection; stronger baselines and stage ablations remain future work.", "scope_limitations_zh": "这是单一 3B 基础模型的进行中研究：从基准最小的 300 个输入中抽取 100 个程序，按 60/20/20 划分。20 个测试输出中 10 个可解析、8 个与教师流程输出匹配；所报 80% 以语法有效为条件。语义检查含人工检查，更强基线及阶段消融仍待完成。", "targets": [ "website", "app" ], "title": "Stage-Supervised Latent Reasoning for Single-Shot JavaScript Deobfuscation", "title_zh": "阶段监督的潜空间推理：单次生成的 JavaScript 去混淆", "url": "https://arxiv.org/abs/2609.27058", "venue": "arXiv", "verification": "source-reviewed", "verified_at": "2026-10-20", "why_fits_en": "Explores how deterministic recovery stages can supervise learned code deobfuscation.", "why_fits_zh": "探索如何利用确定性恢复阶段监督学习式代码去混淆。", "year": 2026 }, { "arxiv_id": null, "arxiv_version_reviewed": null, "authors": [ "Chris McMahon Stone", "Sam L. Thomas", "Mathy Vanhoef", "James Henderson", "Nicolas Bailluet", "Tom Chothia" ], "citation": { "container_title": "Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security", "pages": "2265-2278", "publisher": "ACM", "sources": [ "https://api.crossref.org/works/10.1145/3548606.3559365" ] }, "code_url": "https://github.com/ChrisMcMStone/state-inspector", "date_basis": "The ACM-deposited Crossref record gives November 7, 2022 for both online and print publication; this date is not inferred solely from the conference schedule.", "date_basis_zh": "ACM 提交的 Crossref 记录将在线及印刷出版日期均列为 2022 年 11 月 7 日；该日期并非仅根据会议日程推定。", "date_precision": "day", "description_en": "StateInspector learns protocol Mealy machines by combining active message queries with snapshots of runtime memory, without requiring the target’s source code. It identifies candidate state-defining heap locations and uses taint and concolic analysis to merge states, evaluated by the authors on TLS 1.2 and WPA/2 implementations.", "description_zh": "StateInspector 将主动消息查询与运行时内存快照结合起来，学习协议的 Mealy 状态机，无需目标实现的源代码。它识别可能决定状态的堆内存位置，并通过污点分析与混合执行合并状态；作者在 TLS 1.2 和 WPA/2 实现上进行了评估。", "doi": "10.1145/3548606.3559365", "entry_url": "https://awesomerea.org/papers/paper-stateinspector/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-stateinspector/", "evidence_urls": [ "https://doi.org/10.1145/3548606.3559365", "https://api.crossref.org/works/10.1145/3548606.3559365", "https://tomchothia.gitlab.io/Papers/greyboxstatelearning_ccs2022.pdf", "https://github.com/ChrisMcMStone/state-inspector/blob/103494e6d30fd7741e74393d844212acb4daf683/README.md", "https://github.com/ChrisMcMStone/state-inspector/blob/103494e6d30fd7741e74393d844212acb4daf683/.gitmodules", "https://github.com/ChrisMcMStone/state-inspector/blob/103494e6d30fd7741e74393d844212acb4daf683/ptrace-statemem/LICENSE", "https://github.com/ChrisMcMStone/state-inspector/blob/103494e6d30fd7741e74393d844212acb4daf683/blackbox/statelearner/LICENSE" ], "first_arxiv_date": null, "id": "paper-stateinspector", "kind": "research", "metadata_notes": "Reviewed the author-hosted 19-page copy; ACM-deposited metadata lists proceedings pages 2265–2278, so these are not asserted to be identical PDF versions. Public code documents a dated Linux setup with Python 2, OpenJDK 14, Maven, per-protocol input/reset harnesses and target-specific ptrace hooks. The taint path requires Triton and IDA Pro/Wine; omitting it can prevent termination on counters. No project-wide license was found in the inspected repository; component licenses and proprietary-tool rights remain separate. Only public text and paper documents were retrieved; no upstream code was executed and no encrypted archive was downloaded or decrypted.", "metadata_notes_zh": "核查的是作者托管的 19 页版本；ACM 提交的元数据将论文集页码列为 2265–2278，因此不声称两者是完全相同的 PDF 版本。公开代码记录了较早的 Linux 环境，包括 Python 2、OpenJDK 14、Maven、针对各协议的输入与重置测试驱动程序，以及目标相关的 ptrace 钩子。污点分析路径需要 Triton 和 IDA Pro/Wine；省略该路径可能因计数器而无法终止。所检查仓库中未发现项目整体许可证；各组件许可与专有工具使用权需分别处理。本次仅获取公开文本及论文文档，未执行上游代码，也未下载或解密加密归档。", "pdf_url": "https://tomchothia.gitlab.io/Papers/greyboxstatelearning_ccs2022.pdf", "project_url": null, "publication_date": "2022-11-07", "publication_status": "conference-paper", "runtime_tested": false, "scope_limitations_en": "Assumes a finite Mealy-machine abstraction, a known input alphabet that can reach the relevant states, and state-defining memory on the heap exercised by bootstrap queries. State merging depends on configured search-depth and symbolic look-ahead bounds. Missing inputs or state stored elsewhere can leave behavior unmodeled; malformed harness messages, response abstraction and timeouts can create misleading transitions. Learned models and bounded checks do not establish full implementation equivalence, recover unknown message formats or reconstruct an application’s source code.", "scope_limitations_zh": "假设协议可抽象为有限 Mealy 状态机、已知输入字母表能到达相关状态，且决定状态的内存位于堆上并可由初始化查询触及。状态合并依赖所配置的搜索深度与符号执行前瞻上限。缺失的输入或存储在其他位置的状态可能导致行为未被建模；测试驱动程序构造的错误消息、响应抽象方式和超时也可能产生误导性转移。学习出的模型与有界检查不能证明实现完全等价，也不恢复未知消息格式或重建应用源代码。", "targets": [ "protocol" ], "title": "The Closer You Look, The More You Learn: A Grey-box Approach to Protocol State Machine Learning", "title_zh": "越仔细观察，学到的越多：用于协议状态机学习的灰盒方法", "url": "https://doi.org/10.1145/3548606.3559365", "venue": "ACM CCS 2022", "verification": "source-reviewed", "verified_at": "2026-10-17", "why_fits_en": "Provides a concrete method for reconstructing communication-state behavior from executable protocol implementations and testing deviations from expected flows, complementing message-format inference.", "why_fits_zh": "提供从可执行协议实现中重建通信状态行为、检查其与预期流程偏差的具体方法，可与消息格式推断互补。", "year": 2022 }, { "arxiv_id": "2608.26408", "arxiv_version_reviewed": "v1", "authors": [ "Xiaohan Wang", "Kevin Leach" ], "code_url": null, "date_basis": "First arXiv submission date from the reviewed submission history; no formal publication was verified.", "date_basis_zh": "采用已核对的 arXiv 首次提交日期；尚未核实正式出版信息。", "date_precision": "day", "description_en": "STILL predicts function-level STL container presence from stripped control-flow graphs and turns those predictions into compact hints for LLM refinement of Ghidra output. StlBench supplies controlled labels for five container classes.", "description_zh": "STILL 从去符号控制流图预测函数级 STL 容器的存在情况，并将预测转成紧凑提示，供 LLM 改进 Ghidra 输出。StlBench 为五类容器提供受控标注。", "doi": null, "entry_url": "https://awesomerea.org/papers/paper-still-stl/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-still-stl/", "evidence_urls": [ "https://arxiv.org/abs/2608.26408v1", "https://arxiv.org/html/2608.26408v1" ], "first_arxiv_date": "2026-08-26", "id": "paper-still-stl", "kind": "research", "metadata_notes": "Latest reviewed version is arXiv v1, under CC BY-NC-ND 4.0. The appendix describes an artifact and a planned public StlBench release but gives no verified access URL. Its code, model and dataset licensing was not established; no artifact or experiment was run.", "metadata_notes_zh": "最新核对版本为 arXiv v1，文章采用 CC BY-NC-ND 4.0。附录描述产物及计划公开的 StlBench，但未提供已核实的访问链接。代码、模型及数据集许可尚未确定；本次未运行产物或实验。", "pdf_url": "https://arxiv.org/pdf/2608.26408v1", "project_url": null, "publication_date": "2026-08-26", "publication_status": "preprint", "runtime_tested": false, "scope_limitations_en": "The interface covers map, queue, set, string and vector, not full variable types, template arguments, nesting, iterators or std::array. Experiments use g++/x86-64/libstdc++ with angr and Ghidra; transfer to other toolchains is unverified. Test-suite executability is not equivalence, and hint benefits depend on the downstream model and adaptation.", "scope_limitations_zh": "接口覆盖 map、queue、set、string、vector，不恢复完整变量类型、模板参数、嵌套关系、迭代器或 std::array。实验采用 g++／x86-64／libstdc++、angr 及 Ghidra，未验证向其他工具链的迁移。测试集可执行性不等于等价；提示收益也取决于下游模型及适配。", "targets": [ "binary" ], "title": "STILL: Recovering Lowered STL Semantics for LLM-assisted C++ Decompilation", "title_zh": "STILL：为 LLM 辅助 C++ 反编译恢复编译后隐藏的 STL 语义", "url": "https://arxiv.org/abs/2608.26408", "venue": "arXiv", "verification": "source-reviewed", "verified_at": "2026-10-20", "why_fits_en": "Connects explicit container-semantic recovery with LLM-assisted C++ decompilation without claiming full type reconstruction.", "why_fits_zh": "连接显式容器语义恢复与 LLM 辅助 C++ 反编译，同时保留其并非完整类型重建的边界。", "year": 2026 }, { "arxiv_id": "2407.02733", "arxiv_version_reviewed": "v1", "authors": [ "Harrison Green", "Edward J. Schwartz", "Claire Le Goues", "Bogdan Vasilescu" ], "code_url": "https://github.com/hgarrereyn/STRIDE", "date_basis": "arXiv v1 submission on 2024-07-03, the only version at review time. No later venue publication was found, so no publication date beyond the preprint is asserted.", "date_basis_zh": "采用 arXiv v1 的 2024-07-03 提交日期，审阅时这是唯一版本。未找到后续正式发表记录，因此不主张预印本之外的出版日期。", "date_precision": "day", "description_en": "STRIDE predicts the names and types of variables in decompiler output without a neural model. From training decompilation with known labels, it builds a database mapping the token sequences (N-grams, with N from 2 to 60) immediately left and right of each variable occurrence to the five most frequent names or types. Variable placeholders are canonicalized, and address-like tokens and large constants are bucketed so that N-grams can match. At prediction time it looks up the longest matching N-gram on each side of every occurrence, scores the returned labels by how specific the match is, and sums the scores across the function. The prototype is about 1,000 lines of Python and runs on a CPU. On DIRT functions not seen in training, the authors report 66.4% retyping accuracy, against 52.3% for DIRTY with beam search, and 56.2% renaming accuracy, against 51.3% reported for VarBERT. Across 16 VarCorpus splits, renaming accuracy is higher than VarBERT on 11 and 1.55 points higher on average. Prediction takes 8.2 ms per function on a CPU, against 43.7 ms for VarBERT on an NVIDIA L4 GPU.", "description_zh": "STRIDE 不使用神经网络模型，而是预测反编译器输出中变量的名称和类型。它基于带已知标签的训练反编译结果构建数据库，将每处变量出现位置紧邻左右两侧的词元序列（N-gram，N 取 2 至 60）映射到出现频率最高的五个名称或类型。变量占位名会被规范化，类似地址的词元和较大的常量会被分桶，以便 N-gram 能够匹配。预测时，它在每处出现位置的两侧查找最长的匹配 N-gram，按匹配的特异程度为返回的标签打分，并在整个函数内累加得分。原型约有 1,000 行 Python 代码，在 CPU 上运行。作者报告，在训练集中未出现的 DIRT 函数上，类型恢复准确率为 66.4%（启用束搜索的 DIRTY 为 52.3%），重命名准确率为 56.2%（VarBERT 的已报告结果为 51.3%）。在 16 个 VarCorpus 划分中，其重命名准确率在 11 个划分上高于 VarBERT，平均高 1.55 个百分点。预测在 CPU 上每个函数耗时 8.2 毫秒，而 VarBERT 在 NVIDIA L4 GPU 上为 43.7 毫秒。", "doi": null, "entry_url": "https://awesomerea.org/papers/paper-stride/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-stride/", "evidence_urls": [ "https://arxiv.org/abs/2407.02733", "https://arxiv.org/pdf/2407.02733v1", "https://github.com/hgarrereyn/STRIDE/blob/ebaab25f2bb71a40c2dd70382270d77d7f002777/README.md", "https://github.com/hgarrereyn/STRIDE/blob/ebaab25f2bb71a40c2dd70382270d77d7f002777/LICENSE", "https://github.com/hgarrereyn/STRIDE/tree/ebaab25f2bb71a40c2dd70382270d77d7f002777/stride" ], "first_arxiv_date": "2024-07-03", "id": "paper-stride", "kind": "research", "metadata_notes": "Reviewed arXiv v1 (2024-07-03), the only version at review time; the abstract page lists no comment or journal reference, and the PDF names Carnegie Mellon University and the CMU Software Engineering Institute as affiliations. A Crossref bibliographic search and an OpenAlex search found only the arXiv preprint; DBLP's search API returned a bot check and could not be consulted. The abstract links hgarrereyn/STRIDE, reviewed at its latest commit ebaab25 (2024-07-04): MIT license, copyright 2024 Harrison Green. The README documents converters for the DIRE, DIRT and VarCorpus datasets, which are downloaded separately from Google Drive, Amazon S3 and Dropbox; the repository ships no trained N-gram databases or requirements file, and its FAQ says no decompiler plugin exists yet. The paper says the N-gram database takes a few gigabytes of memory. The repository also appears in the automated scan index, whose record is unchanged. No datasets were downloaded and no code or experiments were run.", "metadata_notes_zh": "审阅 arXiv v1（2024-07-03），审阅时这是唯一版本；摘要页没有注释或期刊引用信息，PDF 列出的单位为卡内基梅隆大学及其软件工程研究所。Crossref 书目检索与 OpenAlex 检索只找到该 arXiv 预印本；DBLP 检索接口返回机器人验证页面，无法查询。摘要链接的 hgarrereyn/STRIDE 按其最新提交 ebaab25（2024-07-04）审阅：采用 MIT 许可证，版权归 Harrison Green（2024）。README 说明了 DIRE、DIRT 与 VarCorpus 数据集的转换脚本，这些数据集需另行从 Google Drive、Amazon S3 和 Dropbox 下载；仓库不含训练好的 N-gram 数据库或依赖清单，其常见问题说明尚无反编译器插件。论文指出 N-gram 数据库会占用数 GB 内存。该仓库也出现在自动扫描索引中，其索引记录未作改动。本次未下载数据集，也未运行代码或实验。", "pdf_url": "https://arxiv.org/pdf/2407.02733v1", "project_url": null, "publication_date": "2024-07-03", "publication_status": "preprint", "runtime_tested": false, "scope_limitations_en": "An arXiv preprint with no stated venue; this record makes no claim of peer review. STRIDE classifies by exact N-gram matches, so its predictions depend on token sequences seen in the training data: it cannot fuzzy-match or predict a name or type absent from training, and a model trained on one decompiler's token format is not expected to transfer to another. Results are reported on decompiler output from the DIRT, DIRE and VarCorpus benchmark datasets. DIRT pairs Hex-Rays output for GCC -O0 builds of GitHub projects with DWARF-derived labels, the older DIRE dataset was prepared similarly, and VarCorpus covers Gentoo packages decompiled with Hex-Rays and Ghidra at -O0 to -O3. Retyping is evaluated only on DIRT, and only x86 C/C++ code is covered. Accuracy is exact match, so near-synonyms count as errors. About 60% of DIRT test functions also appear in training, where STRIDE reaches about 99% by memorization; the not-in-train figures are the more representative ones. DIRT keeps function and global names, and removing them lowers renaming accuracy by a few points. Several baseline numbers are copied from earlier publications rather than rerun. The authors' README expects poor results on custom closed-source binaries with structures absent from training. The reviewed repository is a research prototype with no decompiler plugin or trained databases.", "scope_limitations_zh": "这是一篇未标明发表场所的 arXiv 预印本；本条目不主张其经过同行评审。STRIDE 依据完全一致的 N-gram 匹配进行分类，因此预测取决于训练数据中出现过的词元序列：它无法模糊匹配，也无法预测训练中未出现的名称或类型；基于某一反编译器词元格式训练的模型预计不能迁移到其他反编译器。结果基于 DIRT、DIRE 与 VarCorpus 三个基准数据集中的反编译器输出。DIRT 使用 GitHub 项目经 GCC -O0 编译后的 Hex-Rays 输出，并以 DWARF 信息生成标签，较早的 DIRE 数据集以类似方式构建；VarCorpus 覆盖以 Hex-Rays 和 Ghidra 在 -O0 至 -O3 下反编译的 Gentoo 软件包。类型恢复只在 DIRT 上评测，且仅覆盖 x86 C/C++ 代码。准确率按完全匹配计算，近义名称也算作错误。约 60% 的 DIRT 测试函数同样出现在训练集中，STRIDE 在这部分依靠记忆达到约 99% 的准确率；训练集中未出现的函数上的结果更具代表性。DIRT 保留了函数名与全局变量名，去除这些标识符后重命名准确率会下降几个百分点。部分基线数据摘自既有论文，并未重新运行。作者在 README 中预计，对包含训练中未出现结构体的自定义闭源二进制文件效果不佳。所审阅的仓库是研究原型，不含反编译器插件或训练好的数据库。", "targets": [ "binary" ], "title": "STRIDE: Simple Type Recognition In Decompiled Executables", "title_zh": "STRIDE：反编译可执行文件中的简单类型识别", "url": "https://arxiv.org/abs/2407.02733", "venue": "arXiv", "verification": "source-reviewed", "verified_at": "2026-10-19", "why_fits_en": "Adds a non-neural, sequence-matching baseline for decompiled variable name and type recovery, complementing the transformer-based DIRTY and VarBERT records it compares against.", "why_fits_zh": "补充一个非神经网络、基于序列匹配的反编译变量名称与类型恢复基线，与书目中作为其比较对象、基于 Transformer 的 DIRTY 和 VarBERT 互补。", "year": 2024 }, { "arxiv_id": "2609.33678", "arxiv_version_reviewed": "v3", "authors": [ "Xiaoyu Chen", "Lai Wei", "Jin Wang", "Xiangyu Zou", "Ruochen Fan", "Enze Luo", "Mingzhe Yao", "Jiahui Zhu", "Yuhua Wen", "Linghe Kong", "Weiran Huang" ], "code_url": null, "date_basis": "First arXiv submission; the reviewed version is identified separately.", "date_basis_zh": "采用首次 arXiv 提交日期，另列所复核版本。", "date_precision": "day", "description_en": "Evaluates construction, completion, repair and Godot-to-Unity porting against executable reference games. Evaluator-owned probes and input replays check gameplay behavior, while visual rubrics assess presentation separately.", "description_zh": "以可执行参考游戏评估构建、补全、修复及 Godot 到 Unity 的移植；由评测方控制的探针与输入回放检查玩法行为，视觉评分准则另行评价表现。", "doi": "10.48550/arxiv.2609.33678", "entry_url": "https://awesomerea.org/papers/paper-swe-game/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-swe-game/", "evidence_urls": [ "https://arxiv.org/abs/2609.33678", "https://arxiv.org/html/2609.33678v3", "https://api.datacite.org/dois/10.48550/arxiv.2609.33678" ], "first_arxiv_date": "2026-09-27", "id": "paper-swe-game", "kind": "research", "metadata_notes": "First submitted September 27; reviewed v3 dated October 7. No author-linked code or dataset release was verified in the reviewed manuscript. No engine, model or game was run.", "metadata_notes_zh": "首次提交为 9 月 27 日，本次复核 10 月 7 日 v3；所查手稿未核实作者关联的代码或数据发布。本次未运行引擎、模型或游戏。", "pdf_url": "https://arxiv.org/pdf/2609.33678v3", "project_url": null, "publication_date": "2026-09-27", "publication_status": "preprint", "runtime_tested": false, "scope_limitations_en": "The 247 tasks derive from 41 games. Inputs vary by task; porting receives Godot source, so this is not purely black-box reconstruction. Each model uses one framework, confounding their effects. Finite scenario checks and 100-game functional validation do not establish general gameplay equivalence.", "scope_limitations_zh": "247 项任务来自 41 款游戏。各任务输入不同，移植任务提供 Godot 源码，因此并非纯黑盒重建。每个模型仅配一种框架，二者影响未分离；有限场景检查及 100 款游戏的功能验证不证明通用玩法等价。", "targets": [ "game" ], "title": "SWE-Game: Can Coding Agents Build the Games We Want?", "title_zh": "SWE-Game：编程智能体能否构建符合预期的游戏？", "url": "https://arxiv.org/abs/2609.33678", "venue": "arXiv", "verification": "source-reviewed", "verified_at": "2026-10-20", "why_fits_en": "Adds executable checks for reference-guided game reconstruction and cross-engine behavior preservation.", "why_fits_zh": "补充参考引导的游戏重建及跨引擎行为保留所需的可执行检查。", "year": 2026 }, { "arxiv_id": null, "arxiv_version_reviewed": null, "authors": [ "Linxi Jiang", "Xin Jin", "Zhiqiang Lin" ], "citation": { "container_title": "Proceedings 2025 Network and Distributed System Security Symposium", "publisher": "Internet Society", "sources": [ "https://api.crossref.org/works/10.14722/ndss.2025.240797" ] }, "code_url": "https://github.com/OSUSecLab/SymGen", "date_basis": "The official NDSS paper and the Internet Society’s Crossref deposit establish publication year 2025. The February 24–28 symposium dates are not used as a publication day.", "date_basis_zh": "NDSS 官方论文与 Internet Society 提交的 Crossref 元数据确认出版年份为 2025；不以 2 月 24—28 日的研讨会日期作为出版日。", "date_precision": "year", "description_en": "SymGen infers function names for stripped binaries by generating them with a LoRA-fine-tuned Code Llama model instead of classifying over a fixed name vocabulary. Ghidra decompiles each stripped function, its own name is masked, and callee names are normalized for deduplication. Before fine-tuning, the model is domain-adapted on decompiled code paired with LLM-generated summaries of the matching source functions. On functions from 33 C projects built for x86-64, x86-32, ARM and MIPS at O0–O3, deduplicated from 2,237,915 to 495,494, the authors report average word-level F1 of 0.277 (0.380 on x86-64), plus case studies on obfuscated binaries and Linux malware.", "description_zh": "SymGen 使用经 LoRA 微调的 Code Llama 模型生成去符号二进制的函数名，而不是在固定的名称词表上分类。每个去符号函数先由 Ghidra 反编译，再屏蔽其自身名称，并对被调用函数名进行归一化以便去重。微调之前，模型先以反编译代码及其对应源函数的大语言模型生成摘要进行领域适配。在 33 个 C 项目针对 x86-64、x86-32、ARM 和 MIPS 架构及 O0–O3 优化级别构建的函数上（经去重由 2,237,915 个减至 495,494 个），作者报告词级平均 F1 为 0.277（x86-64 上为 0.380），并给出混淆二进制与 Linux 恶意软件的案例研究。", "doi": "10.14722/ndss.2025.240797", "entry_url": "https://awesomerea.org/papers/paper-symgen/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-symgen/", "evidence_urls": [ "https://www.ndss-symposium.org/ndss-paper/beyond-classification-inferring-function-names-in-stripped-binaries-via-domain-adapted-llms/", "https://www.ndss-symposium.org/wp-content/uploads/2025-797-paper.pdf", "https://api.crossref.org/works/10.14722/ndss.2025.240797", "https://github.com/OSUSecLab/SymGen/blob/78df514a2f228fee9f671f1d71737ea725b008f4/README.md", "https://github.com/OSUSecLab/SymGen/blob/78df514a2f228fee9f671f1d71737ea725b008f4/LICENSE", "https://github.com/OSUSecLab/SymGen/blob/78df514a2f228fee9f671f1d71737ea725b008f4/requirements.txt", "https://github.com/OSUSecLab/SymGen/blob/78df514a2f228fee9f671f1d71737ea725b008f4/lora_weights/adapter_config.json", "https://github.com/OSUSecLab/SymGen/blob/78df514a2f228fee9f671f1d71737ea725b008f4/scripts/evaluation/calculate_score.py", "https://zenodo.org/records/15530083", "https://zenodo.org/api/records/15530083" ], "first_arxiv_date": null, "id": "paper-symgen", "kind": "research", "metadata_notes": "The NDSS page, final PDF and Crossref agree on the title, three-author order and DOI; Crossref lists no pages. The PDF marks Linxi Jiang and Xin Jin as equal-contribution first authors. SymGen is the system name and is not part of the title; an arXiv title search found no preprint. The paper links the reviewed 2025-06-05 repository snapshot, which provides Ghidra decompilation, data-processing, summary-generation, alpaca-lora-based fine-tuning, prediction and evaluation scripts, a sample dataset and a 39 MB LoRA adapter (r=8) for codellama/CodeLlama-34b-Instruct-hf; base weights are not included and keep their own terms. The paper reports about 37 hours of LoRA training on one 80 GB A100. The README uses a Python 3.9 conda environment with largely unpinned requirements, including peft installed from Git. It links Zenodo record 10.5281/zenodo.15530083 (about 7.5 GB of source projects, binaries and decompiled data; CC BY 4.0 in its metadata), whose third-party projects keep their own licenses. The README states Apache License 2.0 and LICENSE contains Apache 2.0 text after an OSU copyright header, but GitHub reports NOASSERTION; this record does not resolve that discrepancy. No code, models or datasets were run or downloaded.", "metadata_notes_zh": "NDSS 页面、最终 PDF 与 Crossref 的标题、三位作者顺序和 DOI 一致；Crossref 未列出页码。PDF 注明 Linxi Jiang 与 Xin Jin 为同等贡献的第一作者。SymGen 是系统名称，并不属于论文标题；按标题检索 arXiv 未发现预印本。论文链接的仓库按 2025-06-05 快照审阅，提供 Ghidra 反编译、数据处理、摘要生成、基于 alpaca-lora 的微调、预测与评估脚本，一份样例数据集，以及面向 codellama/CodeLlama-34b-Instruct-hf 的 39 MB LoRA 适配器（r=8）；不含基础模型权重，其权重适用各自条款。论文报告在一块 80 GB A100 上进行 LoRA 训练约需 37 小时。README 使用 Python 3.9 conda 环境，依赖大多未固定版本，其中 peft 从 Git 安装。README 链接 Zenodo 记录 10.5281/zenodo.15530083（约 7.5 GB，含源项目、二进制与反编译数据；元数据标注 CC BY 4.0），其中第三方项目保留各自许可证。README 声明采用 Apache License 2.0，LICENSE 文件在 OSU 版权声明之后包含 Apache 2.0 文本，但 GitHub 报告为 NOASSERTION；本条目不对这一差异作出判断。本次未运行或下载代码、模型及数据集。", "pdf_url": "https://www.ndss-symposium.org/wp-content/uploads/2025-797-paper.pdf", "project_url": null, "publication_date": null, "publication_status": "conference-paper", "runtime_tested": false, "scope_limitations_en": "Names are split into words and scored with precision, recall and F1, with SymLM’s CodeWordNet grouping similar words; predictions are descriptive guesses, not recovered original symbols. Average F1 is 0.277 and lower on MIPS (0.137) and ARM (0.262). The gains of up to 409.3%, 553.5% and 489.4% in the abstract are author-reported relative improvements over AsmDepictor; the baselines were retrained on the authors’ deduplicated dataset, where they score far below their own papers, and XFL was compared on x86-64 only. A separate model is trained for each architecture and optimization level. All binaries were built with GCC 9.4.0, inputs depend on Ghidra output, and Code Llama’s closed pretraining data leaves leakage possible. Obfuscation tests apply three default Hikari passes to 363 binaries from six projects (F1 0.271–0.303); the malware study covers 812 functions in 16 x86-64 builds (F1 0.348).", "scope_limitations_zh": "函数名被拆分为单词，并以精确率、召回率和 F1 评分，同时使用 SymLM 的 CodeWordNet 归并语义相近的词；预测结果是描述性的推测，并非恢复的原始符号。平均 F1 为 0.277，在 MIPS（0.137）和 ARM（0.262）上更低。摘要中最高 409.3%、553.5% 与 489.4% 的提升是作者报告的相对 AsmDepictor 的改进；各基线在作者去重后的数据集上重新训练，得分远低于其原论文结果，XFL 仅在 x86-64 上比较。每种架构和优化级别分别训练一个模型。所有二进制均由 GCC 9.4.0 构建，输入依赖 Ghidra 输出，且 Code Llama 的预训练数据未公开，仍可能存在数据泄漏。混淆测试对来自六个项目的 363 个二进制应用 Hikari 的三种默认混淆（F1 为 0.271–0.303）；恶意软件研究涵盖 16 个 x86-64 构建中的 812 个函数（F1 为 0.348）。", "targets": [ "binary" ], "title": "Beyond Classification: Inferring Function Names in Stripped Binaries via Domain Adapted LLMs", "title_zh": "超越分类：借助领域适配的大语言模型推断去符号二进制中的函数名", "url": "https://www.ndss-symposium.org/ndss-paper/beyond-classification-inferring-function-names-in-stripped-binaries-via-domain-adapted-llms/", "venue": "NDSS 2025", "verification": "source-reviewed", "verified_at": "2026-10-18", "why_fits_en": "Adds generative LLM-based function-name inference for stripped binaries with explicit deduplication, complementing classification-based function naming and variable, type and data-structure recovery research.", "why_fits_zh": "补充采用显式去重、基于生成式大语言模型的去符号二进制函数名推断方法，与基于分类的函数命名及变量、类型和数据结构恢复研究互补。", "year": 2025 }, { "arxiv_id": null, "arxiv_version_reviewed": null, "authors": [ "Xin Jin", "Kexin Pei", "Jun Yeon Won", "Zhiqiang Lin" ], "citation": { "container_title": "Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security", "pages": "1631-1645", "publisher": "ACM", "sources": [ "https://dl.acm.org/doi/10.1145/3548606.3560612", "https://api.crossref.org/works/10.1145/3548606.3560612" ] }, "code_url": "https://github.com/OSUSecLab/SymLM", "date_basis": "The ACM article page and the publisher’s Crossref deposit both give publication on 2022-11-07, which is also the first day of the November 7–11 conference; the publisher-stated date is recorded.", "date_basis_zh": "ACM 文章页面与出版方提交的 Crossref 元数据均将出版日期列为 2022-11-07，这也是 11 月 7—11 日会议的首日；本条目记录出版方给出的日期。", "date_precision": "day", "description_en": "SymLM predicts function names for stripped binaries as sets of name words. It encodes each function’s instructions with a Trex model pretrained on micro-execution traces, fuses them with embeddings of callers, internal callees and external library calls taken from Ghidra’s interprocedural CFG, and scores words from a fixed vocabulary with an MLP decoder; name preprocessing and a word-embedding module, CodeWordNet, handle abbreviations and synonyms. On 1,431,169 functions from 16,027 binaries of 27 projects across x86, x64, ARM and MIPS, O0–O3 and four Hikari obfuscations, the authors report weighted average precision 0.634, recall 0.677 and F1 0.655, plus a firmware case study.", "description_zh": "SymLM 将去符号二进制的函数名预测为一组名称单词。它使用在微执行轨迹上预训练的 Trex 模型编码每个函数的指令，将其与取自 Ghidra 过程间控制流图的调用者、内部被调用函数及外部库调用的嵌入融合，再由 MLP 解码器对固定词表中的单词打分；名称预处理和词嵌入模块 CodeWordNet 用于处理缩写与同义词。在 27 个项目的 16,027 个二进制、共 1,431,169 个函数上（涵盖 x86、x64、ARM 与 MIPS，O0–O3 优化级别及四种 Hikari 混淆），作者报告加权平均精确率 0.634、召回率 0.677、F1 0.655，并给出固件案例研究。", "doi": "10.1145/3548606.3560612", "entry_url": "https://awesomerea.org/papers/paper-symlm/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-symlm/", "evidence_urls": [ "https://dl.acm.org/doi/10.1145/3548606.3560612", "https://api.crossref.org/works/10.1145/3548606.3560612", "https://xinjin95.github.io/assets/pdf/SymLM_ccs2022_paper.pdf", "https://github.com/OSUSecLab/SymLM/blob/89a4815bb9e75e381b45665e40884f936986ed96/README.md", "https://github.com/OSUSecLab/SymLM/blob/89a4815bb9e75e381b45665e40884f936986ed96/LICENSE", "https://github.com/OSUSecLab/SymLM/blob/89a4815bb9e75e381b45665e40884f936986ed96/requirements.txt", "https://zenodo.org/records/8306055", "https://zenodo.org/api/records/8306055", "https://www.ndss-symposium.org/wp-content/uploads/2025-797-paper.pdf" ], "first_arxiv_date": null, "id": "paper-symlm", "kind": "research", "metadata_notes": "Crossref truncates the title to “SymLM”; the full title follows the ACM page and the author-hosted PDF, which carries the CCS ’22 header and DOI. ACM and Crossref agree on the four-author order and pages 1631–1645, and ACM marks the article free to read. An arXiv title search found no preprint. The reviewed 2025-07-06 repository snapshot is MIT-licensed and includes a vendored fairseq, dataset-generation scripts, a sample x64 dataset, training, prediction and evaluation scripts, and CodeWordNet training code. Its README sets up Python 3.8 with CUDA 11.3 PyTorch and pinned requirements such as transformers 4.16.2 and gensim 3.8.1; training needs a December 2021 Trex checkpoint and CodeWordNet models from Google Drive links, and it warns that newer Trex checkpoints may be incompatible. The full dataset is Zenodo record 8306055 (about 9.4 GB; CC BY 4.0 in its metadata), which is registered under the paper’s DOI rather than a separate dataset DOI. The paper reports 8 days of training on top of the Trex pretraining. Nothing was run or downloaded.", "metadata_notes_zh": "Crossref 将标题截断为“SymLM”；完整标题以 ACM 页面和作者托管的 PDF 为准，该 PDF 带有 CCS ’22 页眉及 DOI。ACM 与 Crossref 的四位作者顺序和页码 1631–1645 一致，ACM 将文章标为免费阅读。按标题检索 arXiv 未发现预印本。所审阅的 2025-07-06 仓库快照采用 MIT 许可证，包含内置的 fairseq、数据集生成脚本、x64 样例数据集、训练、预测与评估脚本以及 CodeWordNet 训练代码。其 README 使用 Python 3.8 与 CUDA 11.3 版 PyTorch，并固定 transformers 4.16.2、gensim 3.8.1 等依赖；训练需要通过 Google Drive 链接获取 2021 年 12 月的 Trex 检查点和 CodeWordNet 模型，README 并提示较新的 Trex 检查点可能不兼容。完整数据集位于 Zenodo 记录 8306055（约 9.4 GB；元数据标注 CC BY 4.0），该记录登记的是论文 DOI，而非单独的数据集 DOI。论文报告在 Trex 预训练之外还需训练 8 天。本次未运行或下载任何内容。", "pdf_url": "https://xinjin95.github.io/assets/pdf/SymLM_ccs2022_paper.pdf", "project_url": null, "publication_date": "2022-11-07", "publication_status": "conference-paper", "runtime_tested": false, "scope_limitations_en": "Names are predicted as unordered word sets from a fixed training vocabulary and scored with word-level precision, recall and F1, with CodeWordNet counting semantically similar words as matches. This is not exact source-name recovery, and out-of-vocabulary words cannot be produced. Binaries were built with GCC 7.5 for Linux and split by binary within the same 27 projects. On 540 binaries from 12 unseen projects, overall performance remains lower, which the authors partly attribute to vocabulary mismatch; a later NDSS 2025 comparison on deduplicated data reports SymLM’s average F1 at 0.105. NFRE comparisons are x64-only, and NERO comparisons use NERO’s dataset. Obfuscation covers four Hikari passes, not packing or encryption. In the firmware case study, 172 of 1,061 functions in eight 32-bit ARM firmware images received partially correct names.", "scope_limitations_zh": "函数名被预测为来自固定训练词表的无序单词集合，并按单词级精确率、召回率和 F1 评分，CodeWordNet 会将语义相近的单词计为匹配。这并非精确恢复源码名称，且无法生成词表外的单词。二进制由 GCC 7.5 为 Linux 构建，并在同样的 27 个项目内按二进制划分数据集。在来自 12 个未见项目的 540 个二进制上，整体表现仍然较低，作者将部分原因归于词表不匹配；后来一项 NDSS 2025 研究在去重数据上比较时，报告 SymLM 的平均 F1 为 0.105。与 NFRE 的比较仅针对 x64，与 NERO 的比较使用 NERO 的数据集。混淆实验覆盖四种 Hikari 混淆，不包括加壳或加密。固件案例中，八个 32 位 ARM 固件映像的 1,061 个函数里有 172 个得到部分正确的名称。", "targets": [ "binary" ], "title": "SymLM: Predicting Function Names in Stripped Binaries via Context-Sensitive Execution-Aware Code Embeddings", "title_zh": "SymLM：基于上下文敏感、执行感知代码嵌入的去符号二进制函数名预测", "url": "https://dl.acm.org/doi/10.1145/3548606.3560612", "venue": "ACM CCS 2022", "verification": "source-reviewed", "verified_at": "2026-10-18", "why_fits_en": "Adds execution-aware, calling-context function-name prediction for stripped binaries, evaluated across architectures, optimizations and obfuscations, complementing variable-name, type and data-structure recovery research.", "why_fits_zh": "补充结合执行语义与调用上下文的去符号二进制函数名预测方法，并在多种架构、优化级别和混淆设置下评估，与变量名、类型及数据结构恢复研究互补。", "year": 2022 }, { "arxiv_id": "2610.10374", "arxiv_version_reviewed": "v1", "authors": [ "Chengwei Shi", "Yunnong Chen", "Tingting Zhou", "Qiang Lu", "Shiyu Yue", "Xinyuan Hu", "Jianfang Ru", "Liuqing Chen" ], "code_url": null, "date_basis": "arXiv v1 submission date; no separate proceedings or journal publication was verified.", "date_basis_zh": "采用 arXiv v1 的提交日期，未核实另行出版的会议论文集或期刊版本。", "date_precision": "day", "description_en": "TaoD2C-Bench reconstructs interfaces from design images, layer metadata and component-library documentation. It separates requirement inference from implementation, checking component choices and layout relations through source/runtime evidence alongside rendered appearance.", "description_zh": "TaoD2C-Bench 根据设计图、图层元数据与组件库文档重建界面，将需求推断与代码实现分别评测，并结合源码、运行时结构及渲染结果检查组件选择与布局关系。", "doi": "10.48550/arXiv.2610.10374", "entry_url": "https://awesomerea.org/papers/paper-taod2c-bench/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-taod2c-bench/", "evidence_urls": [ "https://arxiv.org/abs/2610.10374v1", "https://arxiv.org/html/2610.10374v1", "https://taod2c-bench.github.io/", "https://github.com/TaoD2C-Bench/TaoD2C-Bench/tree/d4547c4d556d62dd01a73a9b1387a7e8477363bd" ], "first_arxiv_date": "2026-10-07", "id": "paper-taod2c-bench", "kind": "research", "metadata_notes": "The linked repository at d4547c4 contains evaluation JSON only; no scorer or license file was found. Paper Appendix F assigns CC BY-NC 4.0 to annotations and separate restrictive terms to platform-owned assets. No data assets or code were executed or downloaded.", "metadata_notes_zh": "所链接仓库的 d4547c4 版本仅含评测 JSON，未找到评分器或许可证文件。论文附录 F 将标注列为 CC BY-NC 4.0，并为平台自有素材规定另行限制条款。本次未下载数据素材或代码，也未执行任何产物。", "pdf_url": "https://arxiv.org/pdf/2610.10374v1", "project_url": "https://taod2c-bench.github.io/", "publication_date": "2026-10-07", "publication_status": "preprint", "runtime_tested": false, "scope_limitations_en": "Eight models are evaluated on 421 designs, not the full 2,861-design collection. Results include specified retries and one output-repair attempt. The tasks assess component/layout constraints and visual fidelity, not complete application behavior; all designs come from one commercial ecosystem.", "scope_limitations_zh": "八个模型的实测范围为 421 个设计，而非完整的 2,861 个设计。结果包含规定的重试与一次输出修复；任务衡量组件、布局约束及视觉相似度，不验证完整应用行为，设计来源也集中于同一商业生态。", "targets": [ "website", "app" ], "title": "TaoD2C-Bench: Benchmarking MLLMs for Industrial UI Code Generation Beyond Visual Fidelity", "title_zh": "TaoD2C-Bench：超越视觉相似度的工业界面代码生成评测", "url": "https://arxiv.org/abs/2610.10374", "venue": "arXiv", "verification": "source-reviewed", "verified_at": "2026-10-20", "why_fits_en": "Adds requirement-level checks for screenshot- and metadata-guided interface reconstruction.", "why_fits_zh": "为截图及元数据驱动的界面重建补充需求级检查。", "year": 2026 }, { "arxiv_id": null, "arxiv_version_reviewed": null, "authors": [ "Yanyang Zhao", "Zhengxiong Luo", "Wenlong Zhang", "Feifan Wu", "Yuanliang Chen", "Fuchen Ma", "Qi Xu", "Heyuan Shi", "Yu Jiang" ], "citation": { "container_title": "Proceedings of the ACM on Software Engineering", "issue": "FSE", "pages": "636-656", "publisher": "Association for Computing Machinery (ACM)", "sources": [ "https://api.crossref.org/works/10.1145/3797124" ], "volume": "3" }, "code_url": null, "date_basis": "ACM-deposited Crossref print/online publication date; the author-hosted manuscript retains placeholder publication metadata.", "date_basis_zh": "采用 ACM 向 Crossref 登记的纸质／在线出版日期，作者托管手稿仍保留占位出版元数据。", "date_precision": "day", "description_en": "Transfers field-boundary patterns from standardized protocol traces labeled by Tshark to poorly documented target protocols. A source-selection stage chooses related protocols, and a neural domain-adaptation model infers message syntax from their shared patterns.", "description_zh": "将 Tshark 标注的标准协议流量中的字段边界模式迁移到文档不足的目标协议。先选择相关源协议，再通过神经网络领域适应模型依据共享模式推断消息语法。", "doi": "10.1145/3797124", "entry_url": "https://awesomerea.org/papers/paper-transre/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-transre/", "evidence_urls": [ "https://api.crossref.org/works/10.1145/3797124", "https://fcorleone.github.io/publications/", "https://conf.researchr.org/details/fse-2026/fse-2026-research-papers/77/Protocol-Reverse-Engineering-via-Deep-Transfer-Learning" ], "first_arxiv_date": null, "id": "paper-transre", "kind": "research", "metadata_notes": "June 2026 is a strong six-month-window supplement. Fulltext was read from the public PDF explicitly linked by coauthor Fuchen Ma; its February date and placeholder DOI are not used as final metadata. The publisher PDF previously returned 403. Crossref confirms nine authors, volume 3(FSE), pages 636–656 and CC BY 4.0 for the version of record. No author-linked implementation release or code license was verified; nothing was run.", "metadata_notes_zh": "该工作发表于 2026 年 6 月，作为近六个月的强相关补充。全文来自共同作者 Fuchen Ma 明确链接的公开 PDF，不采用其中二月日期或占位 DOI 作为最终元数据；出版商 PDF 此前返回 403。Crossref 确认九位作者、卷 3(FSE)、636–656 页及正式版本 CC BY 4.0 许可。未核实作者关联的实现发布或代码许可，本次未运行任何产物。", "pdf_url": "https://dl.acm.org/doi/pdf/10.1145/3797124", "project_url": null, "publication_date": "2026-06-30", "publication_status": "journal-article", "runtime_tested": false, "scope_limitations_en": "Recovers message syntax, not state transitions. Evaluation uses 12 protocol variants; payload noise can distort source selection, while encrypted, compressed or obfuscated traffic needs separate preprocessing. Camera experiments supplement format metrics, but the four reported issues were vendor-known and do not establish complete protocol recovery.", "scope_limitations_zh": "恢复的是消息语法，而非状态转换。评估采用 12 种协议变体；载荷噪声可能干扰源协议选择，加密、压缩或混淆流量需要另行预处理。摄像头实验补充格式指标，但四个报告问题为厂商已知问题，也不证明协议已完整恢复。", "targets": [ "protocol" ], "title": "Protocol Reverse Engineering via Deep Transfer Learning", "title_zh": "通过深度迁移学习进行协议逆向工程", "url": "https://doi.org/10.1145/3797124", "venue": "Proceedings of the ACM on Software Engineering / FSE 2026", "verification": "source-reviewed", "verified_at": "2026-10-20", "why_fits_en": "Adds a transfer-learning approach to recovering undocumented message formats without parser source code.", "why_fits_zh": "补充无需解析器源码、利用迁移学习恢复未公开消息格式的方法。", "year": 2026 }, { "arxiv_id": null, "arxiv_version_reviewed": null, "authors": [ "Weidong Cui", "Marcus Peinado", "Karl Chen", "Helen J. Wang", "Luis Irun-Briz" ], "code_url": null, "date_basis": "ACM’s Crossref deposit records print and online publication on 2008-10-27, and an archived copy of the ACM article page shows the same date. The CCS meeting dates are not substituted.", "date_basis_zh": "ACM 提交的 Crossref 元数据将印刷与在线出版日期均记为 2008-10-27，ACM 论文页面的存档副本显示相同日期。本条目不以 CCS 会议日期替代。", "date_precision": "day", "description_en": "Tupni infers an input format from an execution trace of an x86 program parsing one input, using byte-level dynamic taint tracking. It segments the input into fields from the instructions that operate on tainted bytes, finds record sequences from parsing loops, groups records into types by the code that handles them, and emits an enhanced BNF grammar with length, value and some inter-message constraints. Grammars from several inputs can be merged into a more complete specification. The evaluation covers five file formats (WMF, BMP, JPG, PNG, TIF) and five network protocols (DNS, RPC, TFTP, HTTP, FTP), and the output is used for zero-day vulnerability signature generation with ShieldGen.", "description_zh": "Tupni 利用字节级动态污点跟踪，从 x86 程序解析单个输入时的执行轨迹推断输入格式。它依据处理污点字节的指令把输入切分为字段，从解析循环中找出记录序列，按处理代码将记录归为不同记录类型，并输出带有长度、取值及部分跨报文约束的增强 BNF 文法。多个输入得到的文法可以合并为更完整的规范。评测覆盖五种文件格式（WMF、BMP、JPG、PNG、TIF）和五种网络协议（DNS、RPC、TFTP、HTTP、FTP），并将输出用于 ShieldGen 的零日漏洞签名生成。", "doi": "10.1145/1455770.1455820", "entry_url": "https://awesomerea.org/papers/paper-tupni/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-tupni/", "evidence_urls": [ "https://dl.acm.org/doi/10.1145/1455770.1455820", "https://web.archive.org/web/20250206195542/https://dl.acm.org/doi/10.1145/1455770.1455820", "https://api.crossref.org/works/10.1145/1455770.1455820", "https://dl.acm.org/doi/pdf/10.1145/1455770.1455820", "https://www.microsoft.com/en-us/research/publication/tupni-automatic-reverse-engineering-of-input-formats/", "https://www.microsoft.com/en-us/research/wp-content/uploads/2016/02/tupni-ccs08.pdf" ], "first_arxiv_date": null, "id": "paper-tupni", "kind": "research", "metadata_notes": "Crossref and the archived ACM page give the five authors in this order, CCS ’08 pages 391–402, and the main title “Tupni” with subtitle “automatic reverse engineering of input formats”; the record uses the paper’s capitalization. The text was reviewed in the 12-page copy on the Microsoft Research publication page, whose byline spells the fifth author “Luiz Irun-Briz”; the record follows the ACM and Crossref spelling. The paper states that the prototype has 14,000 lines of C++ and 4,100 lines of Perl outside Vigilante and iDNA, and it links no code or data; the Windows test binaries and the 150 WMF files from an internal Microsoft repository are not public artifacts. No code or experiments were run.", "metadata_notes_zh": "Crossref 与 ACM 页面存档按此顺序列出五位作者，记载 CCS ’08 第 391–402 页，主标题为“Tupni”，副标题为“automatic reverse engineering of input formats”；本条目采用论文中的大小写。正文审阅依据 Microsoft Research 出版物页面提供的 12 页副本，其署名将第五位作者写作“Luiz Irun-Briz”；本条目沿用 ACM 与 Crossref 的拼写。论文说明，不计 Vigilante 与 iDNA，原型含 14,000 行 C++ 与 4,100 行 Perl；论文未链接代码或数据，Windows 测试二进制及来自 Microsoft 内部库的 150 个 WMF 文件也不是公开产物。本次未运行代码或实验。", "pdf_url": "https://dl.acm.org/doi/pdf/10.1145/1455770.1455820", "project_url": null, "publication_date": "2008-10-27", "publication_status": "conference-paper", "runtime_tested": false, "scope_limitations_en": "Tupni needs the parsing program and a recorded execution trace for every input; it does not work from captured traffic or files alone. The prototype combined iDNA traces with a re-implemented Vigilante taint engine, and the traces came from Windows XP SP2 binaries such as gdi32.dll, gdiplus.dll, nslookup.exe and IIS components. Single-input accuracy uses one input per format, scored by the authors against published specifications; WMF, DNS and HTTP guided the design, compressed image data was skipped in favor of container structure, and no quantitative baseline was run because earlier tools were unavailable. All record sequences were found, with some false-positive sequences, and 889 of 1,551 PNG fields were misidentified because the program ignored repeated chunk data. Coverage depends on input diversity, constraints can be specific to the samples, byte-level taint handles fields that do not align with bytes poorly (including many encrypted or compressed formats), and formats beyond regular expressions are out of scope. Inter-message constraints were evaluated only for TFTP, and multi-input aggregation only on 150 WMF files.", "scope_limitations_zh": "Tupni 需要解析程序以及每个输入对应的已记录执行轨迹，不能仅凭捕获的流量或文件工作。原型将 iDNA 轨迹与重新实现的 Vigilante 污点引擎结合，轨迹来自 Windows XP SP2 上的二进制，例如 gdi32.dll、gdiplus.dll、nslookup.exe 及 IIS 组件。单输入准确性评测每种格式只用一个输入，由作者对照公开规范判定；WMF、DNS 与 HTTP 用于指导设计，压缩图像数据被跳过，只分析容器结构；由于早期工具不可获得，未运行定量基线。所有记录序列均被识别，但存在部分误报序列；PNG 的 1,551 个字段中有 889 个识别错误，原因是程序忽略了重复数据块的内容。覆盖范围取决于输入的多样性，约束可能只适用于样本；字节级污点难以处理与字节边界不对齐的字段（包括许多加密或压缩格式），超出正则表达式描述能力的格式也不在适用范围内。跨报文约束只在 TFTP 上评估，多输入聚合只在 150 个 WMF 文件上评估。", "targets": [ "protocol", "binary" ], "title": "Tupni: Automatic Reverse Engineering of Input Formats", "title_zh": "Tupni：输入格式的自动逆向工程", "url": "https://dl.acm.org/doi/10.1145/1455770.1455820", "venue": "ACM CCS 2008", "verification": "source-reviewed", "verified_at": "2026-10-19", "why_fits_en": "Adds a classic execution-based input-format inference method that recovers record sequences, record types and field constraints, complementing the collection’s traffic-based and binary-assisted protocol-format research.", "why_fits_zh": "补充一种经典的基于执行的输入格式推断方法，可恢复记录序列、记录类型与字段约束，与合集中基于流量及借助二进制的协议格式研究互补。", "year": 2008 }, { "arxiv_id": "2607.28287", "arxiv_version_reviewed": "v1", "authors": [ "Jens Lehmann", "Andrei Aioanei", "Sahar Vahdati" ], "code_url": "https://github.com/NIMI-research/Tycho", "date_basis": "First public arXiv submission date; version v1 was reviewed.", "date_basis_zh": "首次公开提交至 arXiv 的日期；核查版本为 v1。", "date_precision": "day", "description_en": "Tycho constructs editable Python models of game state, transitions, rendering and outcomes from action/observation histories in unfamiliar ARC-AGI-3 games. It checks model predictions against recorded transitions and can use, repair or bypass these models during planning.", "description_zh": "Tycho 根据陌生 ARC-AGI-3 游戏中的动作与观察历史，构建可编辑的 Python 模型，描述游戏状态、状态转移、渲染与结果。它将模型预测与已记录的转移进行核对，并在规划时选择使用、修复或绕过这些模型。", "doi": "10.48550/arXiv.2607.28287", "entry_url": "https://awesomerea.org/papers/paper-tycho/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-tycho/", "evidence_urls": [ "https://arxiv.org/abs/2607.28287", "https://arxiv.org/html/2607.28287v1", "https://arxiv.org/pdf/2607.28287v1", "https://api.datacite.org/dois/10.48550/arXiv.2607.28287", "https://github.com/NIMI-research/Tycho", "https://raw.githubusercontent.com/NIMI-research/Tycho/f68912a764372ead0a610db2e1c011d41ce5197e/README.md", "https://raw.githubusercontent.com/NIMI-research/Tycho/f68912a764372ead0a610db2e1c011d41ce5197e/LICENSE", "https://raw.githubusercontent.com/NIMI-research/Tycho/f68912a764372ead0a610db2e1c011d41ce5197e/pyproject.toml", "https://raw.githubusercontent.com/NIMI-research/Tycho/f68912a764372ead0a610db2e1c011d41ce5197e/CITATION.cff", "https://raw.githubusercontent.com/NIMI-research/Tycho/f68912a764372ead0a610db2e1c011d41ce5197e/PUBLIC_RELEASE_MANIFEST.json" ], "first_arxiv_date": "2026-07-30", "id": "paper-tycho", "kind": "research", "metadata_notes": "The arXiv posting date is July 30; the manuscript header and software release use July 29. DataCite confirms the arXiv DOI is registered and findable. The pinned author artifact is Apache-2.0 and includes source, prompts, paper configurations and compact evaluation evidence; ARC environment terms are separate. Python >=3.12, model/ARC access and a Docker or Finch sandbox are documented requirements; no installation or experiments were run.", "metadata_notes_zh": "arXiv 发布日期为 7 月 30 日；文稿页首和软件发布采用 7 月 29 日。DataCite 确认 arXiv DOI 已注册且处于可检索状态。固定版本的作者产物采用 Apache-2.0，包含源码、提示词、论文配置和精简评估证据；ARC 环境适用独立条款。文档要求 Python >=3.12、模型与 ARC 访问权限，以及 Docker 或 Finch 沙箱；未进行安装或实验复现。", "pdf_url": "https://arxiv.org/pdf/2607.28287v1", "project_url": null, "publication_date": "2026-07-30", "publication_status": "preprint", "runtime_tested": false, "scope_limitations_en": "Evaluation uses one stochastic run per configuration on 25 public games and 183 levels; five games informed harness development. Models may abstain on cells or accept bounded rendering variants. Transition replay and game scores do not establish complete engine reconstruction, correct objectives, unseen-state fidelity, unseen-game generalization or run-to-run reliability; the agent can bypass modeling.", "scope_limitations_zh": "评估针对 25 个公开游戏、183 个关卡，每种配置仅进行一次随机运行；其中五个游戏曾用于开发智能体框架。模型可以不预测部分像素格，或接受有限的渲染变体。转移回放和游戏分数不能证明完整引擎重建、目标识别正确、未见状态保真度、未见游戏泛化或多次运行的可靠性；智能体也可以绕过建模。", "targets": [ "game" ], "title": "Tycho: Active Abstraction with Programmatic World Models for ARC-AGI-3", "title_zh": "Tycho：面向 ARC-AGI-3 的程序化世界模型主动抽象", "url": "https://arxiv.org/abs/2607.28287", "venue": "arXiv", "verification": "source-reviewed", "verified_at": "2026-10-17", "why_fits_en": "Studies executable reconstruction of observed game dynamics and checks model fidelity separately from task success, providing a bounded behavioral reconstruction case.", "why_fits_zh": "研究对已观察游戏动态的可执行重建，并将模型保真度与任务成功分开检验，提供了范围明确的行为重建案例。", "year": 2026 }, { "arxiv_id": null, "arxiv_version_reviewed": null, "authors": [ "Chang Zhu", "Ziyang Li", "Anton Xue", "Ati Priya Bajaj", "Wil Gibbs", "Yibo Liu", "Rajeev Alur", "Tiffany Bao", "Hanjun Dai", "Adam Doupé", "Mayur Naik", "Yan Shoshitaishvili", "Ruoyu Wang", "Aravind Machiry" ], "code_url": "https://github.com/sefcom/TYGR", "date_basis": "Publication month in the official USENIX proceedings BibTeX; the August 14–16, 2024 symposium dates are not used to assert a publication day.", "date_basis_zh": "采用 USENIX 官方论文集 BibTeX 中的出版月份；不以 2024 年 8 月 14–16 日的会议日期推定具体出版日。", "date_precision": "month", "description_en": "TYGR infers the types of stack and heap variables in stripped binaries by running an architecture-agnostic, intra-procedural data-flow analysis on angr's VEX IR and classifying each variable's data-flow graph with a graph neural network. It predicts base types, pointers and struct member layouts, covering 97.1% of the types observed in its data. The authors also build TyDa, 163,643 binaries compiled with debug information from Gentoo and Debian C packages for x86, x64, AArch64, Arm32 and MIPS at O0–O3, and deduplicate functions in the evaluated subset before splitting it. On x64 across O0–O3 they report 76.6% overall and 45.2% struct accuracy, and say TYGR beats prior work by at least 26.1% overall and 10.2% on structs.", "description_zh": "TYGR 在 angr 的 VEX 中间表示上执行与架构无关的过程内数据流分析，并用图神经网络对每个变量的数据流图进行分类，从而推断剥离符号二进制中栈变量与堆变量的类型。它可预测基本类型、指针及结构体成员布局，覆盖其数据中观察到的 97.1% 的类型。作者还构建了 TyDa：由 Gentoo 与 Debian 的 C 软件包以 O0–O3 编译、保留调试信息的 163,643 个二进制，涵盖 x86、x64、AArch64、Arm32 与 MIPS，并在划分评测子集前对其中函数去重。作者报告在 x64 的 O0–O3 上整体准确率为 76.6%、结构体准确率为 45.2%，并称整体准确率与结构体准确率分别至少超出已有工作 26.1% 和 10.2%。", "doi": null, "entry_url": "https://awesomerea.org/papers/paper-tygr/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-tygr/", "evidence_urls": [ "https://www.usenix.org/conference/usenixsecurity24/presentation/zhu-chang", "https://www.usenix.org/system/files/usenixsecurity24-zhu-chang.pdf", "https://github.com/sefcom/TYGR/tree/280320129a7f8bbfb9ee61b9a2155d2ddeac44c6", "https://github.com/sefcom/TYGR/blob/280320129a7f8bbfb9ee61b9a2155d2ddeac44c6/readme.md", "https://github.com/sefcom/TYGR/blob/280320129a7f8bbfb9ee61b9a2155d2ddeac44c6/environment.yml", "https://github.com/sefcom/TYGR/tree/280320129a7f8bbfb9ee61b9a2155d2ddeac44c6/model" ], "first_arxiv_date": null, "id": "paper-tygr", "kind": "research", "metadata_notes": "The USENIX page, its BibTeX entry and the final PDF agree on the 14-author order, pages 4283–4300 and ISBN 978-1-939133-44-1. USENIX assigns no paper DOI and no arXiv version was found, so the record relies on the reviewed USENIX Security 2024 URL/PDF identity. The paper releases its artifacts at github.com/sefcom/TYGR. At the reviewed 2024-08-22 commit the repository has no license file; it ships trained MODEL_base and MODEL_struct models, and its environment pins Python 3.8, PyTorch 1.8.1 with CUDA 10.2 and angr 9.0.7491. TyDa is not in the repository: the README links two Dropbox folders, one described as Gentoo C and C++ x86-64 binaries with per-optimization JSON metadata and one with the remaining C binaries, and notes that the dataset still contains duplicate functions. The Dropbox data was not downloaded, and no code or experiments were run.", "metadata_notes_zh": "USENIX 页面、其 BibTeX 条目与最终 PDF 的 14 位作者顺序、页码 4283–4300 及 ISBN 978-1-939133-44-1 一致。USENIX 不为论文分配 DOI，也未找到 arXiv 版本，因此本条目依据经审阅的 USENIX Security 2024 页面／PDF 出版方标识。论文在 github.com/sefcom/TYGR 发布研究产物。在所审阅的 2024-08-22 提交中，该仓库没有许可证文件；仓库附带训练好的 MODEL_base 与 MODEL_struct 模型，环境文件固定 Python 3.8、PyTorch 1.8.1（CUDA 10.2）与 angr 9.0.7491。TyDa 不在仓库内：README 链接了两个 Dropbox 文件夹，其一被描述为附有各优化级别 JSON 元数据的 Gentoo C 与 C++ x86-64 二进制，另一个包含其余 C 二进制，并说明数据集中仍有重复函数。本次未下载 Dropbox 数据，也未运行代码或实验。", "pdf_url": "https://www.usenix.org/system/files/usenixsecurity24-zhu-chang.pdf", "project_url": null, "publication_date": "2024-08", "publication_status": "conference-paper", "runtime_tested": false, "scope_limitations_en": "Ground truth comes from DWARF information in binaries compiled by the authors, and training and testing use TyDa-min, about 8% of TyDa's binaries, so the results do not cover wild, obfuscated or C++ code. The analysis is intra-procedural and covers stack and heap variables only, not globals; unresolved indirect jumps can leave code unexplored, and adjacent stack structs are predicted as one struct, though the authors find this rare in TyDa. Accuracy plateaus near 80% as training data grows, which the authors attribute to rare types and types that usage alone cannot distinguish. Comparisons follow each baseline's original setting: DIRTY and OSPREY on x64 only, and OSPREY through results its authors supplied for Coreutils x64-O0. Accuracy is not compared directly with Ghidra or IDA Pro. Predictions choose from a fixed set of base, pointer and struct-member types; they do not recover type names or full struct declarations.", "scope_limitations_zh": "真实标签来自作者自行编译的二进制中的 DWARF 信息，训练与测试使用 TyDa-min，即约 8% 的 TyDa 二进制，因此结果不涵盖野外样本、混淆代码或 C++ 代码。分析是过程内的，仅覆盖栈变量与堆变量，不包括全局变量；未解析的间接跳转可能使部分代码未被分析，相邻的栈上结构体会被预测为一个结构体，但作者发现这种情况在 TyDa 中很少见。随着训练数据增加，准确率在 80% 左右趋于平稳，作者将其归因于罕见类型以及仅凭使用方式无法区分的类型。比较按各基线的原始设定进行：DIRTY 与 OSPREY 仅在 x64 上比较，OSPREY 则使用其作者提供的 Coreutils x64-O0 结果。准确率未直接与 Ghidra 或 IDA Pro 比较。预测结果取自固定的基本类型、指针类型与结构体成员类型集合，并不恢复类型名称或完整的结构体声明。", "targets": [ "binary" ], "title": "TYGR: Type Inference on Stripped Binaries using Graph Neural Networks", "title_zh": "TYGR：基于图神经网络的剥离符号二进制类型推断", "url": "https://www.usenix.org/conference/usenixsecurity24/presentation/zhu-chang", "venue": "USENIX Security 2024", "verification": "source-reviewed", "verified_at": "2026-10-19", "why_fits_en": "Adds graph-neural-network type inference over data-flow graphs and a multi-architecture type-recovery dataset, complementing decompiler-output, LLM-based and synthesis-based type recovery research.", "why_fits_zh": "补充基于数据流图和图神经网络的类型推断方法及多架构类型恢复数据集，与基于反编译输出、大语言模型及程序合成的类型恢复研究互补。", "year": 2024 }, { "arxiv_id": null, "arxiv_version_reviewed": null, "authors": [ "Yanzhong Wang", "Ruigang Liang", "Yilin Li", "Peiwei Hu", "Kai Chen", "Bolun Zhang" ], "citation": { "container_title": "2025 IEEE Symposium on Security and Privacy (SP)", "publisher": "IEEE", "sources": [ "https://ieeexplore.ieee.org/document/11023499", "https://api.crossref.org/works/10.1109/SP61157.2025.00193" ] }, "code_url": "https://github.com/noobone123/TypeForge", "date_basis": "IEEE Xplore and the publisher’s Crossref deposit establish publication year 2025. Both list 12 May 2025, the first day of the May 12–15 symposium, and IEEE added the article to Xplore on 16 June 2025; neither date is treated as a verified publication day.", "date_basis_zh": "IEEE Xplore 与出版方提交的 Crossref 元数据确认出版年份为 2025。两者均列出 2025 年 5 月 12 日，即 5 月 12—15 日研讨会的首日；IEEE 于 2025 年 6 月 16 日将文章加入 Xplore。本条目不将这两个日期视为已核实的出版日。", "date_precision": "year", "description_en": "TypeForge recovers composite data types, including struct layouts, unions and pointer or nesting relationships, from stripped binaries. A whole-program Type Flow Graph over Ghidra’s decompiler-inferred variables propagates member offsets and sizes, cuts conflicting edges caused by casts and unions, and synthesizes candidate type declarations. An LLM only selects among these statically synthesized candidates: each is applied through the decompiler’s retype interface, and a double-elimination tournament compares the resulting pseudocode for readability. On OSPREY’s coreutils dataset the authors report F1 of 81.7% for composite-type identification, 88.2% for layout recovery and 72.1% for relationship recovery.", "description_zh": "TypeForge 从去符号二进制中恢复复合数据类型，包括结构体布局、联合体以及指针引用和嵌套关系。它在 Ghidra 反编译器推断出的变量之上构建全程序类型流图，传播成员偏移与大小，切断由类型转换和联合体引起的冲突边，并合成候选类型声明。大语言模型只在这些静态合成的候选中进行选择：每个候选通过反编译器的重定类型接口应用，再以双败淘汰赛比较所得伪代码的可读性。作者在 OSPREY 的 coreutils 数据集上报告复合类型识别 F1 为 81.7%、布局恢复 F1 为 88.2%、关系恢复 F1 为 72.1%。", "doi": "10.1109/SP61157.2025.00193", "entry_url": "https://awesomerea.org/papers/paper-typeforge/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-typeforge/", "evidence_urls": [ "https://ieeexplore.ieee.org/document/11023499", "https://api.crossref.org/works/10.1109/SP61157.2025.00193", "https://noobone123.github.io/papers/typeforge-sp25.pdf", "https://github.com/noobone123/TypeForge/blob/0f2ceff872362a1e4a4e927c589f9f5be465ebeb/README.md", "https://github.com/noobone123/TypeForge/blob/0f2ceff872362a1e4a4e927c589f9f5be465ebeb/LICENSE", "https://github.com/noobone123/TypeForge/blob/0f2ceff872362a1e4a4e927c589f9f5be465ebeb/Evaluation.md", "https://github.com/noobone123/TypeForge/blob/0f2ceff872362a1e4a4e927c589f9f5be465ebeb/scripts/README.md", "https://github.com/noobone123/TypeForge/blob/0f2ceff872362a1e4a4e927c589f9f5be465ebeb/scripts/requirements.txt", "https://github.com/noobone123/TypeForge/blob/0f2ceff872362a1e4a4e927c589f9f5be465ebeb/scripts/judge/README.md", "https://github.com/noobone123/TypeForge/blob/0f2ceff872362a1e4a4e927c589f9f5be465ebeb/scripts/judge/llm.py" ], "first_arxiv_date": null, "id": "paper-typeforge", "kind": "research", "metadata_notes": "IEEE Xplore and Crossref agree on the title, six-author order and DOI; an arXiv title search found no preprint. Both list article-relative pages 1–18, whereas the repository’s BibTeX gives 2847–2864; neither range is recorded in the citation. The author-hosted PDF is the final paper, including the S&P meta-review appendix. The reviewed 2026-03-17 snapshot, identical to its dev branch at review time, is a Ghidra extension tested with Ghidra 11.0.3; its Python 3.13 selection scripts pin LangChain 0.3.23 and openai 1.75.0, and their README example names gpt-4.1-mini rather than the paper’s GPT-4o mini. Ground-truth extraction needs DWARF 4 debug information. LICENSE contains BSD 3-Clause-style terms with an added requirement to cite the paper in academic work; the README badge says BSD 3-Clause and GitHub reports NOASSERTION, so no single license is asserted here. Evaluation.md links early-version data captured before LLM selection, notes a June 2025 identification bug fix after submission, and withholds the variable-alignment evaluation script, so the paper’s metrics cannot be recomputed from the release alone. No code, model calls or downloads were run.", "metadata_notes_zh": "IEEE Xplore 与 Crossref 的标题、六位作者顺序和 DOI 一致；按标题检索 arXiv 未发现预印本。两者均列出按文章计的页码 1–18，而仓库提供的 BibTeX 为 2847–2864；引用信息不记录这两种页码范围。作者托管的 PDF 是最终论文，包含 S&P 元评审附录。所审阅的 2026-03-17 快照在审阅时与 dev 分支相同，是在 Ghidra 11.0.3 上测试的 Ghidra 扩展；其 Python 3.13 选择脚本固定 LangChain 0.3.23 与 openai 1.75.0，README 示例使用 gpt-4.1-mini，而非论文中的 GPT-4o mini。提取真实标签需要 DWARF 4 调试信息。LICENSE 文件采用 BSD 3-Clause 风格条款，另加在学术工作中须引用论文的要求；README 徽章标为 BSD 3-Clause，GitHub 则报告 NOASSERTION，因此本条目不认定单一许可证。Evaluation.md 链接的是 LLM 选择阶段之前、由早期版本生成的数据，说明投稿后于 2025 年 6 月修复了影响类型识别的缺陷，并且未公开变量对齐评估脚本，因此仅凭发布内容无法重新计算论文指标。本次未运行代码、调用模型或下载数据。", "pdf_url": "https://noobone123.github.io/papers/typeforge-sp25.pdf", "project_url": null, "publication_date": null, "publication_status": "conference-paper", "runtime_tested": false, "scope_limitations_en": "Recovers member offsets, sizes and relationships, not original type or member names; relationship correctness is judged by matching layouts because names are unavailable. The main evaluation uses OSPREY’s dataset of GNU coreutils and larger Howard-dataset programs, over 10,000 functions and 11,000 composite-typed variables at O0–O3, with ground truth from debug information; the paper does not report results per architecture. In the baseline comparison, OSPREY results were supplied by its authors and its runtime is an estimate, and ReSym figures are its published results, so not every baseline was rerun. Conservative removal of conflicting edges can drop valid members, and compiler optimizations that merge or flatten members lower accuracy at higher levels. About 75% of runtime is the LLM selection stage; the default model was GPT-4o mini, with each comparison run three times. Downstream readability and vulnerability examples are case studies, not proof of semantic equivalence.", "scope_limitations_zh": "恢复的是成员偏移、大小和类型间关系，而非原始类型名或成员名；由于名称不可得，关系是否正确以布局匹配判定。主要评测使用 OSPREY 的数据集，包括 GNU coreutils 与 Howard 数据集中较大的程序，涵盖超过 10,000 个函数和 11,000 个复合类型变量，优化级别为 O0–O3，真实标签取自调试信息；论文未按架构分别报告结果。基线比较中，OSPREY 的结果由其作者提供，运行时间为估算值，ReSym 的数据取自其已发表结果，因此并非所有基线均经重新运行。保守地删除冲突边可能遗漏有效成员；合并或展平成员的编译器优化会降低较高优化级别下的准确率。约 75% 的运行时间用于大语言模型选择阶段；默认模型为 GPT-4o mini，每轮比较执行三次。下游可读性与漏洞检测示例属于案例研究，不能证明语义等价。", "targets": [ "binary" ], "title": "TypeForge: Synthesizing and Selecting Best-Fit Composite Data Types for Stripped Binaries", "title_zh": "TypeForge：为去符号二进制合成并选择最适配的复合数据类型", "url": "https://ieeexplore.ieee.org/document/11023499", "venue": "IEEE S&P 2025", "verification": "source-reviewed", "verified_at": "2026-10-18", "why_fits_en": "Adds static composite-type and struct-layout recovery that feeds decompiler readability, complementing learned variable naming, data-structure symbol recovery and LLM refinement of decompiler output.", "why_fits_zh": "补充以静态分析恢复复合类型与结构体布局、进而提升反编译结果可读性的方法，与基于学习的变量命名、数据结构符号恢复及大语言模型改写反编译输出的研究互补。", "year": 2025 }, { "arxiv_id": "2607.06306", "arxiv_version_reviewed": "v2", "authors": [ "Grace Man Chen", "Litao Guo", "Yifan Wu", "Yiyu Chen", "Yenchi Tseng", "Sicheng Liu", "Yuyu Luo", "Ying-Cong Chen" ], "code_url": "https://github.com/chenmancm169/UI2App", "date_basis": "First arXiv submission date. The reviewed v2 was submitted on 2026-10-04; it is not a separately verified conference publication.", "date_basis_zh": "首次提交至 arXiv 的日期。核查的 v2 于 2026-10-04 提交，不视为另行核实的会议出版。", "date_precision": "day", "description_en": "UI2App evaluates runnable React/TypeScript applications generated from 600 screenshots across 95 web applications. It separates build executability, visual fidelity and screenshot-implied interaction behavior, including cross-route state, using a reference interaction taxonomy and public evaluation pipeline.", "description_zh": "UI2App 使用来自 95 个 Web 应用的 600 张截图，评测生成的可运行 React/TypeScript 应用。它通过参考交互分类体系和公开评测流水线，分别衡量构建可执行性、视觉保真度，以及包括跨路由状态在内的截图隐含交互行为。", "doi": "10.48550/arXiv.2607.06306", "entry_url": "https://awesomerea.org/papers/paper-ui2app/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-ui2app/", "evidence_urls": [ "https://arxiv.org/abs/2607.06306", "https://arxiv.org/html/2607.06306v2", "https://arxiv.org/pdf/2607.06306v2", "https://api.datacite.org/dois/10.48550/arXiv.2607.06306", "https://chenmancm169.github.io/UI2App-ProjectPage/", "https://github.com/chenmancm169/UI2App/blob/520a59aad0899b1eb61e80351aa1ffbfad9322a4/README.md", "https://github.com/chenmancm169/UI2App/blob/520a59aad0899b1eb61e80351aa1ffbfad9322a4/LICENSE", "https://github.com/chenmancm169/UI2App/blob/520a59aad0899b1eb61e80351aa1ffbfad9322a4/requirements.txt", "https://github.com/chenmancm169/UI2App/blob/520a59aad0899b1eb61e80351aa1ffbfad9322a4/iis/evaluate.py", "https://huggingface.co/datasets/UI2App/UI2App/blob/32e6f6193c5c265cf6d8afcbce12b641e3c2a758/README.md", "https://huggingface.co/datasets/UI2App/UI2App/blob/32e6f6193c5c265cf6d8afcbce12b641e3c2a758/annotations/rii.jsonl" ], "first_arxiv_date": "2026-07-07", "id": "paper-ui2app", "kind": "research", "metadata_notes": "Use v2’s 95 applications and 600 screenshots, not v1’s 45/327 counts. The arXiv DOI is registered. Public code is MIT; the dataset and reference annotations are CC BY 4.0, with upstream code and third-party asset rights separate. The documented pipeline needs Python 3.10+, Node/npm, pnpm, Chromium, Tesseract and model access; Auto IIS additionally needs an authenticated Codex CLI. No pipeline or benchmark was run.", "metadata_notes_zh": "采用 v2 的 95 个应用与 600 张截图，不混用 v1 的 45/327 数量。arXiv DOI 已注册。公开代码采用 MIT，数据集和参考标注采用 CC BY 4.0；上游代码及第三方资产权利另行处理。文档所述流水线需要 Python 3.10+、Node/npm、pnpm、Chromium、Tesseract 和模型访问权限；Auto IIS 还需要已登录的 Codex CLI。本次未运行流水线或基准。", "pdf_url": "https://arxiv.org/pdf/2607.06306v2", "project_url": "https://chenmancm169.github.io/UI2App-ProjectPage/", "publication_date": "2026-07-07", "publication_status": "preprint", "runtime_tested": false, "scope_limitations_en": "Static screenshots underdetermine behavior; the rubric accepts multiple valid implementations rather than proving equivalence to the original application or backend. Auto IIS judges generated source and screenshots without tool execution; human runtime validation covers a 45-application subset. Cross-route state is not necessarily durable persistence across reloads or sessions. Main results use one generation per application-model pair, with repeated runs on a subset.", "scope_limitations_zh": "静态截图无法唯一确定行为；评分规则接受多种有效实现，并不证明与原应用或后端等价。Auto IIS 在不执行工具的情况下评判生成源码和截图，人工运行验证覆盖 45 个应用的子集。跨路由状态不一定能在重新加载或会话结束后持久保存。主结果每个应用与模型组合生成一次，重复运行仅覆盖子集。", "targets": [ "website" ], "title": "UI2App: Benchmarking Visual Interaction Inference in Executable Web Application Generation", "title_zh": "UI2App：评测可执行 Web 应用生成中的视觉交互推断", "url": "https://arxiv.org/abs/2607.06306", "venue": "arXiv", "verification": "source-reviewed", "verified_at": "2026-10-17", "why_fits_en": "Tests reconstruction from observed web interfaces while distinguishing visual copying from inferred interaction logic; its explicit behavior ambiguity makes it a bounded complement to trace-guided reconstruction benchmarks.", "why_fits_zh": "评测从已观察 Web 界面进行重建，并区分视觉复制与交互逻辑推断；其明确的行为歧义边界可补充由交互轨迹指导的重建基准。", "year": 2026 }, { "arxiv_id": null, "arxiv_version_reviewed": null, "authors": [ "Chunyang Chen", "Ting Su", "Guozhu Meng", "Zhenchang Xing", "Yang Liu" ], "citation": { "container_title": "Proceedings of the 40th International Conference on Software Engineering", "pages": "665-676", "publisher": "ACM", "sources": [ "https://api.crossref.org/works/10.1145/3180155.3180240" ] }, "code_url": "https://github.com/ccywch/UI2code", "date_basis": "Publisher-deposited Crossref publication date for the ICSE proceedings article.", "date_basis_zh": "出版方提交至 Crossref 的 ICSE 会议论文集文章出版日期。", "date_precision": "day", "description_en": "UI2code translates a mobile UI image into an Android component hierarchy and layout skeleton using a neural encoder-decoder. The paper evaluates structural prediction and a small developer study of implementing layouts from generated skeletons.", "description_zh": "UI2code 使用神经编码器—解码器，将移动 UI 图像转换为 Android 组件层级与布局骨架。论文评估了结构预测，并通过小规模开发者实验研究如何基于生成的骨架实现布局。", "doi": "10.1145/3180155.3180240", "entry_url": "https://awesomerea.org/papers/paper-ui2code/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-ui2code/", "evidence_urls": [ "https://doi.org/10.1145/3180155.3180240", "https://api.crossref.org/works/10.1145/3180155.3180240", "https://chunyang-chen.github.io/publication/ui2code.pdf", "https://conf.researchr.org/details/icse-2018/icse-2018-Technical-Papers/12/From-UI-Design-Image-to-GUI-Skeleton-A-Neural-Machine-Translator-to-Bootstrap-Mobile", "https://github.com/ccywch/UI2code", "https://raw.githubusercontent.com/ccywch/UI2code/fa2cb895dd3367340180257880a76886c9b6ee2f/README.md", "https://raw.githubusercontent.com/ccywch/UI2code/fa2cb895dd3367340180257880a76886c9b6ee2f/src/train.lua" ], "first_arxiv_date": null, "id": "paper-ui2code", "kind": "research", "metadata_notes": "The author-hosted PDF prints 10.1145/3180155.3180222, which identifies another paper; the DOI here follows publisher-deposited metadata for this title, pages 665–676. The artifact README lists 29,887 screenshots, while the paper reports 185,277 image/skeleton pairs; they should not be treated as the same released corpus. The pinned legacy Torch/Lua repository has no license file; external data and model downloads were not tested.", "metadata_notes_zh": "作者托管 PDF 印有 10.1145/3180155.3180222，但该 DOI 对应另一篇论文；此处采用出版方为本标题提交的 DOI，页码为 665–676。代码仓库 README 列出 29,887 张截图，论文则报告 185,277 对图像与骨架，不应视为同一套已发布语料。固定版本的旧版 Torch/Lua 仓库没有许可证文件；未测试外部数据和模型下载。", "pdf_url": "https://chunyang-chen.github.io/publication/ui2code.pdf", "project_url": null, "publication_date": "2018-05-27", "publication_status": "conference-paper", "runtime_tested": false, "scope_limitations_en": "The output covers component types and hierarchy from a single image; detailed styling and text require developer work. Structural token accuracy and an eight-participant study on five screenshots do not establish complete visual fidelity, navigation, app logic or backend recovery. The main split is screenshot-based; a separate evaluation on 1,208 images from 20 unseen apps provides limited generalization evidence.", "scope_limitations_zh": "输出仅覆盖单张图像中的组件类型与层级；详细样式和文本仍需开发者补充。结构标记准确率以及针对五张截图、由八名参与者开展的实验，不能证明完整视觉保真度，也不代表恢复了导航、应用逻辑或后端。主数据集按截图划分；独立评估使用了 20 个未见应用的 1,208 张图像，提供了有限的泛化证据。", "targets": [ "app" ], "title": "From UI Design Image to GUI Skeleton: A Neural Machine Translator to Bootstrap Mobile GUI Implementation", "title_zh": "从 UI 设计图到 GUI 骨架：辅助启动移动界面实现的神经机器翻译器", "url": "https://doi.org/10.1145/3180155.3180240", "venue": "ICSE 2018", "verification": "source-reviewed", "verified_at": "2026-10-17", "why_fits_en": "A native-app reconstruction foundation that explicitly generates and evaluates GUI structure from visual observations, beyond locating interface elements.", "why_fits_zh": "这是原生应用重建的基础工作，明确从视觉观察生成并评估 GUI 结构，研究范围超出了界面元素定位。", "year": 2018 }, { "arxiv_id": null, "arxiv_version_reviewed": null, "authors": [ "Chuhuai Yue", "Jiajun Chai", "Yufei Zhang", "Zixiang Ding", "Xihao Liang", "Peixin Wang", "Shihai Chen", "Wang Yixuan", "Yanping Wang", "Guojun Yin", "Wei Lin" ], "citation": { "container_title": "Findings of the Association for Computational Linguistics: EMNLP 2025", "pages": "2769-2782", "publisher": "Association for Computational Linguistics", "sources": [ "https://aclanthology.org/2025.findings-emnlp.150/", "https://api.crossref.org/works/10.18653/v1/2025.findings-emnlp.150" ] }, "code_url": null, "date_basis": "The official ACL Anthology citation gives November 2025. Crossref records only the year; the November 4–9 conference dates printed in the PDF are not treated as a publication day.", "date_basis_zh": "ACL Anthology 官方引文给出 2025 年 11 月。Crossref 仅记录年份；PDF 中的 11 月 4–9 日会议日期不作为具体出版日。", "date_precision": "month", "description_en": "UIOrchestra converts static mobile UI designs into React/CSS through layout-description, code-generation and rendered-image comparison agents. Its APPUI benchmark contains 1,101 human-refined code/rendering pairs based on screenshots from 165 apps across 12 categories. The reference code is reconstructed for evaluation, rather than recovered original application source.", "description_zh": "UIOrchestra 通过布局描述、代码生成及渲染图像比较三个智能体，将静态移动 UI 设计转换为 React/CSS。其 APPUI 基准包含 1,101 组经人工修订的代码与渲染图像，依据 12 类中的 165 款应用截图构建。参考代码为评测而重建，并非恢复出的原始应用源码。", "doi": "10.18653/v1/2025.findings-emnlp.150", "entry_url": "https://awesomerea.org/papers/paper-uiorchestra/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-uiorchestra/", "evidence_urls": [ "https://aclanthology.org/2025.findings-emnlp.150/", "https://aclanthology.org/2025.findings-emnlp.150.pdf", "https://api.crossref.org/works/10.18653/v1/2025.findings-emnlp.150", "https://gjyin.github.io/" ], "first_arxiv_date": null, "id": "paper-uiorchestra", "kind": "research", "metadata_notes": "Reviewed the final 14-page proceedings PDF. Its eleven-author order is retained, including Yanping Wang where ACL/Crossref metadata renders Wangyanping; Wang Yixuan is preserved as printed. No arXiv version was verified. The paper promises a code/data release, but the reviewed coauthor page has disabled code/project placeholders and no attributable release or artifact license was verified. Code/project URLs therefore remain unset. The paper is covered by ACL’s CC BY 4.0 policy; this does not establish licensing for an unreleased dataset or depicted apps.", "metadata_notes_zh": "审阅最终 14 页会议论文 PDF，保留其中十一位作者的顺序，包括 ACL／Crossref 元数据写作 Wangyanping 的 Yanping Wang；Wang Yixuan 按论文原样保留。未核实 arXiv 版本。论文承诺发布代码与数据，但所审阅的合作者主页中，代码／项目链接仍是禁用的占位链接；未核实可归属于作者的发布产物或其许可，因此代码／项目 URL 留空。论文适用 ACL 的 CC BY 4.0 政策，但这并不证明尚未发布的数据集或所展示应用的许可。", "pdf_url": "https://aclanthology.org/2025.findings-emnlp.150.pdf", "project_url": null, "publication_date": "2025-11", "publication_status": "conference-paper", "runtime_tested": false, "scope_limitations_en": "Tests visual, component and code similarity, not native-package execution, interaction, backend behavior or application equivalence. APPUI references are rendered reconstructions of iOS screenshots; unavailable images/icons use placeholders. A human study covers 200 samples with four annotators. The difference-analysis prompt ignores font-size/typeface differences and placeholder image content. Model snapshots, rendering dependencies and a reproducible runtime setup were not verified; experiments were not rerun.", "scope_limitations_zh": "评测视觉、组件及代码相似度，不验证原生安装包执行、交互、后端行为或应用等价性。APPUI 参考图像来自对 iOS 截图所做重建的渲染结果；无法获取的图片／图标使用占位素材。人工研究由四位标注者评估 200 个样本。差异分析提示词忽略字号／字体差异及占位图像内容。未核实模型快照、渲染依赖或可复现的运行环境，亦未重新运行实验。", "targets": [ "app", "website" ], "title": "UIOrchestra: Generating High-Fidelity Code from UI Designs with a Multi-agent System", "title_zh": "UIOrchestra：通过多智能体系统将 UI 设计转换为高保真代码", "url": "https://aclanthology.org/2025.findings-emnlp.150/", "venue": "Findings of EMNLP 2025", "verification": "source-reviewed", "verified_at": "2026-10-18", "why_fits_en": "Adds a mobile-oriented screenshot reconstruction method and benchmark with explicit human-built reference data; also evaluates on Design2Code-hard webpages.", "why_fits_zh": "补充面向移动界面的截图重建方法与基准，明确参考数据由人工参与构建，并在 Design2Code-hard 网页上开展评测。", "year": 2025 }, { "arxiv_id": "2606.31732", "arxiv_version_reviewed": "v1", "authors": [ "Yaozhi Zheng", "Yilei Jiang", "Manyuan Zhang", "Yuxuan Wan", "Kaituo Feng", "Tianshuo Peng", "Bo Zhang", "Xiangyu Yue" ], "code_url": "https://github.com/JimmyZhengyz/unicoder", "date_basis": "arXiv v1 submission date; no separate proceedings or journal publication was verified.", "date_basis_zh": "采用 arXiv v1 的提交日期，未核实另行出版的会议论文集或期刊版本。", "date_precision": "day", "description_en": "UniCoder trains a visual-to-code model for charts, SVGs and webpages. Its reinforcement-learning objective combines rendering checks, image similarity and code-derived visual attributes; low-reward training groups receive reference-code trajectories to improve exploration.", "description_zh": "UniCoder 面向图表、SVG 与网页训练视觉到代码模型。强化学习目标结合渲染检查、图像相似度和代码中的视觉属性，并向低奖励训练组加入参考代码轨迹以改善探索。", "doi": "10.48550/arXiv.2606.31732", "entry_url": "https://awesomerea.org/papers/paper-unicoder/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-unicoder/", "evidence_urls": [ "https://arxiv.org/abs/2606.31732v1", "https://arxiv.org/html/2606.31732v1", "https://github.com/JimmyZhengyz/unicoder/blob/2844ebd5908d563338580b1bd60f61032bf8fc24/README.md", "https://github.com/JimmyZhengyz/unicoder/blob/2844ebd5908d563338580b1bd60f61032bf8fc24/MODEL_RELEASE.md", "https://github.com/JimmyZhengyz/unicoder/blob/2844ebd5908d563338580b1bd60f61032bf8fc24/LICENSE", "https://github.com/JimmyZhengyz/unicoder/blob/2844ebd5908d563338580b1bd60f61032bf8fc24/THIRD_PARTY_NOTICES.md" ], "first_arxiv_date": "2026-06-30", "id": "paper-unicoder", "kind": "research", "metadata_notes": "At 2844ebd, the repository releases ChartMimic/UniSVG evaluation wrappers, not model weights, full training code or datasets. Original repository code is Apache-2.0; adapted benchmarks retain their own terms. The arXiv title includes “UniCoder”; the HTML heading and software citation omit that prefix. No artifacts were run.", "metadata_notes_zh": "仓库 2844ebd 版本发布 ChartMimic／UniSVG 评测封装，未发布模型权重、完整训练代码或数据集。仓库原创代码采用 Apache-2.0，改编基准仍保留原条款。arXiv 标题包含“UniCoder”前缀，HTML 标题及软件引用则省略该前缀。本次未运行产物。", "pdf_url": "https://arxiv.org/pdf/2606.31732v1", "project_url": null, "publication_date": "2026-06-30", "publication_status": "preprint", "runtime_tested": false, "scope_limitations_en": "Experiments concern static visual reconstruction with one 8B backbone, including Design2Code and ScreenBench. Reference code is used during training; successful rendering does not prove interactive behavior. Extending the attribute extractor to new domains requires new schemas/prompts. Interactive interfaces, animation and mobile-app behavior are not evaluated.", "scope_limitations_zh": "实验以一个 8B 基座模型研究静态视觉重建，包含 Design2Code 与 ScreenBench。参考代码用于训练，渲染成功不证明交互行为正确；新领域需要调整属性模式与提示词。交互界面、动画及移动应用行为未被评测。", "targets": [ "website" ], "title": "UniCoder: Unified Visual-to-Code Generation via Symbolic Rewards and Reference-Guided Code Optimization", "title_zh": "UniCoder：利用符号奖励与参考代码引导优化的统一视觉到代码生成", "url": "https://arxiv.org/abs/2606.31732", "venue": "arXiv", "verification": "source-reviewed", "verified_at": "2026-10-20", "why_fits_en": "Explores training signals for recovering code from visual website references.", "why_fits_zh": "探索根据网页视觉参考恢复代码的训练信号。", "year": 2026 }, { "arxiv_id": null, "arxiv_version_reviewed": null, "authors": [ "Kuntal Kumar Pal", "Ati Priya Bajaj", "Pratyay Banerjee", "Audrey Dutcher", "Mutsumi Nakamura", "Zion Leonahenahe Basque", "Himanshu Gupta", "Saurabh Arjun Sawant", "Ujjwala Anantheswaran", "Yan Shoshitaishvili", "Adam Doupé", "Chitta Baral", "Ruoyu Wang" ], "code_url": "https://github.com/sefcom/VarBERT/tree/76f221a5e0af43a36169818cbbfd6e8dd3c98cdc", "date_basis": "IEEE’s Crossref deposit and the proceedings title establish publication year 2024. Its published-print date, 2024-05-19, is the first day of the May 19–23 symposium, and the IEEE Xplore record could not be retrieved to confirm a separate publication date, so no day is asserted.", "date_basis_zh": "IEEE 提交的 Crossref 元数据及论文集名称确认出版年份为 2024。其 published／纸质出版日期 2024-05-19 恰为 5 月 19—23 日会议的首日，且未能获取 IEEE Xplore 记录以确认另有出版日期，因此本条目不推定具体日期。", "date_precision": "year", "description_en": "VarBERT suggests variable names for IDA Hex-Rays and Ghidra decompiler output with a BERT-style model pre-trained on 5.2M human-written C functions from Debian and fine-tuned on decompiled code; it also predicts whether each variable came from the developer or was introduced by the decompiler. The authors build VarCorpus from Gentoo C and C++ packages compiled for x86-64 at O0–O3, labeling decompiled variables from debug symbols. On per-function splits of O2 binaries, top-1 accuracy is 54.43% for IDA and 54.49% for Ghidra; on an IDA-O0 subset it reaches 50.70%, against 35.94% for DIRE and 38.00% for DIRTY.", "description_zh": "VarBERT 使用 BERT 式模型为 IDA Hex-Rays 与 Ghidra 的反编译输出建议变量名：模型先以来自 Debian 的 520 万个人工编写的 C 函数预训练，再以反编译代码微调；它还预测每个变量出自开发者，还是由反编译器引入。作者从 Gentoo 的 C 与 C++ 软件包构建 VarCorpus，在 O0 至 O3 下编译为 x86-64，并借助调试符号为反编译变量标注名称。在 O2 二进制的按函数划分上，IDA 与 Ghidra 的 Top-1 准确率分别为 54.43% 和 54.49%；在 IDA-O0 子集上为 50.70%，DIRE 与 DIRTY 分别为 35.94% 和 38.00%。", "doi": "10.1109/SP54263.2024.00152", "entry_url": "https://awesomerea.org/papers/paper-varbert/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-varbert/", "evidence_urls": [ "https://ieeexplore.ieee.org/document/10646727", "https://api.crossref.org/works/10.1109/SP54263.2024.00152", "https://www.atipriya.com/files/papers/varbert_oakland24.pdf", "https://github.com/sefcom/VarBERT/blob/76f221a5e0af43a36169818cbbfd6e8dd3c98cdc/README.md", "https://github.com/sefcom/VarBERT/blob/76f221a5e0af43a36169818cbbfd6e8dd3c98cdc/requirements.txt", "https://github.com/sefcom/VarBERT/blob/76f221a5e0af43a36169818cbbfd6e8dd3c98cdc/Dockerfile" ], "first_arxiv_date": null, "id": "paper-varbert", "kind": "research", "metadata_notes": "Crossref gives the 13 authors in this order and pages 4069–4087 of the 2024 IEEE Symposium on Security and Privacy; the DOI resolves to IEEE Xplore document 10646727, whose page could not be retrieved during review. The title follows the paper's curly quotation marks; Crossref stores straight quotes. The 19-page author-hosted PDF, linked from the repository, lacks IEEE pagination and includes the program committee's meta-review. No arXiv version was found. The paper used IDA Pro 7.6, Ghidra 10.4, PyTorch 1.9.0, Transformers 4.10.0 and FairSeq 0.10.0. The reviewed 2025-12-17 repository commit has no license file, so no open license is asserted; its README lists Python 3.8+, Java 11 for Joern and Java 17+ for Ghidra 10.4, requirements.txt leaves torch and transformers unpinned, the Dockerfile (Ubuntu 22.04, Python 3.11) fetches a modified Joern from Dropbox, and the README serves the HSC and VarCorpus data, Gentoo binaries and 16 fine-tuned models from Dropbox. Inference is offered through the separate binsync/varbert_api library and the DAILA plugin. No data or models were downloaded and no code or experiments were run.", "metadata_notes_zh": "Crossref 按此顺序列出 13 位作者，并给出 2024 IEEE Symposium on Security and Privacy 第 4069–4087 页；DOI 指向 IEEE Xplore 文档 10646727，审阅时未能获取该页面。标题沿用论文中的弯引号，Crossref 记录的是直引号。仓库链接的 19 页作者自存 PDF 没有 IEEE 页码，并附有程序委员会的元评审。未找到 arXiv 版本。论文使用 IDA Pro 7.6、Ghidra 10.4、PyTorch 1.9.0、Transformers 4.10.0 与 FairSeq 0.10.0。所审阅的 2025-12-17 仓库提交没有许可证文件，因此本条不认定开放许可；其 README 要求 Python 3.8+、供 Joern 使用的 Java 11 和供 Ghidra 10.4 使用的 Java 17+；requirements.txt 未固定 torch 与 transformers 版本，Dockerfile（Ubuntu 22.04、Python 3.11）会从 Dropbox 下载修改版 Joern；README 还通过 Dropbox 提供 HSC 与 VarCorpus 数据、Gentoo 二进制文件及 16 个微调模型。推理功能由独立的 binsync/varbert_api 库与 DAILA 插件提供。本次未下载数据或模型，也未运行代码或实验。", "pdf_url": "https://www.atipriya.com/files/papers/varbert_oakland24.pdf", "project_url": null, "publication_date": null, "publication_status": "conference-paper", "runtime_tested": false, "scope_limitations_en": "Predicted names are learned suggestions scored against developer names, not recovered originals. Top-1 accuracy drops to 42.40% (IDA) and 40.49% (Ghidra) on per-binary O2 splits, and the per-binary IDA-O0 lead over DIRTY is 4.52 points. The DIRE and DIRTY comparison covers IDA at O0 only, on about 400K functions (roughly 15% of VarCorpus), because DIRE's training time was prohibitive. The method can name only variables the decompiler recovers, and labeling relies on IDA and Ghidra preserving variables when matching debug symbols. Corpora come from Linux distribution packages, mainly x86-64 with a smaller AArch64 O2 experiment, and may not represent Windows or macOS executables; deduplication removes exact duplicates only. The user study had 27 students who completed 13 function pairs. Types, structures and recompilable code are outside its scope.", "scope_limitations_zh": "预测名称是模型学到的建议，以开发者原名称评分，并非恢复出的原始符号。在 O2 的按二进制划分上，Top-1 准确率降至 42.40%（IDA）与 40.49%（Ghidra）；在 IDA-O0 的按二进制划分上，其领先 DIRTY 的幅度为 4.52 个百分点。与 DIRE、DIRTY 的比较仅覆盖 O0 下的 IDA，并因 DIRE 训练耗时过长而只使用约 40 万个函数（约占 VarCorpus 的 15%）。方法只能为反编译器恢复出的变量命名，标注则依赖 IDA 与 Ghidra 在匹配调试符号时保留变量。语料来自 Linux 发行版软件包，以 x86-64 为主，另有规模较小的 AArch64 O2 实验，可能不代表 Windows 或 macOS 可执行文件；去重仅删除完全重复项。用户研究由 27 名完成全部 13 组函数的学生参与。类型、数据结构与可重新编译的代码不在其范围内。", "targets": [ "binary" ], "title": "“Len or index or count, anything but v1”: Predicting Variable Names in Decompilation Output with Transfer Learning", "title_zh": "“len、index 或 count，就是别叫 v1”：基于迁移学习预测反编译输出中的变量名", "url": "https://ieeexplore.ieee.org/document/10646727", "venue": "IEEE S&P 2024", "verification": "source-reviewed", "verified_at": "2026-10-18", "why_fits_en": "Adds transfer-learning variable-name prediction across two decompilers and four optimization levels, with a dataset that addresses train–test overlap in earlier naming benchmarks.", "why_fits_zh": "补充跨两种反编译器与四种优化级别的迁移学习变量名预测方法，并提供一个针对早期命名基准训练集与测试集重叠问题的数据集。", "year": 2024 }, { "arxiv_id": "2603.26648", "arxiv_version_reviewed": "v3", "authors": [ "Zehai He", "Wenyi Hong", "Zhen Yang", "Ziyang Pan", "Mingdao Liu", "Xiaotao Gu", "Jie Tang" ], "citation": { "container_title": "Proceedings of the 43rd International Conference on Machine Learning", "pages": "41393-41415", "publisher": "PMLR", "series": "Proceedings of Machine Learning Research", "sources": [ "https://proceedings.mlr.press/v306/he26n.html" ], "volume": "306" }, "code_url": "https://github.com/zai-org/Vision2Web", "date_basis": "Publication date stated for PMLR volume 306; the July 6–11 conference dates are not used as the publication date.", "date_basis_zh": "采用 PMLR 第 306 卷标明的出版日期；不将 7 月 6—11 日的会议日期作为出版日期。", "date_precision": "day", "description_en": "Benchmarks website development from visual prototypes and written requirements across 100 static-page, 66 interactive-frontend and 27 full-stack tasks, combining workflow-based functional checks with model-judged visual comparison.", "description_zh": "基于视觉原型和文字需求评测网站开发，包含 100 项静态页面、66 项交互前端与 27 项全栈任务，将基于工作流的功能检查与模型进行的视觉比较结合。", "doi": null, "entry_url": "https://awesomerea.org/papers/paper-vision2web/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-vision2web/", "evidence_urls": [ "https://proceedings.mlr.press/v306/he26n.html", "https://proceedings.mlr.press/v306/", "https://raw.githubusercontent.com/mlresearch/v306/main/assets/he26n/he26n.pdf", "https://arxiv.org/abs/2603.26648", "https://arxiv.org/html/2603.26648v3", "https://vision2web-bench.github.io/", "https://github.com/zai-org/Vision2Web/blob/d80a4a3d0ea7326541ad87314294269a633789e4/README.md", "https://github.com/zai-org/Vision2Web/blob/d80a4a3d0ea7326541ad87314294269a633789e4/setup.py", "https://github.com/zai-org/Vision2Web/blob/d80a4a3d0ea7326541ad87314294269a633789e4/vision2web/evaluation/prompts.py", "https://github.com/zai-org/Vision2Web/blob/d80a4a3d0ea7326541ad87314294269a633789e4/vision2web/evaluation/functional_tester.py", "https://huggingface.co/datasets/zai-org/Vision2Web/blob/8f03299d92b9bd852e93852d0c21e8a4848ab661/README.md" ], "first_arxiv_date": "2026-03-27", "id": "paper-vision2web", "kind": "research", "metadata_notes": "The final PMLR paper has seven authors and pages 41393–41415; arXiv v3 is dated 2026-07-20. Current artifact evaluation differs from the paper configuration. Licensing signals conflict: README text says CC-BY-NC-SA-4.0, Hugging Face metadata says Apache-2.0, the project page says CC BY-SA 4.0, and setup.py lists MIT while the repository has no LICENSE file. No uniform artifact license is asserted.", "metadata_notes_zh": "正式 PMLR 论文包含七位作者，页码为 41393–41415；arXiv v3 日期为 2026-07-20。当前产物的评测配置与论文不同。许可信息存在冲突：README 正文声明 CC-BY-NC-SA-4.0，Hugging Face 元数据标为 Apache-2.0，项目页声明 CC BY-SA 4.0，setup.py 列出 MIT，但仓库没有 LICENSE 文件。因此不宣称产物适用统一许可。", "pdf_url": "https://raw.githubusercontent.com/mlresearch/v306/main/assets/he26n/he26n.pdf", "project_url": "https://vision2web-bench.github.io/", "publication_date": "2026-09-29", "publication_status": "conference-paper", "runtime_tested": false, "scope_limitations_en": "The full-stack tier is specification-driven, not reconstruction solely by exploring a live website. Workflows test state management and CRUD outcomes, but finite agent judgments do not establish exact backend or durable-database equivalence. The current public evaluator maintains a browser session within each workflow and permits local business-API checks; this is not a universal persistence proof.", "scope_limitations_zh": "全栈层级由明确规格驱动，并非仅通过探索运行中的网站进行重建。工作流测试状态管理与增删改查结果，但有限的智能体判断不能证明后端或数据库持久性的精确等价。当前公开评测器在每个工作流内保持浏览器会话，并允许检查本地业务 API；这不构成通用的持久化证明。", "targets": [ "website" ], "title": "Vision2Web: A Hierarchical Benchmark for Visual Website Development with Agent Verification", "title_zh": "Vision2Web：采用智能体验证的分层视觉网站开发基准", "url": "https://proceedings.mlr.press/v306/he26n.html", "venue": "ICML 2026", "verification": "source-reviewed", "verified_at": "2026-10-17", "why_fits_en": "A useful comparison for evaluating interactive and stateful website reconstruction, while separating written-specification development from behavior-only inference.", "why_fits_zh": "可用于比较交互式、有状态网站重建的评测方法，同时明确区分根据文字规格开发与仅凭行为推断。", "year": 2026 }, { "arxiv_id": "2610.17861", "arxiv_version_reviewed": "v1", "authors": [ "Ruwei Pan", "Junlei Shen", "Linhao Wu", "Zixiong Yang", "Qisheng Zhang", "Yifan Li", "Tianyu Ma", "Yakun Zhang", "Lu Zhang", "Hongyu Zhang" ], "code_url": null, "date_basis": "First arXiv v1 submission; no formal venue publication was verified.", "date_basis_zh": "采用 arXiv v1 首次提交日期；未核实正式会议或期刊出版。", "date_precision": "day", "description_en": "VisStateCoder links visual prototype elements, project files, interaction requirements and render evidence in a project state graph, then uses those links to generate websites and limit subsequent repairs to selected files.", "description_zh": "VisStateCoder 以项目状态图连接视觉原型元素、项目文件、交互需求与渲染证据，据此生成网站，并将后续修复限制在选定文件内。", "doi": "10.48550/arxiv.2610.17861", "entry_url": "https://awesomerea.org/papers/paper-visstatecoder/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-visstatecoder/", "evidence_urls": [ "https://arxiv.org/abs/2610.17861", "https://arxiv.org/html/2610.17861v1", "https://api.datacite.org/dois/10.48550/arxiv.2610.17861" ], "first_arxiv_date": "2026-10-13", "id": "paper-visstatecoder", "kind": "research", "metadata_notes": "DataCite registered the matching arXiv DOI on 2026-10-14. The article uses the arXiv non-exclusive license. The paper states that its implementation, prompts, projects, logs and annotations are released, but an author-linked artifact and code/data license were not verified in the reviewed sources and bounded search. No website project, model or experiment was executed.", "metadata_notes_zh": "DataCite 于 2026-10-14 登记匹配的 arXiv DOI。文章采用 arXiv 非独占许可。论文声明已发布实现、提示、项目、日志和标注，但所审阅来源及有界检索未核实作者链接的产物或代码／数据许可。本次未运行网站项目、模型或实验。", "pdf_url": "https://arxiv.org/pdf/2610.17861v1", "project_url": null, "publication_date": "2026-10-13", "publication_status": "preprint", "runtime_tested": false, "scope_limitations_en": "Requires visual prototypes and textual workflow requirements. The five-model Vision2Web evaluation covers up to seven-page HTML/CSS/JavaScript sites with an optional Node.js server; larger projects and React/Vue are untested. Each configuration runs once, without variance or significance estimates. Internal repair checks do not execute interaction workflows; functional scores come from separate benchmark tests. Visual judges and incomplete tests limit conclusions about behavior, maintainability and accessibility.", "scope_limitations_zh": "需要视觉原型及文字形式的交互流程需求。五个模型上的 Vision2Web 评测覆盖最多七页的 HTML/CSS/JavaScript 网站，可选 Node.js 服务端；未测试更大项目或 React／Vue。每种配置仅运行一次，没有方差或显著性估计。内部修复检查不执行交互流程，功能分数来自独立的基准测试。视觉评判器及不完备测试限制了对行为、可维护性和可访问性的结论。", "targets": [ "website" ], "title": "State-Aware Generation of Deployable Websites from Visual Prototypes and Requirements", "title_zh": "从视觉原型与需求生成可部署网站的状态感知方法", "url": "https://arxiv.org/abs/2610.17861", "venue": "arXiv", "verification": "source-reviewed", "verified_at": "2026-10-20", "why_fits_en": "Studies visual-reference website reconstruction with explicit links between reference elements, code files and repair evidence.", "why_fits_zh": "研究以视觉参照重建网站，并显式关联参照元素、代码文件和修复证据。", "year": 2026 }, { "arxiv_id": "2406.11346", "arxiv_version_reviewed": "v3", "authors": [ "Xinyu She", "Yanjie Zhao", "Haoyu Wang" ], "citation": { "container_title": "Proceedings of the 39th IEEE/ACM International Conference on Automated Software Engineering", "pages": "481-492", "publisher": "ACM", "sources": [ "https://api.crossref.org/works/10.1145/3691620.3695020" ] }, "code_url": "https://github.com/XinyuShe/WaDec/tree/e244f7172539478a5b64bbb86e1fd03e527cb6be", "date_basis": "ACM-deposited Crossref metadata gives print and online publication on 2024-10-27. That is also the first day of the October 27–November 1 conference; the date comes from the publisher record, not from the conference schedule.", "date_basis_zh": "ACM 提交的 Crossref 元数据将纸质与在线出版日期均记为 2024-10-27。该日期恰为 10 月 27 日至 11 月 1 日会议的首日；本条目依据出版方记录，而非根据会议日程推定。", "date_precision": "day", "description_en": "WaDec decompiles WebAssembly text (wat) into C by fine-tuning CodeLlama-7b with LoRA on loop-level wat–C snippet pairs. Functions are ordered by dependency and sliced so that each input holds at most one loop, with nested loops replaced by markers. Prompts add declarations of called functions, previously defined local variables and offset-to-string mappings; the outputs are then reassembled, with string constants restored and variables renamed. Training data come from 51,768 the-stack-dedup and 377 TheAlgorithms/C programs compiled with Emscripten. On 3,977 C files, the authors report 3.34% code inflation, 52.11% recompilability, 43.55% re-execution and 27.15% output consistency, compared with Wasm2c and Ghidra.", "description_zh": "WaDec 使用循环级 wat–C 代码片段对，以 LoRA 微调 CodeLlama-7b，将 WebAssembly 文本格式（wat）反编译为 C。它按依赖关系排列函数并进行切片，使每个输入至多包含一个循环，嵌套循环以标记替代。提示中补充被调用函数的声明、此前已定义的局部变量以及偏移到字符串的映射；随后重组输出，恢复字符串常量并重命名变量。训练数据来自经 Emscripten 编译的 51,768 个 the-stack-dedup 程序和 377 个 TheAlgorithms/C 程序。作者在 3,977 个 C 文件上报告，代码膨胀率为 3.34%，可重新编译率为 52.11%，可重新执行率为 43.55%，输出一致率为 27.15%，并与 Wasm2c 及 Ghidra 进行比较。", "doi": "10.1145/3691620.3695020", "entry_url": "https://awesomerea.org/papers/paper-wadec/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-wadec/", "evidence_urls": [ "https://dl.acm.org/doi/10.1145/3691620.3695020", "https://api.crossref.org/works/10.1145/3691620.3695020", "https://arxiv.org/abs/2406.11346", "https://arxiv.org/pdf/2406.11346v3", "https://github.com/XinyuShe/WaDec/blob/e244f7172539478a5b64bbb86e1fd03e527cb6be/README.md", "https://github.com/XinyuShe/WaDec/blob/e244f7172539478a5b64bbb86e1fd03e527cb6be/Scripts/infering.py", "https://huggingface.co/datasets/wadecc/FGW2C/blob/572a8501594303a369df1b0152812a5e9e0f16ed/README.md", "https://huggingface.co/wadecc/Wat2c/blob/e7e740ea819fedbc7da19b7a22f82b4b2c049a90/adapter_config.json" ], "first_arxiv_date": "2024-06-17", "id": "paper-wadec", "kind": "research", "metadata_notes": "ACM's Crossref deposit gives the three-author order, pages 481–492 and publication on 2024-10-27. The reviewed arXiv v3 (2024-09-11, comment “This paper was accepted by ASE 2024”) carries the ACM reference format and DOI; v1 dates from 2024-06-17. The paper's footnote names github.com/XinyuShe/WaDec as the replication artifact, while its reference list and the README's clone command still point to an anonymous review mirror. The reviewed 2024-07-24 snapshot contains dataset-construction notebooks, an evaluation JSON file and inference and metric scripts, but no license file or declaration, so no open license is inferred. The README lists only Python 3.x and Git as prerequisites. It points to the wadecc/FGW2C dataset (110,096 examples, no license declared) and the wadecc/Wat2c model, a LoRA adapter whose configuration names codellama/CodeLlama-7b-hf as its base, so the base model's own license also applies. No dataset, model or code was downloaded or run.", "metadata_notes_zh": "ACM 提交的 Crossref 元数据给出三位作者的顺序、481–492 页码及 2024-10-27 出版日期。所审阅的 arXiv v3（2024-09-11，备注“This paper was accepted by ASE 2024”）载有 ACM 引用格式与 DOI；v1 发布于 2024-06-17。论文脚注将 github.com/XinyuShe/WaDec 列为复现产物，但其参考文献和 README 中的克隆命令仍指向匿名评审镜像。所审阅的 2024-07-24 快照包含数据集构建笔记本、一份评估 JSON 文件以及推断与指标脚本，但没有许可证文件或声明，因此不推定为开放许可。README 仅列出 Python 3.x 与 Git 作为前提条件，并指向 wadecc/FGW2C 数据集（110,096 条样本，未声明许可证）及 wadecc/Wat2c 模型；后者是 LoRA 适配器，其配置将 codellama/CodeLlama-7b-hf 列为基座模型，因此基座模型自身的许可证同样适用。本次未下载或运行数据集、模型或代码。", "pdf_url": "https://arxiv.org/pdf/2406.11346v3", "project_url": null, "publication_date": "2024-10-27", "publication_status": "conference-paper", "runtime_tested": false, "scope_limitations_en": "The reported rates are author results on C programs compiled to Wasm with Emscripten. About half of the outputs recompile, fewer than half re-execute and roughly a quarter reproduce the original output, so decompiled code is generally not semantically equivalent. The 3,977-file benchmark comes from the same two sources as the training programs. Optimized builds are not evaluated: the authors neither adapted the method to nor trained it on O1/O2 code. The model also handles data structures poorly, often flattening them into separate variables or arrays. Only C sources are studied; Wasm produced from other languages or toolchains is not evaluated. Baselines are Wasm2c and Ghidra's Wasm plugin, and LLM baselines were excluded because none could decompile Wasm functions without fine-tuning. Slicing means one function may be decompiled several times, at about 0.1 to 2 seconds per prompt.", "scope_limitations_zh": "所报告的比率是作者在经 Emscripten 编译为 Wasm 的 C 程序上取得的结果。约一半输出可重新编译，不到一半可重新执行，约四分之一能复现原始输出，因此反编译代码总体上并不语义等价。含 3,977 个文件的基准与训练程序来自相同的两个来源。未评估优化构建：作者既未针对 O1/O2 代码调整方法，也未用其训练模型。模型处理数据结构的能力也较弱，常将其拆成独立变量或数组。研究仅涉及 C 源码，未评估由其他语言或工具链生成的 Wasm。基线为 Wasm2c 与 Ghidra 的 Wasm 插件；由于没有大语言模型能在未经微调时反编译 Wasm 函数，此类基线被排除。切片意味着一个函数可能需多次反编译，每个提示约需 0.1 至 2 秒。", "targets": [ "binary", "website" ], "title": "WaDec: Decompiling WebAssembly Using Large Language Model", "title_zh": "WaDec：基于大语言模型的 WebAssembly 反编译", "url": "https://dl.acm.org/doi/10.1145/3691620.3695020", "venue": "ASE 2024", "verification": "source-reviewed", "verified_at": "2026-10-18", "why_fits_en": "Adds LLM decompilation of WebAssembly with recompilation and re-execution checks, complementing the native-binary decompilation research in this section and the WebAssembly tools in the catalog.", "why_fits_zh": "补充带重新编译与重新执行检查的大语言模型 WebAssembly 反编译方法，与本节中的原生二进制反编译研究及目录中的 WebAssembly 工具互补。", "year": 2024 }, { "arxiv_id": "2406.20098", "arxiv_version_reviewed": "v2", "authors": [ "Sukmin Yun", "Haokun Lin", "Rusiru Thushara", "Mohammad Qazim Bhat", "Yongxin Wang", "Zutao Jiang", "Mingkai Deng", "Jinhong Wang", "Tianhua Tao", "Junbo Li", "Haonan Li", "Preslav Nakov", "Timothy Baldwin", "Zhengzhong Liu", "Eric P. Xing", "Xiaodan Liang", "Zhiqiang Shen" ], "citation": { "container_title": "Advances in Neural Information Processing Systems", "pages": "112134-112157", "sources": [ "https://proceedings.nips.cc/paper_files/paper/2024/hash/cb66be286795d71f89367d596bf78ea7-Abstract-Datasets_and_Benchmarks_Track.html", "https://api.crossref.org/works/10.52202/079017-3560" ], "volume": "37" }, "code_url": "https://github.com/MBZUAI-LLM/web2code", "date_basis": "The official NeurIPS proceedings and publisher-deposited Crossref metadata identify publication year 2024; Crossref provides no finer publication date. The first arXiv submission date is recorded separately.", "date_basis_zh": "NeurIPS 官方论文集与出版方提交的 Crossref 元数据标明出版年份为 2024；Crossref 未提供更精确的出版日期。arXiv 首次提交日期另行记录。", "date_precision": "year", "description_en": "Studies screenshot-to-HTML reconstruction through instruction tuning and two evaluation benchmarks. Web2Code combines generated webpages, refined WebSight and pix2code image/code pairs, and WebSRC-derived question answering. Models produce HTML from a webpage image and instruction; rendered output is compared visually, while a separate benchmark measures screenshot understanding.", "description_zh": "通过指令微调和两个评测基准研究从截图重建 HTML。Web2Code 结合生成网页、经改进的 WebSight 与 pix2code 图像／代码对，以及来自 WebSRC 的问答。模型根据网页图像与指令生成 HTML，渲染输出接受视觉比较，另一个基准则测量截图理解能力。", "doi": "10.52202/079017-3560", "entry_url": "https://awesomerea.org/papers/paper-web2code/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-web2code/", "evidence_urls": [ "https://proceedings.nips.cc/paper_files/paper/2024/hash/cb66be286795d71f89367d596bf78ea7-Abstract-Datasets_and_Benchmarks_Track.html", "https://proceedings.neurips.cc/paper_files/paper/2024/file/cb66be286795d71f89367d596bf78ea7-Paper-Datasets_and_Benchmarks_Track.pdf", "https://arxiv.org/abs/2406.20098v2", "https://arxiv.org/html/2406.20098v2", "https://api.crossref.org/works/10.52202/079017-3560", "https://github.com/MBZUAI-LLM/web2code/blob/48c356a97dd6199f29a9710fdd2b4b2689b5e361/README.md", "https://github.com/MBZUAI-LLM/web2code/blob/48c356a97dd6199f29a9710fdd2b4b2689b5e361/web2code/README.md", "https://github.com/MBZUAI-LLM/web2code/blob/48c356a97dd6199f29a9710fdd2b4b2689b5e361/web2code/pyproject.toml", "https://github.com/MBZUAI-LLM/web2code/blob/48c356a97dd6199f29a9710fdd2b4b2689b5e361/web2code/LICENSE", "https://github.com/MBZUAI-LLM/web2code/blob/48c356a97dd6199f29a9710fdd2b4b2689b5e361/code_generation/README.md", "https://github.com/MBZUAI-LLM/web2code/blob/48c356a97dd6199f29a9710fdd2b4b2689b5e361/code_generation/gpt4_vision_evaluation.py", "https://github.com/MBZUAI-LLM/web2code/blob/48c356a97dd6199f29a9710fdd2b4b2689b5e361/webpage_understanding/README.md", "https://huggingface.co/datasets/MBZUAI/Web2Code/blob/21e587b4509b946e56732fe8c621b17bad631e6b/README.md" ], "first_arxiv_date": "2024-06-28", "id": "paper-web2code", "kind": "research", "metadata_notes": "Published in NeurIPS volume 37, pages 112134–112157; full author names follow the proceedings PDF. The repository still cites the preprint; reviewed arXiv v2 is dated 2024-11-17. The LLaVA-based training subtree carries Apache-2.0. Dataset licensing is inconsistent: the GitHub README and dataset-card frontmatter say MIT, while the same card’s body says CC BY 4.0 with research-only/non-commercial wording. No blanket reuse permission is inferred for constituent data or model weights. The training metadata requires Python >=3.8 and pins PyTorch 2.0.1; evaluation needs browser rendering and an external vision-model API. No training, evaluation, model or dataset payload was run or downloaded.", "metadata_notes_zh": "发表于 NeurIPS 第 37 卷，第 112134–112157 页；作者完整姓名以论文集 PDF 为准。仓库仍引用预印本；所审阅 arXiv v2 日期为 2024-11-17。基于 LLaVA 的训练子目录采用 Apache-2.0。数据集许可声明不一致：GitHub README 与数据卡元数据写 MIT，同一数据卡正文却写 CC BY 4.0，并附仅供研究／非商业措辞。不据此推定全部组成数据或模型权重具有统一复用许可。训练元数据要求 Python >=3.8，固定 PyTorch 2.0.1；评估需要浏览器渲染与外部视觉模型 API。本合集未运行训练或评估，也未下载模型或数据集载荷。", "pdf_url": "https://proceedings.neurips.cc/paper_files/paper/2024/file/cb66be286795d71f89367d596bf78ea7-Paper-Datasets_and_Benchmarks_Track.pdf", "project_url": "https://mbzuai-llm.github.io/webpage2code/", "publication_date": null, "publication_status": "conference-paper", "runtime_tested": false, "scope_limitations_en": "Evaluation uses 1,198 screenshots and 5,990 yes/no questions. WCGB grades rendered images with GPT-4V; its User Interface and Interactivity category measures element appearance, not executed click paths, persistent state or backend behavior. Synthetic and refined examples do not establish coverage of arbitrary real web applications, original-source equivalence or code quality. The paper reports contact-information issues in 2.7% of a 1,000-item privacy sample, so a blanket claim that the data is free of such information is unsupported.", "scope_limitations_zh": "评估使用 1,198 张截图和 5,990 个是／否问题。WCGB 用 GPT-4V 评价渲染图像；其“用户界面与交互性”类别衡量元素外观，并不执行点击路径、持久状态或后端行为。合成与改进样本不能确立对任意真实 Web 应用的覆盖、与原始源码等价或代码质量。论文报告，在 1,000 项隐私抽样中，2.7% 存在联系信息问题，因此不能笼统宣称数据完全不含此类信息。", "targets": [ "website" ], "title": "Web2Code: A Large-scale Webpage-to-Code Dataset and Evaluation Framework for Multimodal LLMs", "title_zh": "Web2Code：面向多模态大语言模型的大规模网页转代码数据集与评估框架", "url": "https://proceedings.nips.cc/paper_files/paper/2024/hash/cb66be286795d71f89367d596bf78ea7-Abstract-Datasets_and_Benchmarks_Track.html", "venue": "NeurIPS 2024 Datasets and Benchmarks", "verification": "source-reviewed", "verified_at": "2026-10-17", "why_fits_en": "A foundational visual reconstruction dataset and evaluation method, useful for distinguishing screenshot fidelity from the behavioral guarantees of later website-reconstruction benchmarks.", "why_fits_zh": "提供基础性的视觉重建数据集与评估方法，有助于区分截图保真度与后续网站重建基准所检验的行为保证。", "year": 2024 }, { "arxiv_id": "2404.06369", "arxiv_version_reviewed": "v2", "authors": [ "Yi Gui", "Zhen Li", "Yao Wan", "Yemin Shi", "Hongyu Zhang", "Bohua Chen", "Yi Su", "Dongping Chen", "Siyuan Wu", "Xing Zhou", "Wenbin Jiang", "Hai Jin", "Xiangliang Zhang" ], "citation": { "container_title": "Proceedings of the ACM on Web Conference 2025", "pages": "1834-1845", "publisher": "ACM", "sources": [ "https://dl.acm.org/doi/10.1145/3696410.3714889", "https://api.crossref.org/works/10.1145/3696410.3714889" ] }, "code_url": "https://github.com/CGCL-codes/naturalcc/tree/main/examples/webcode2m", "date_basis": "The ACM article page and ACM-deposited Crossref metadata agree on publication on 2025-04-22; the April 28–May 2 conference dates are not used as the publication date.", "date_basis_zh": "ACM 文章页面与 ACM 提交的 Crossref 元数据均将出版日期记为 2025-04-22；本条目不以 4 月 28 日至 5 月 2 日的会议日期作为出版日期。", "date_precision": "day", "description_en": "WebCode2M pairs about 2.56 million real-world webpage screenshots with purified HTML/CSS code and element bounding-box layout trees. Pages sampled from a Common Crawl snapshot are cleaned (scripts, metadata and hidden elements removed, styles merged into one block), rendered with Playwright, and filtered by a neural scorer trained on 10,000 annotated samples. The paper fine-tunes Pix2Struct-1.3B as the WebCoder baseline, introduces TreeBLEU to measure DOM-structure recall, and benchmarks specialized, open and commercial multimodal models on short, medium and long test subsets of 256 pages each.", "description_zh": "WebCode2M 将约 256 万张真实网页截图与净化后的 HTML/CSS 代码及元素边界框布局树配对。数据取样自 Common Crawl 快照，经清洗（移除脚本、元数据与隐藏元素，并将样式合并为单一样式块）后用 Playwright 渲染，再由基于 10,000 条人工标注样本训练的神经评分器筛选。论文以 Pix2Struct-1.3B 微调出基线模型 WebCoder，提出衡量 DOM 结构召回率的 TreeBLEU 指标，并在短、中、长三个各含 256 个网页的测试子集上评测专用、开源及商业多模态模型。", "doi": "10.1145/3696410.3714889", "entry_url": "https://awesomerea.org/papers/paper-webcode2m/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-webcode2m/", "evidence_urls": [ "https://dl.acm.org/doi/10.1145/3696410.3714889", "https://api.crossref.org/works/10.1145/3696410.3714889", "https://arxiv.org/abs/2404.06369", "https://arxiv.org/pdf/2404.06369v2", "https://webcode2m.github.io/", "https://huggingface.co/datasets/xcodemind/webcode2m/blob/f53cd4a9317364e32a6fc7d99dc50761fe54715f/README.md", "https://github.com/CGCL-codes/naturalcc/blob/5f84062064947a0e2137ebda0bd3a9ae8ceb1736/examples/webcode2m/README.MD", "https://github.com/CGCL-codes/naturalcc/blob/5f84062064947a0e2137ebda0bd3a9ae8ceb1736/examples/webcode2m/environment.yml", "https://github.com/CGCL-codes/naturalcc/blob/5f84062064947a0e2137ebda0bd3a9ae8ceb1736/examples/webcode2m/requirements.txt", "https://github.com/CGCL-codes/naturalcc/blob/5f84062064947a0e2137ebda0bd3a9ae8ceb1736/LICENSE" ], "first_arxiv_date": "2024-04-09", "id": "paper-webcode2m", "kind": "research", "metadata_notes": "arXiv v1 (2024-04-09) was titled “VISION2UI: A Real-World Dataset with Layout for Code Generation from UI Designs”; the reviewed v2 (2025-02-22, comment “WWW'25”) carries the final title and DOI. The ACM page and Crossref list Bohua Chen before Yi Su, while arXiv v2 lists Yi Su first; this record follows the publisher order. The project page links the paper, the naturalcc code directory and the Hugging Face dataset. The reviewed dataset-card revision f53cd4a (2025-03-05) declares CC BY 4.0, says the dataset is also called Vision2UI, warns of inappropriate content and points to a purified variant; its data directory is about 1.1 TB. The naturalcc repository declares MIT. Its webcode2m README still uses earlier names: the UICoder model and the vision2ui_test set, which now redirects to webcode2m_test. The environment file pins Python 3.10, PyTorch 2.1.2 and Transformers 4.33.1. No dataset, model or code was downloaded or run.", "metadata_notes_zh": "arXiv v1（2024-04-09）的标题为“VISION2UI: A Real-World Dataset with Layout for Code Generation from UI Designs”；所审阅的 v2（2025-02-22，备注“WWW'25”）采用最终标题并载有 DOI。ACM 页面与 Crossref 将 Bohua Chen 列于 Yi Su 之前，而 arXiv v2 将 Yi Su 列前；本条目遵循出版方顺序。项目页面链接论文、naturalcc 代码目录及 Hugging Face 数据集。所审阅的数据集卡片修订版 f53cd4a（2025-03-05）声明 CC BY 4.0，说明该数据集也称 Vision2UI，提醒可能含不当内容，并指向一个净化版本；其数据目录约 1.1 TB。naturalcc 仓库声明 MIT 许可。其 webcode2m README 仍使用早期名称：UICoder 模型与 vision2ui_test 测试集，后者现已重定向至 webcode2m_test。环境文件固定 Python 3.10、PyTorch 2.1.2 与 Transformers 4.33.1。本次未下载或运行数据集、模型或代码。", "pdf_url": "https://arxiv.org/pdf/2404.06369v2", "project_url": "https://webcode2m.github.io/", "publication_date": "2025-04-22", "publication_status": "conference-paper", "runtime_tested": false, "scope_limitations_en": "The task is static HTML/CSS generation from a design image. Scripts are stripped during purification, so interaction, client-side behavior and backend logic are not reconstructed, and outputs are judged by visual score, CLIP similarity and TreeBLEU rather than functional equivalence. The paper reports that no evaluated model reproduces image elements accurately, and scores fall as target code grows longer. The 768 test pages were drawn from high-scoring candidates and manually inspected; the scorer is about 90% accurate, so low-quality training samples remain, and the authors warn that crawled content may still include inappropriate material. Commercial models are named only by family, and about one-third of Gemini test cases failed with recitation errors, so those comparisons are snapshots. The dataset card's CC BY 4.0 license does not clear rights in the crawled pages' code, text or images.", "scope_limitations_zh": "任务是根据设计图生成静态 HTML/CSS。净化过程会移除脚本，因此不重建交互、客户端行为或后端逻辑；输出以视觉得分、CLIP 相似度和 TreeBLEU 评判，而非功能等价性。论文报告，所有被评测模型都无法准确还原图像元素，且目标代码越长得分越低。768 个测试网页取自高分候选并经人工检查；评分器准确率约为 90%，训练集中仍有低质量样本，作者也提醒爬取内容可能仍含不当材料。商业模型仅以模型家族命名，约三分之一的 Gemini 测试样例因 recitation 错误失败，因此相关比较只反映当时情况。数据集卡片声明的 CC BY 4.0 许可不能清除所爬取网页代码、文本或图片的权利。", "targets": [ "website" ], "title": "WebCode2M: A Real-World Dataset for Code Generation from Webpage Designs", "title_zh": "WebCode2M：面向网页设计稿代码生成的真实世界数据集", "url": "https://dl.acm.org/doi/10.1145/3696410.3714889", "venue": "WWW 2025", "verification": "source-reviewed", "verified_at": "2026-10-18", "why_fits_en": "Adds a large real-world design-to-code training corpus with layout trees and a structure metric, complementing the smaller real-page and synthetic website-reconstruction benchmarks in this section.", "why_fits_zh": "补充带布局树和结构指标的大规模真实设计稿到代码训练语料，与本节中规模较小的真实网页基准及合成网站重建基准互补。", "year": 2025 }, { "arxiv_id": "2608.12518", "arxiv_version_reviewed": "v1", "authors": [ "Ziyun Guo", "Jingyu Xiao", "Yuqiang Sun", "Yintong Huo" ], "code_url": "https://github.com/ZiyunGuo/WebCompat", "date_basis": "arXiv v1 submission date; no separate proceedings or journal publication was verified.", "date_basis_zh": "采用 arXiv v1 的提交日期，未核实另行出版的会议论文集或期刊版本。", "date_precision": "day", "description_en": "WebCompat evaluates screenshot-reconstructed webpages across browsers and devices. Its XCompat detector combines rendered DOM geometry, viewport metadata and screenshots to identify layout and element failures, independently of similarity to the original design.", "description_zh": "WebCompat 评测由截图重建的网页在不同浏览器与设备中的表现。XCompat 结合渲染后 DOM 几何信息、视口元数据及截图检测布局与元素问题，并将跨环境一致性与原始设计的相似度区分开。", "doi": "10.48550/arXiv.2608.12518", "entry_url": "https://awesomerea.org/papers/paper-webcompat/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-webcompat/", "evidence_urls": [ "https://arxiv.org/abs/2608.12518v1", "https://arxiv.org/html/2608.12518v1", "https://github.com/ZiyunGuo/WebCompat/blob/61d4ce2c345ff2d01ed5176bf5fd6c4c64b74a8b/README.md", "https://github.com/ZiyunGuo/WebCompat/tree/61d4ce2c345ff2d01ed5176bf5fd6c4c64b74a8b" ], "first_arxiv_date": "2026-08-12", "id": "paper-webcompat", "kind": "research", "metadata_notes": "The pinned public snapshot contains 203 empirical pages; the paper’s 51-page test split was not found. README reports no license and incomplete collection/metric packaging. Its 56 passing tests are author-reported; no code, BrowserStack session or dataset asset was executed or downloaded for this review.", "metadata_notes_zh": "固定版本的公开快照包含 203 个实证分析网页，未找到论文所述的 51 页测试集。README 说明缺少许可证，采集与指标流程的打包也不完整。56 项测试通过是作者报告；本次未下载数据素材或代码，也未执行代码或 BrowserStack 会话。", "pdf_url": "https://arxiv.org/pdf/2608.12518v1", "project_url": null, "publication_date": "2026-08-12", "publication_status": "preprint", "runtime_tested": false, "scope_limitations_en": "Filtering retains 254 static pages from 480 generations, producing 2,032 comparison pairs. The held-out detector test uses 51 pages/408 pairs. Failed renders and interaction-dependent layouts are excluded; heuristic errors and subjective design intent limit generalization to dynamic sites or every environment.", "scope_limitations_zh": "从 480 次生成中筛留 254 个静态网页，组成 2,032 个对照样本；保留测试集为 51 页、408 对。失败渲染与依赖交互的布局被排除，启发式误差及设计意图的主观性限制了对动态网站或所有环境的泛化。", "targets": [ "website" ], "title": "Does It Render Everywhere? A Study of Cross-Environment Compatibility in MLLM-Generated Webpages", "title_zh": "能否处处正确渲染？多模态模型生成网页的跨环境兼容性研究", "url": "https://arxiv.org/abs/2608.12518", "venue": "arXiv", "verification": "source-reviewed", "verified_at": "2026-10-20", "why_fits_en": "Adds cross-environment validation for reconstructed frontends beyond single-screenshot similarity.", "why_fits_zh": "为重建前端补充跨环境验证，超出单张截图相似度的范围。", "year": 2026 }, { "arxiv_id": "2506.07818", "arxiv_version_reviewed": "v1", "authors": [ "Zhiyu Lin", "Zhengda Zhou", "Zhiyuan Zhao", "Tianrui Wan", "Yilun Ma", "Junyu Gao", "Xuelong Li" ], "code_url": null, "date_basis": "ACL proceedings publication month.", "date_basis_zh": "采用 ACL 会议论文集的出版月份。", "date_precision": "month", "description_en": "Diagnoses webpage-to-code capability through visual perception, HTML programming, image-to-HTML understanding, and screenshot reconstruction tasks. It separates underlying skills using question-answer pairs derived from real websites.", "description_zh": "通过视觉感知、HTML 编程、图像与 HTML 对应理解，以及截图重建任务，诊断从网页界面生成代码的能力；利用来自真实网站的问答对，分别考察各项基础技能。", "doi": "10.18653/v1/2025.findings-acl.815", "entry_url": "https://awesomerea.org/papers/paper-webuibench/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-webuibench/", "evidence_urls": [ "https://aclanthology.org/2025.findings-acl.815/", "https://aclanthology.org/2025.findings-acl.815.pdf", "https://arxiv.org/abs/2506.07818", "https://github.com/MAIL-Tele-AI/WebUIBench", "https://huggingface.co/datasets/Tele-AI-MAIL/WebUIBench" ], "first_arxiv_date": "2025-06-09", "id": "paper-webuibench", "kind": "research", "metadata_notes": "The published ACL record supplies the bibliography; repository citation fields remain placeholders and the dataset card displays a different arXiv identifier. The author-linked repository is retained as a project link, not advertised as a runnable code release.", "metadata_notes_zh": "书目信息采用正式 ACL 记录；仓库引用字段仍是占位内容，数据集卡片显示的 arXiv 编号也不同。作者链接的仓库作为项目链接保留，不将其宣传为可运行的代码发布。", "pdf_url": "https://aclanthology.org/2025.findings-acl.815.pdf", "project_url": "https://github.com/MAIL-Tele-AI/WebUIBench", "publication_date": "2025-07", "publication_status": "conference-paper", "runtime_tested": false, "scope_limitations_en": "Primarily evaluates visual and HTML reconstruction skills. The paper includes a preliminary interaction study, not a full workflow or backend-equivalence benchmark. The official repository currently exposes README and images but not the evaluation scripts described in its instructions.", "scope_limitations_zh": "主要评估视觉与 HTML 重建技能。论文虽含初步交互研究，但并非完整流程或后端等价评测。官方仓库目前提供 README 和图片，未提供说明中提及的评估脚本。", "targets": [ "website" ], "title": "WebUIBench: A Comprehensive Benchmark for Evaluating Multimodal Large Language Models in WebUI-to-Code", "title_zh": "WebUIBench：评估多模态大语言模型从网页界面生成代码能力的综合基准", "url": "https://aclanthology.org/2025.findings-acl.815/", "venue": "Findings of ACL 2025", "verification": "source-reviewed", "verified_at": "2026-10-16", "why_fits_en": "Adds diagnostic evidence for screenshot-based website reconstruction, complementary to end-to-end Design2Code evaluation.", "why_fits_zh": "为基于截图的网站重建提供诊断性证据，与 Design2Code 的端到端评估互补。", "year": 2025 }, { "arxiv_id": "2608.12611", "arxiv_version_reviewed": "v1", "authors": [ "Houston H. Zhang", "Tao Zhang", "Li Gu", "Linfeng Ye", "Yuanhao Yu", "Xinxin Zuo", "Yang Wang", "Zhixiang Chi" ], "code_url": null, "date_basis": "The official 2026 MUCG workshop program confirms inclusion; a proceedings publication date was not verified.", "date_basis_zh": "MUCG 2026 官方研讨会日程确认收录，尚未核实正式论文集的出版日期。", "date_precision": "year", "description_en": "WidgetGen reconstructs widget screenshots as React JSX. OCR text boxes and color palettes guide whole-widget layout reasoning and optional chart generation before one terminal render; generated render/code pairs also support model fine-tuning.", "description_zh": "WidgetGen 将组件截图重建为 React JSX，利用 OCR 文本框与调色板支持整体布局推理及可选图表生成，最后渲染一次；生成的渲染图与代码配对还用于模型微调。", "doi": "10.48550/arXiv.2608.12611", "entry_url": "https://awesomerea.org/papers/paper-widgetgen/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-widgetgen/", "evidence_urls": [ "https://arxiv.org/abs/2608.12611v1", "https://arxiv.org/html/2608.12611v1", "https://mllm-mucg.github.io/ECCV2026/" ], "first_arxiv_date": "2026-08-12", "id": "paper-widgetgen", "kind": "research", "metadata_notes": "The official MUCG 2026 program lists this paper; proceedings publication was not verified, and OpenReview required browser verification. The arXiv paper is CC BY 4.0. No dedicated implementation or weight link was found in the reviewed paper/program; Widget2Code is the separate benchmark source. Nothing was executed.", "metadata_notes_zh": "MUCG 2026 官方日程列出本论文，但未核实正式论文集出版；OpenReview 页面要求浏览器验证。arXiv 论文采用 CC BY 4.0。所审论文及日程未给出专门的实现或权重链接，Widget2Code 是另行引用的基准来源。本次未执行产物。", "pdf_url": "https://arxiv.org/pdf/2608.12611v1", "project_url": null, "publication_date": null, "publication_status": "conference-accepted", "runtime_tested": false, "scope_limitations_en": "The main comparison uses six models and 1,000 test widgets from one dataset. Its nine image-based metrics do not test interaction, accessibility or maintainability. The supervision experiment covers six Qwen-family checkpoints; broader UI and model-family generalization remains open.", "scope_limitations_zh": "主要对比使用六个模型与单一数据集中的 1,000 个测试组件。九项图像指标不检验交互、无障碍或可维护性；监督学习实验仅覆盖六个 Qwen 系列模型，更多界面分布与模型系列的泛化尚未确定。", "targets": [ "app", "website" ], "title": "From Visual Widgets to UI Code: Efficient Tool-Grounded Generation", "title_zh": "从视觉组件到界面代码：借助工具证据的高效生成", "url": "https://arxiv.org/abs/2608.12611", "venue": "MUCG @ ECCV 2026", "verification": "source-reviewed", "verified_at": "2026-10-20", "why_fits_en": "Studies evidence-assisted recovery of executable interface code from compact visual references.", "why_fits_zh": "研究根据紧凑视觉参考与工具证据恢复可执行界面代码。", "year": 2026 }, { "arxiv_id": null, "arxiv_version_reviewed": null, "authors": [ "Johannes Pohl", "Andreas Noack" ], "code_url": "https://github.com/jopohl/urh", "date_basis": "The official USENIX BibTeX entry identifies August 2019 for the WOOT 19 workshop publication.", "date_basis_zh": "USENIX 官方 BibTeX 将 WOOT 19 研讨会论文的出版月份列为2019年8月。", "date_precision": "month", "description_en": "Infers message formats of proprietary wireless protocols from demodulated physical-layer captures: it aligns messages by preamble and sync word, then uses RSSI and dedicated engines to label length, address, sequence-number and checksum fields, optionally using known addresses or field positions.", "description_zh": "从解调后的物理层捕获数据推断专有无线协议的报文格式：先依据前导码和同步字对齐报文，再结合 RSSI 与专用引擎标注长度、地址、序列号和校验和字段，并可利用已知地址或字段位置等先验信息。", "doi": null, "entry_url": "https://awesomerea.org/papers/paper-wireless-protocol-re/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-wireless-protocol-re/", "evidence_urls": [ "https://www.usenix.org/conference/woot19/presentation/pohl", "https://www.usenix.org/system/files/woot19-paper_pohl.pdf", "https://www.usenix.org/biblio/export/bibtex/238586", "https://github.com/jopohl/urh/blob/1403d92987cc3d01d41aff64250955ce455dabd2/README.md", "https://github.com/jopohl/urh/blob/1403d92987cc3d01d41aff64250955ce455dabd2/LICENSE", "https://github.com/jopohl/urh/tree/1403d92987cc3d01d41aff64250955ce455dabd2/src/urh/awre", "https://github.com/jopohl/urh/releases/tag/v2.10.0" ], "first_arxiv_date": null, "id": "paper-wireless-protocol-re", "kind": "research", "metadata_notes": "The official USENIX page, its BibTeX entry and the final PDF verify this workshop paper; no DOI or arXiv identifier was verified. The final PDF uses the WOOT 19 underscore path, and the conference/woot19 form returns 404. The PDF carries an Artifact Evaluated 'Passed' badge. The paper names Universal Radio Hacker as its implementation, and the URH README links its automatic field inference to this paper. At the pinned commit the GPL-3.0 repository is archived, its inference code is in src/urh/awre, and the latest release is v2.10.0. URH's WOOT 18 tool paper is a separate publication.", "metadata_notes_zh": "USENIX 官方页面、其中的 BibTeX 条目和正式 PDF 确认了这篇研讨会论文；尚未核实 DOI 或 arXiv 标识。正式 PDF 采用 WOOT 19 的下划线路径，conference/woot19 形式的地址返回 404。PDF 带有 Artifact Evaluated “Passed”（工件评估通过）标志。论文指明其实现位于 Universal Radio Hacker 中，URH README 也将自动字段推断功能链接到本文。固定提交中该 GPL-3.0 仓库已归档，推断代码位于 src/urh/awre，最新发行版为 v2.10.0。URH 自身的 WOOT 18 工具论文是另一篇独立发表的论文。", "pdf_url": "https://www.usenix.org/system/files/woot19-paper_pohl.pdf", "project_url": null, "publication_date": "2019-08", "publication_status": "conference-paper", "runtime_tested": false, "scope_limitations_en": "Only message formats are inferred: preamble, sync, length, address, sequence number and checksum. State-machine inference and payload fields, such as an on/off bit, are out of scope. The method assumes length-efficient binary messages with one preamble and sync word each. Accuracy is measured on 8 generated protocols; 3 real smart-home captures (EnOcean, Homematic BidCoS and an eQ-3 protocol used by RWE Smarthome) serve for performance tests, which the authors call a limited test set.", "scope_limitations_zh": "仅推断报文格式，即前导码、同步字、长度、地址、序列号和校验和；协议状态机推断以及开关位等载荷字段不在研究范围内。方法假设报文为紧凑的二进制格式，且每条报文只有一个前导码和同步字。准确率在 8 个生成协议上评测；3 份真实智能家居捕获（EnOcean、Homematic BidCoS 及 RWE Smarthome 使用的 eQ-3 协议）用于性能测试，作者也承认这是有限的测试集。", "targets": [ "protocol" ], "title": "Automatic Wireless Protocol Reverse Engineering", "title_zh": "无线协议自动逆向工程", "url": "https://www.usenix.org/conference/woot19/presentation/pohl", "venue": "13th USENIX Workshop on Offensive Technologies (WOOT 19)", "verification": "source-reviewed", "verified_at": "2026-10-17", "why_fits_en": "Extends protocol inference from network-message traces to physical-layer wireless captures, with the field-labeling method implemented in a public analysis tool.", "why_fits_zh": "将协议推断从网络报文轨迹扩展到物理层无线捕获数据，其字段标注方法已集成到公开的分析工具中。", "year": 2019 }, { "arxiv_id": "2402.12275", "arxiv_version_reviewed": null, "authors": [ "Hao Tang", "Darren Key", "Kevin Ellis" ], "citation": { "container_title": "Advances in Neural Information Processing Systems", "pages": "70148-70212", "sources": [ "https://papers.nips.cc/paper_files/paper/2024/hash/820c61a0cd419163ccbd2c33b268816e-Abstract-Conference.html", "https://api.crossref.org/works/10.52202/079017-2243" ], "volume": "37" }, "code_url": "https://github.com/haotang1995/WorldCoder", "date_basis": "The NeurIPS proceedings and publisher-deposited Crossref record identify 2024; no publication month or day is asserted.", "date_basis_zh": "NeurIPS 论文集及出版方提交的 Crossref 记录给出 2024 年；不推定出版月份或日期。", "date_precision": "year", "description_en": "WorldCoder learns executable Python transition and reward models from environment interactions and natural-language goals. It refines code against recorded experiences and an optimistic planning constraint, studying transfer and task solving in Sokoban, MiniGrid and ALFWorld.", "description_zh": "WorldCoder 根据环境交互和自然语言目标学习可执行的 Python 状态转移与奖励模型，利用已记录经验和乐观规划约束修正代码，并在 Sokoban、MiniGrid 与 ALFWorld 中研究迁移和任务求解。", "doi": "10.52202/079017-2243", "entry_url": "https://awesomerea.org/papers/paper-worldcoder/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-worldcoder/", "evidence_urls": [ "https://papers.nips.cc/paper_files/paper/2024/hash/820c61a0cd419163ccbd2c33b268816e-Abstract-Conference.html", "https://papers.neurips.cc/paper_files/paper/2024/file/820c61a0cd419163ccbd2c33b268816e-Paper-Conference.pdf", "https://api.crossref.org/works/10.52202/079017-2243", "https://arxiv.org/abs/2402.12275", "https://haotang1995.github.io/projects/worldcoder", "https://github.com/haotang1995/WorldCoder/blob/9d9fc8d55b7537e2cc1e667a13185a0f2c9d9404/README.md", "https://github.com/haotang1995/WorldCoder/blob/9d9fc8d55b7537e2cc1e667a13185a0f2c9d9404/LICENSE", "https://github.com/haotang1995/WorldCoder/blob/9d9fc8d55b7537e2cc1e667a13185a0f2c9d9404/requirements.txt", "https://github.com/haotang1995/WorldCoder/blob/9d9fc8d55b7537e2cc1e667a13185a0f2c9d9404/worldcoder/envs/__init__.py", "https://github.com/haotang1995/WorldCoder/blob/9d9fc8d55b7537e2cc1e667a13185a0f2c9d9404/worldcoder/agent/synthesizer/evaluator.py" ], "first_arxiv_date": "2024-02-19", "id": "paper-worldcoder", "kind": "research", "metadata_notes": "Reviewed the final NeurIPS paper, pages 70148–70212. The MIT author repository is a partial experiment artifact: its pinned environment registry exposes MiniGrid only, despite the README’s Sokoban example and broader paper experiments. The README warns about NumPy 2 incompatibility and older Gymnasium/MiniGrid dependencies. No installation or model calls were performed.", "metadata_notes_zh": "核查的是正式 NeurIPS 论文，页码 70148–70212。作者仓库采用 MIT，但仅提供部分实验产物：固定版本的环境注册表只暴露 MiniGrid，尽管 README 给出 Sokoban 示例、论文也评估了更多环境。README 提醒 NumPy 2 不兼容及较旧的 Gymnasium/MiniGrid 依赖问题。本次未安装或调用模型。", "pdf_url": "https://papers.neurips.cc/paper_files/paper/2024/file/820c61a0cd419163ccbd2c33b268816e-Paper-Conference.pdf", "project_url": "https://haotang1995.github.io/projects/worldcoder", "publication_date": null, "publication_status": "conference-paper", "runtime_tested": false, "scope_limitations_en": "Assumes deterministic dynamics and symbolic, discrete states rather than recovering a game from arbitrary pixels or binaries. Consistency with observed transitions and successful planning do not establish complete engine equivalence or correctness on every unseen state. Evaluation concerns bounded environment models and planning, not original source or asset recovery.", "scope_limitations_zh": "假设环境动态具有确定性，状态为符号化的离散表示，并非从任意像素或二进制恢复游戏。与已观察转移一致及规划成功，不能证明完整引擎等价或所有未见状态上的正确性。评估针对有限范围的环境模型与规划，不涉及恢复原始源码或资产。", "targets": [ "game" ], "title": "WorldCoder, a Model-Based LLM Agent: Building World Models by Writing Code and Interacting with the Environment", "title_zh": "WorldCoder：通过编写代码并与环境交互构建世界模型的基于模型的语言智能体", "url": "https://papers.nips.cc/paper_files/paper/2024/hash/820c61a0cd419163ccbd2c33b268816e-Abstract-Conference.html", "venue": "NeurIPS 2024", "verification": "source-reviewed", "verified_at": "2026-10-17", "why_fits_en": "A foundation for agent-assisted reconstruction of observed game behavior as executable code, with explicit consistency checks instead of a visual-only similarity claim.", "why_fits_zh": "这是将已观察游戏行为重建为可执行代码的智能体辅助基础研究，采用明确的一致性检查，而非仅以视觉相似度作为依据。", "year": 2024 }, { "arxiv_id": "2107.13404", "arxiv_version_reviewed": "v4", "authors": [ "James Patrick-Evans", "Moritz Dannehl", "Johannes Kinder" ], "citation": { "container_title": "2023 IEEE Symposium on Security and Privacy (SP)", "pages": "2375-2390", "publisher": "IEEE", "sources": [ "https://ieeexplore.ieee.org/document/10179439", "https://api.crossref.org/works/10.1109/SP46215.2023.10179439" ] }, "code_url": "https://github.com/lmu-plai/xfl", "date_basis": "IEEE Xplore and the publisher’s Crossref deposit both record publication in May 2023; IEEE added the article to Xplore on 21 July 2023. No publication day is asserted.", "date_basis_zh": "IEEE Xplore 与出版方提交的 Crossref 元数据均记录出版时间为 2023 年 5 月；IEEE 于 2023 年 7 月 21 日将文章加入 Xplore。本条目不认定具体出版日。", "date_precision": "month", "description_en": "XFL treats function naming in stripped binaries as extreme multi-label classification: names are split into tokens, and PfastreXML ranks which tokens from a vocabulary of frequent labels fit each function. Its DEXTER embedding combines static-analysis features built on angr’s VEX IR with call-graph and whole-binary context, and a separate language model orders predicted tokens into a name string. On 741,724 functions from 10,047 x86-64 C binaries in Debian packages, with a 1,024-label vocabulary, the authors report precision 0.835, recall 0.575 and F1 0.681, ahead of Punstrip, Debin and Nero in precision and F1.", "description_zh": "XFL 将去符号二进制中的函数命名视为极端多标签分类：函数名被拆分为词元，再由 PfastreXML 从常见标签词表中为每个函数排序合适的词元。其 DEXTER 嵌入结合基于 angr VEX 中间表示的静态分析特征、调用图上下文和整个二进制的全局上下文，另有一个语言模型把预测的词元排列成函数名字符串。在来自 Debian 软件包、共 10,047 个 x86-64 C 二进制中的 741,724 个函数上，以 1,024 个标签的词表，作者报告精确率 0.835、召回率 0.575、F1 0.681，在精确率和 F1 上领先 Punstrip、Debin 与 Nero。", "doi": "10.1109/SP46215.2023.10179439", "entry_url": "https://awesomerea.org/papers/paper-xfl/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-xfl/", "evidence_urls": [ "https://ieeexplore.ieee.org/document/10179439", "https://api.crossref.org/works/10.1109/SP46215.2023.10179439", "https://arxiv.org/abs/2107.13404", "https://arxiv.org/pdf/2107.13404v4", "https://github.com/lmu-plai/xfl/blob/5ad25691972158d4f559c401a7462f82fc5412a0/README.md", "https://github.com/lmu-plai/xfl/blob/5ad25691972158d4f559c401a7462f82fc5412a0/COPYING", "https://github.com/lmu-plai/xfl/blob/5ad25691972158d4f559c401a7462f82fc5412a0/xfl-r/README.md", "https://github.com/lmu-plai/xfl/blob/5ad25691972158d4f559c401a7462f82fc5412a0/xfl-r/INSTALL.md", "https://github.com/lmu-plai/xfl/blob/5ad25691972158d4f559c401a7462f82fc5412a0/xfl/evaluation/README.md", "https://zenodo.org/records/10733597" ], "first_arxiv_date": "2021-07-28", "id": "paper-xfl", "kind": "research", "metadata_notes": "IEEE Xplore and Crossref agree on the title, three-author order, DOI, pages 2375–2390 and the May 2023 date. Reviewed arXiv v4 (2022-12-12; v1 2021-07-28), whose title and authors match; it was not compared page by page with the IEEE version. The paper’s code link github.com/unibw-patch/xfl now redirects to lmu-plai/xfl. The reviewed 2025-11-30 snapshot carries GPL-3.0 in COPYING. Its README describes xfl/ as partial original source with experiment data and logs and recommends the refactored xfl-r/ for comparisons; lm/ holds the name-generation language model. The README’s BibTeX lists pages 1677–1692 and DOI 10.1109/SP46215.2023.00096, which doi.org does not resolve, so this record uses the registered DOI. XFL-R setup requires Python 3.8, TensorFlow 2.13.1, PostgreSQL 13, radare2 5.5.4 and Ghidra 10.4, a PfastreXML build compiled from source downloaded separately, and a 46.9 GB Zenodo archive of models and tables (10.5281/zenodo.10733597) whose metadata names no license; pretrained DEXTER embeddings are linked from a separate download host. The paper reports about 850 GB of RAM for DEXTER training. Nothing was run or downloaded.", "metadata_notes_zh": "IEEE Xplore 与 Crossref 的标题、三位作者顺序、DOI、页码 2375–2390 及 2023 年 5 月日期一致。审阅 arXiv v4（2022-12-12；v1 为 2021-07-28），其标题与作者一致；未与 IEEE 版本逐页比对。论文中的代码链接 github.com/unibw-patch/xfl 现重定向至 lmu-plai/xfl。所审阅的 2025-11-30 快照在 COPYING 中采用 GPL-3.0。其 README 说明 xfl/ 是包含实验数据和日志的部分原始源码，并建议使用重构后的 xfl-r/ 进行比较；lm/ 包含生成函数名的语言模型。README 中的 BibTeX 列出页码 1677–1692 及 DOI 10.1109/SP46215.2023.00096，但 doi.org 无法解析该 DOI，因此本条目使用已注册的 DOI。XFL-R 的安装需要 Python 3.8、TensorFlow 2.13.1、PostgreSQL 13、radare2 5.5.4 与 Ghidra 10.4，需要从另行下载的源码编译 PfastreXML，还需要一个 46.9 GB 的 Zenodo 模型与数据表压缩包（10.5281/zenodo.10733597），其元数据未注明许可证；预训练 DEXTER 嵌入链接至另一个下载站点。论文报告训练 DEXTER 约需 850 GB 内存。本次未运行或下载任何内容。", "pdf_url": "https://arxiv.org/pdf/2107.13404v4", "project_url": null, "publication_date": "2023-05", "publication_status": "conference-paper", "runtime_tested": false, "scope_limitations_en": "Predictions are token labels from a fixed vocabulary, ranked and optionally assembled into names; they are not recovered source names, and scoring matches tokens rather than exact names. Evaluation uses x86-64 ELF C binaries from Debian packages, built with mixed compilers and optimization settings, plus Nero’s smaller dataset; the trained model is specific to x86-64 GNU/Linux binaries. All tools receive function boundaries from symbol tables at test time, so boundary-detection errors are excluded. Many test names also occur in training; restricted to names never seen in training, F1 falls to 0.242. Obfuscated and adversarial binaries are out of scope. Debin and Dire figures on the Nero dataset are copied from the Nero paper rather than rerun.", "scope_limitations_zh": "预测结果是固定词表中的词元标签，经排序后可选地组合成名称；它们并非恢复的源码名称，评分也按词元而非完整名称匹配。评测使用来自 Debian 软件包、以多种编译器与优化设置构建的 x86-64 ELF C 二进制，以及规模较小的 Nero 数据集；训练所得模型仅适用于 x86-64 GNU/Linux 二进制。测试时所有工具均从符号表获取函数边界，因此不计入边界检测错误。许多测试函数名也出现在训练集中；仅考察训练中从未出现的名称时，F1 降至 0.242。混淆和对抗性二进制不在研究范围内。Nero 数据集上 Debin 与 Dire 的数据取自 Nero 论文，并未重新运行。", "targets": [ "binary" ], "title": "XFL: Naming Functions in Binaries with Extreme Multi-label Learning", "title_zh": "XFL：基于极端多标签学习的二进制函数命名", "url": "https://ieeexplore.ieee.org/document/10179439", "venue": "IEEE S&P 2023", "verification": "source-reviewed", "verified_at": "2026-10-18", "why_fits_en": "Adds function-name prediction for stripped binaries framed as multi-label learning over binary embeddings, complementing variable-name, type and data-structure recovery research.", "why_fits_zh": "补充以二进制嵌入上的多标签学习预测去符号二进制函数名的方法，与变量名、类型及数据结构恢复研究互补。", "year": 2023 } ]