AwesomeREA.org

2026 · Conference paper

Lifting Optimized Binaries to Canonical Compiler IR via Structure-Aware Retrieval and Iterative Verification

Xiaoao Zhu; Jie Ren; Zhiqiang Li; Jie Zheng; Zhanyong Tang; Zheng Wang

BRIDGE lifts stripped, optimized x86-64 and ARM64 functions, given as llvm-objdump disassembly, to LLVM IR. Its target is the unoptimized IR that a fixed clang -O0 configuration emits for the original source. Offline, it builds a retrieval database from 69,253 ExeBench functions compiled at -O0 to -O3, using LLVM pseudo-probe instrumentation to align assembly fragments with the matching -O0 IR regions. At inference it splits each function's angr-recovered control-flow graph into control-flow segments such as loops and if–else regions, retrieves the three nearest aligned assembly–IR pairs per segment from a FAISS index of Nova-1.3B embeddings, and prompts a hosted general-purpose LLM (DeepSeek-chat) to write the IR. Up to five refinement rounds then feed LLVM verifier and compiler diagnostics and unit-test failures back to the model. On HumanEval-Decompile and MBPP compiled with Clang 19 at -O0 to -O3, average re-executability is 65.2% and 65.4% on x86-64 and 45.6% and 42.1% on ARM64. The rule-based MCTOLL reaches 62.1% and 64.9% on x86-64, and the five directly prompted API LLMs reach at most 21.5%.

Scope and limitations

Evaluation is function-level on short benchmark programs: HumanEval-Decompile and an MBPP subset, with inputs of 2 to 628 assembly instructions, built by the authors with one LLVM/Clang 19 toolchain on Linux. Canonical means matching one fixed clang -O0 configuration, not recovering the original source. Refinement and the re-executability metric both use the unit tests these benchmarks supply; the authors note that such test oracles are rarely available in practical reverse engineering. On x86-64 HumanEval-Decompile, re-executability falls from 65.2% to 60.8% with LLM-generated tests and to 53.5% with no tests. Output still diverges structurally from the reference: average edit similarity stays below 50%, and exact control-flow-graph matches reach 25.9% on that benchmark. The pipeline calls a hosted LLM API, as do the LLM baselines; results are geometric means of five runs and can shift as hosted models change. Forklift and LLM Compiler FTD are excluded from the baselines because the authors treat them as lifting compiler-emitted assembly text, and MCTOLL is compared only on x86-64. Other instruction sets need a rebuilt retrieval database. BRIDGE produces LLVM IR, not C source, so it is not a decompiler to C. The code repository has no license.

Why it fits this collection

Adds retrieval-guided LLM lifting of optimized machine code to compiler IR with verifier and test feedback, complementing rule-based lifters such as rev.ng and the assembly-to-C neural decompilation papers in this section.

Publication and review details

Venue
ACL 2026
Status
Conference paper
Publication / posting date
July 2026
Date source
The official ACL Anthology citation and BibTeX give July 2026. Crossref records only the year; the July 2–7 conference dates printed in the PDF are not treated as a publication day.
DOI
10.18653/v1/2026.acl-long.527

The ACL Anthology page and BibTeX give the Proceedings of the 64th Annual Meeting of the ACL (Volume 1: Long Papers), pages 11498–11516, San Diego, published by the ACL, and the same six authors in order; the Crossref DOI record matches the title, authors and pages and gives only the year. No arXiv version was found by arXiv title and keyword searches, so arxiv_id is null. In §6.1 the text gives 42.1% average re-executability for ARM64 HumanEval-Decompile, while Table 1 lists 45.6% for that benchmark and 42.1% for ARM64 MBPP; this record follows the table. The PDF's online-materials note links Azhu-c/BRIDGE-rag. At the reviewed 2026-07-06 commit the repository has no LICENSE file and GitHub reports no license. Its README recommends Python 3.10 and requires a DeepSeek API key, and the LLM wrapper defaults to the deepseek-chat model through an OpenAI-compatible client. requirements.txt pins openai 1.57.0, angr 9.2.162, torch 2.5.1 and faiss-gpu 1.7.2. The knowledge-base configuration expects ExeBench samples under ./data/exebench_samples and a local Nova-1.3b model path; neither is in the repository. Evaluation_datasets holds HumanEval-Decompile and MBPP-subset inputs for both instruction sets with BRIDGE and baseline outputs, and docs/ holds a copy of the paper. Nothing was downloaded beyond the paper, and no code or experiments were run.

Sources reviewed

Source review only; experiments were not rerun for this collection. Cite the original authors using the linked paper or BibTeX.

Report an outdated entry Suggest a translation fix

Primary sources

  1. https://aclanthology.org/2026.acl-long.527/
  2. https://aclanthology.org/2026.acl-long.527.bib
  3. https://aclanthology.org/2026.acl-long.527.pdf
  4. https://api.crossref.org/works/10.18653/v1/2026.acl-long.527
  5. https://github.com/Azhu-c/BRIDGE-rag/tree/9add8abe0f15748cfae36395b07c6fc4e4ecc386
  6. README.md GitHub · Azhu-c/BRIDGE-rag · Revision 9add8ab
  7. requirements.txt GitHub · Azhu-c/BRIDGE-rag · Revision 9add8ab
  8. default.env.example GitHub · Azhu-c/BRIDGE-rag · Revision 9add8ab
  9. configs/knowledge_base.yaml GitHub · Azhu-c/BRIDGE-rag · Revision 9add8ab
  10. src/llm/llm_api.py GitHub · Azhu-c/BRIDGE-rag · Revision 9add8ab
  11. Evaluation_datasets GitHub · Azhu-c/BRIDGE-rag · Revision 9add8ab