2022 · Conference paper
Decomperson: How Humans Decompile and What We Can Learn From It
Reframes manual reverse engineering as perfect decompilation: writing source that, compiled with the original toolchain and options, reproduces the target functions’ binary code exactly. The authors built Decomperson, a web editor that compiles, disassembles, tests and diffs each submission, and used it in Decompetition, a 24-hour Jeopardy-style competition in November 2020 with 23 unstripped challenge binaries written in C, C++, Go, Rust and Swift. Over 150 participants made more than 35,000 submissions, including over 300 perfect ones; all but one challenge was perfectly decompiled, and the recorded edit histories are analyzed to describe how humans decompile.
Scope and limitations
Participants were self-selected competitors in a single 2020 event, mostly playing solo on teams of any size, and the follow-up survey drew only 12% of registrants. The challenges are 23 small competition binaries written by the organizers, not stripped and without debug information, and Decomperson assumed the original toolchain and compilation options were known. Perfect decompilation requires matching compiler output; the authors note that it is not a traditional reverse-engineering task, does not capture skills such as triaging large binaries, and can include time spent fighting compiler idiosyncrasies. The web editor took players out of their usual tools and may have influenced timings. Participants could paste automatic-decompiler output; about 20% of C function attempts resembled tool output, mostly Hex-Rays, Ghidra or Binary Ninja. The study observes humans and does not evaluate automated decompilers or agents.
Why it fits this collection
Adds a large, programmatically analyzable record of human decompilation, complementing studies that compare human reverse engineers with LLMs and agents.
Publication and review details
- Venue
- USENIX Security 2022
- Status
- Conference paper
- Publication / posting date
- August 2022
- Date source
- Publication month from the official USENIX BibTeX (month = aug) and the final PDF cover for the 31st USENIX Security Symposium, August 10–12, 2022; no exact publication day is asserted.
No paper DOI or arXiv identifier was verified; the record uses the reviewed USENIX Security presentation-page and sec22-burk.pdf profile. The USENIX BibTeX gives the 31st USENIX Security Symposium, pages 2765–2782, USENIX Association and month August. The paper states IRB exemption under Category 3 and that no personally identifiable information was used. Its Artifacts section links the challenges-2020, server, disassembler and data repositories and a Docker Hub builder image; the image was not checked. The code link uses the Decomperson server, reviewed at commit 0d381d4 (2026-04-13), which carries an Apache-2.0 license whose copyright line was filled in that day; the challenges and disassembler repositories first received Apache-2.0 license files the same day. The anonymized submission data, decompetition/data at 4b339e5 (2022-06-02), is a PostgreSQL dump from a 2020-12-10 snapshot with a Docker-based serve.sh, and that repository declares no license, so no redistribution rights are implied. No data was downloaded and no code was run.
Sources reviewed
Source review only; experiments were not rerun for this collection. Cite the original authors using the linked paper or BibTeX.
Primary sources
- https://www.usenix.org/conference/usenixsecurity22/presentation/burk
- https://www.usenix.org/system/files/sec22-burk.pdf
- README.md GitHub · decompetition/server · Revision 0d381d4
- LICENSE.txt GitHub · decompetition/server · Revision 0d381d4
- README.md GitHub · decompetition/data · Revision 4b339e5