2024 · Conference paper
A Taxonomy of C Decompiler Fidelity Issues
Open-codes decompiled/original C function pairs to classify how decompiler output departs from the source beyond missing names and types. Using a statement-alignment abstraction and thematic analysis, the authors build a hierarchical codebook of 15 top-level categories and 52 codes, covering correctness issues such as nonequivalent expressions and incorrect return behavior and readability issues such as extraneous variables, non-idiomatic control flow and decompiler-specific macros. The codebook, developed on Hex-Rays output, is applied to Ghidra, retdec and angr, and the authors suggest type prediction, rule-based fixes and whole-program learned techniques to address classes of defects.
Scope and limitations
A qualitative taxonomy, not a benchmark score or decompiler ranking. Coding centres on a random sample of 200 Hex-Rays decompiled/original pairs from the small-function set plus ten large functions; the authors report 235 coded pairs in total. Ghidra, retdec and angr were compared with Hex-Rays only on a 25-function subsample. Inputs are Hex-Rays decompilations of GHCC builds of majority-C GitHub repositories, biased toward projects with recognizable, working build scripts and filtered by a step that also removed some valid functions; the dataset contains no obfuscated binaries and is unlikely to include malware. Missing variable names and types were deliberately not labeled. The Java check applies the codebook to 25 Defects4J functions decompiled with JD-GUI as a side study. The issues’ effect on reverse-engineer productivity is left to future work.
Why it fits this collection
Adds an empirical taxonomy of what decompiled C gets wrong, complementing decompiler benchmarks with automated scores and LLM repair methods such as FidelityGPT.
Publication and review details
- Venue
- USENIX Security 2024
- Status
- Conference paper
- Publication / posting date
- August 2024
- Date source
- Publication month from the official USENIX BibTeX (month = aug) and the final PDF cover for the 33rd USENIX Security Symposium, August 14–16, 2024; no exact publication day is asserted.
No paper DOI or arXiv identifier was verified; the record uses the reviewed USENIX Security 2024 presentation-page and usenixsecurity24-dramko.pdf profile. The USENIX BibTeX gives the 33rd USENIX Security Symposium, pages 379–396, USENIX Association and month August; the presentation page also links a prepublication PDF. The paper’s Availability section points to Zenodo DOI 10.5281/zenodo.8419614, a CC BY 4.0 dataset record dated 2023-11-07 by the same five creators with codebook.pdf and dataset.zip; that DOI identifies the coded examples and codebook, not this paper, so it is recorded here rather than as the paper DOI or a code link. The paper versions only JD-GUI (1.6.6) and names no Hex-Rays, Ghidra, retdec or angr versions. Intercoder agreement is reported as Cohen’s kappa and is weaker for rare issues. The Zenodo files were not downloaded, and no decompilers were run.
Sources reviewed
Source review only; experiments were not rerun for this collection. Cite the original authors using the linked paper or BibTeX.