Papers for

malware analysis teams

Papers whose findings have a practical use for this group, as judged from the abstract. Open a paper to read what it means in practice.

Echo improves source code recovery from optimized binaries with trusted feedback

Echo: Learning-based Matching Decompilation using Trusted Back Translation

Abstract: Neural decompilers can recover readable and recompilable source code from binaries, but their predictions remain difficult to trust. Matching decompilation addresses this problem by searching for source code whose recompiled assembly exactly matches the target, providing stronger evidence of correctness. However, exact matching remains challenging for optimized binaries under unknown compilation configurations. We present Echo, a matching decompilation system based on trusted back-translation. Our key insight is to use compilation not only for verification, but also as trusted feedback to guide iterative search. Echo first uses a domain-specific model to generate candidate programs and compilation configurations. It recompiles these candidates, measures assembly-level similarity, and synthesizes promising code-configuration pairs. Remaining mismatches are then progressively repaired using rule-based rewriting, neural refinement, and reasoning-based refinement. We evaluate Echo on function-level benchmarks and the Mirai malware binary. Compared with the strongest baseline, Echo produces 2.43x more exact matches on average and achieves the highest structural similarity to ground-truth source code. On Mirai, Echo matches 2.75x and 7.4x as many functions as GPT-5.6 and Codex, respectively.

Wed 16 SeptCryptography and SecurityArtificial Intelligence
The gist
Turning machine code back into human-readable source code is very hard, especially when the code is optimized or compiled in unknown ways. The authors introduce Echo, a system that not only guesses possible source codes but also checks them by compiling back and comparing to the original machine code. Echo uses this feedback to fix differences step-by-step, making the recovered source code more accurate and trustworthy. Tests show Echo performs better than previous systems, matching more functions exactly and producing source code closer to the original.
Open → 2609.18706v1