Practical Source Code Recovery from Binary Functions Using Anchor-Based Retrieval and LLM Reasoning
2026-07-10 • Software Engineering
Software EngineeringArtificial Intelligence
AI summaryⓘ
The authors created a method to find original source code from stripped binary functions by combining reverse engineering and a special search using large language models (LLMs). Instead of guessing code, their method tries to match parts of the binary to real source code files using clues like strings and function names. They tested this on a well-prepared database and got very good results, covering most of the assembly instructions. However, when testing on a messier, GitHub-based database, the method didn't work as well, showing it depends on having high-quality source code databases.
reverse engineeringbinary functionssource code retrievaldecompiled codelarge language modelsGhidraassembly instructionsinverted-index searchtcpdump binary
Authors
Charles Edward Gagnon, Steven H. H. Ding, Philippe Charland, Benjamin C. M. Fung
Abstract
We present a practical pipeline for recovering source code from stripped binary functions by combining reverse engineering, anchor-based source code retrieval, and large language model reasoning. Our binary-to-source-code retrieval method attempts to identify the source function from a source code database, rather than generating approximate decompiled pseudocode. It extracts anchors such as strings, constants, external calls, and available function names using Ghidra, retrieves candidate files via an inverted-index search database, narrows candidates to likely function snippets, and re-ranks them with a large language model (LLM) based on disassembly, decompiled code, and source metadata. Confident matches can also serve as anchors in later passes. In an evaluation backed by our high-fidelity source code database on a stripped, optimized tcpdump binary, our proposed binary-to-source matching method achieves 95.2% assembly instruction coverage. Experiments on a GitHub-based retrieval database showed lower performance with 35.5% instruction coverage on average, mainly due to retrieval misses. These results show that source-level binary recovery excels with high-quality databases and remains a useful tool in noisy environments.