Echo improves source code recovery from optimized binaries with trusted feedback
Echo: Learning-based Matching Decompilation using Trusted Back Translation
Cryptography and SecurityArtificial Intelligence
Summary
Turning machine code back into human-readable source code is very hard, especially when the code is optimized or compiled in unknown ways. The authors introduce Echo, a system that not only guesses possible source codes but also checks them by compiling back and comparing to the original machine code. Echo uses this feedback to fix differences step-by-step, making the recovered source code more accurate and trustworthy. Tests show Echo performs better than previous systems, matching more functions exactly and producing source code closer to the original.
What this means in practice
- •For software reverse engineers: Recover accurate source code from optimized binaries to understand and analyze unknown software safely.
- •For malware analysis teams: Match compiled malware functions accurately to their source, improving malware understanding and detection.
Authors
Jun Bi, Xiangxin Fang, Aarsh Chaube, José Wesley De Souza Magalhães, Rodrigo C. O. Rocha, Michael O'Boyle
Abstract
Neural decompilers can recover readable and recompilable source code from binaries, but their predictions remain difficult to trust. Matching decompilation addresses this problem by searching for source code whose recompiled assembly exactly matches the target, providing stronger evidence of correctness. However, exact matching remains challenging for optimized binaries under unknown compilation configurations. We present Echo, a matching decompilation system based on trusted back-translation. Our key insight is to use compilation not only for verification, but also as trusted feedback to guide iterative search. Echo first uses a domain-specific model to generate candidate programs and compilation configurations. It recompiles these candidates, measures assembly-level similarity, and synthesizes promising code-configuration pairs. Remaining mismatches are then progressively repaired using rule-based rewriting, neural refinement, and reasoning-based refinement. We evaluate Echo on function-level benchmarks and the Mirai malware binary. Compared with the strongest baseline, Echo produces 2.43x more exact matches on average and achieves the highest structural similarity to ground-truth source code. On Mirai, Echo matches 2.75x and 7.4x as many functions as GPT-5.6 and Codex, respectively.