2019

DIRE: A Neural Approach to Decompiled Identifier Naming

Lacomis, Jeremy, Yin, Pengcheng, Schwartz, Edward J. et al.

Understand

The decompiler is one of the most common tools for examining binaries without corresponding source code.

It transforms binaries into high-level code, reversing the compilation process.
Decompilers can reconstruct much of the information that is lost during the compilation process (e.g., structure and type information).
Unfortunately, they do not reconstruct semantically meaningful variable names, which are known to increase code understandability.

Built on

D. E. Rumelhart, G. E. Hinton, R. J. Williams et al. , “Learning representations by back-propagating errors,” Cognitive Modeling , vol. 5, no. 3, p. 1, 1988
1988
Earlier work this paper cites.
E. M. Gellenbeck and C. R. Cook, “An investigation of procedure and variable names as beacons during program comprehension,” Oregon State University, Tech. Rep., 1991
1991
Earlier work this paper cites.
W. H. Press, S. A. Teukolsky, W. T. Vetterling, and B. P. Flannery, Numerical Recipes in C: The Art of Scientific Computing , 2nd ed. Cambridge University Press, 1992, ch. 20.2 Gray Codes, p. 896
Original
1992
Earlier work this paper cites.
S. Hochreiter and J. Schmidhuber, “Long short-term memory,” Neural Computation , vol. 9, no. 8, pp. 1735–1780, 1997
1997
Earlier work this paper cites.
D. Lawrie, C. Morrell, H. Feild, and D. Binkley, “What’s in a name? A study of identifiers,” in International Conference on Program Comprehension , ser. ICPC ’06, 2006, pp. 3–12
2006
Earlier work this paper cites.
M. J. van Emmerik, “Static single assignment for decompilation,” Ph.D. dissertation, University of Queensland, 2007
2007
Earlier work this paper cites.
B. Stone-Gross, M. Cova, L. Cavallaro, B. Gilbert, M. Szydlowski, R. Kemmerer, C. Kruegel, and G. Vigna, “Your botnet is my botnet: Analysis of a botnet takeover,” in ACM Conference on Computer and Communications Security , ser. CCS ’09, November 2009
2009
Earlier work this paper cites.
P. Koehn, Statistical machine translation . Cambridge University Press, 2009
2009
Earlier work this paper cites.
F. Scarselli, M. Gori, A. C. Tsoi, M. Hagenbuchner, and G. Monfardini, “The graph neural network model,” IEEE Transactions on Neural Networks , vol. 20, no. 1, pp. 61–80, 2009
2009
Earlier work this paper cites.
A. Hindle, E. T. Barr, Z. Su, M. Gabel, and P. Devanbu, “On the naturalness of software,” in Proc. International Conference on Software Engineering (ICSE) . IEEE, 2012, pp. 837–847
2012
Earlier work this paper cites.
M. J. Eager, “Introduction to the DWARF debugging format,” April 2012. [Online]. Available: http://www.dwarfstd.org/doc/Debugging%20using%20DWARF-2012.pdf
2012
Earlier work this paper cites.
L. Durfina, J. Kroustek, and P. Zemek, “PsybOt malware: A step-by-step decompilation case study,” in Working Conference on Reverse Engineering , ser. WCRE ’13, 2013, pp. 449–456
2013
Earlier work this paper cites.
E. J. Schwartz, J. Lee, M. Woo, and D. Brumley, “Native x86 decompilation using semantics-preserving structural analysis and iterative control-flow structuring,” in USENIX Security Symposium , ser. USENIXSEC ’13, 2013, pp. 353–368
2013
Earlier work this paper cites.
C. Rossow, D. Andriesse, T. Werner, B. Stone-Gross, D. Plohmann, C. J. Dietrich, and H. Bos, “SoK: P2PWNED — Modeling and evaluating the resilience of peer-to-peer botnets,” in Symposium on Security and Privacy , ser. SOSP ’13, 2013, pp. 97–111
2013
Earlier work this paper cites.
“Uroburos: Highly complex espionage software with Russian roots,” G Data SecurityLabs, Tech. Rep., 2014
2014
Earlier work this paper cites.

Similar

M. Allamanis, E. T. Barr, C. Bird, and C. Sutton, “Learning natural coding conventions,” in Symposium on the Foundations of Software Engineering , ser. FSE ’14, 2014, pp. 281–293
2014
Cited alongside, same era.
K. Cho, B. van Merriënboer, C. Gulcehre, D. Bahdanau, F. Bougares, H. Schwenk, and Y. Bengio, “Learning phrase representations using RNN encoder-decoder for statistical machine translation,” in Conference on Empirical Methods in Natural Language Processing , ser. EMNLP ’14, 2014
2014
Cited alongside, same era.
K. Yakdan, S. Eschweiler, E. Gerhards-Padilla, and M. Smith, “No more gotos: Decompilation using pattern-independent control-flow structuring and semantics-preserving transformations,” in Network and Distributed System Security Symposium , ser. NDSS ’15, 2015
2015
Cited alongside, same era.
P. Devanbu, “New initiative: The naturalness of software,” in International Conference on Software Engineering , ser. ICSE ’15, 2015, pp. 543–546
2015
Cited alongside, same era.
V. Raychev, M. Vechev, and A. Krause, “Predicting program properties from “Big Code”,” in Symposium on Principles of Programming Languages , ser. POPL ’15, 2015, pp. 111–124
2015
Cited alongside, same era.
——, “Suggesting accurate method and class names,” in Joint Meeting of the European Software Engineering Conference and the Symposium on the Foundations of Software Engineering , ser. ESEC/FSE ’15, 2015, pp. 38–49
2015
Cited alongside, same era.
Y. Li, D. Tarlow, M. Brockschmidt, and R. Zemel, “Gated graph sequence neural networks,” arXiv preprint arXiv:1511.05493 , 2015
Original
2015
Cited alongside, same era.
T. Luong, H. Pham, and C. D. Manning, “Effective approaches to attention-based neural machine translation,” in EMNLP , 2015
2015
Cited alongside, same era.
K. Cho, A. Courville, and Y. Bengio, “Describing multimedia content using attention-based encoder-decoder networks,” IEEE Transactions on Multimedia , vol. 17, no. 11, pp. 1875–1886, 2015
2015
Cited alongside, same era.
K. Yakdan, S. Dechand, E. Gerhards-Padilla, and M. Smith, “Helping Johnny to analyze malware: A usability-optimized decompiler and malware analysis user study,” in IEEE Symposium on Security and Privacy , ser. SP ’16, 2016, pp. 158–177
2016
Cited alongside, same era.
W. Wang, J.-T. Peter, H. Rosendahl, and H. Ney, “CharacTer: Translation edit rate on character level,” in WMT ’16 , 2016, pp. 505–510
2016
Cited alongside, same era.
B. Vasilescu, C. Casalnuovo, and P. Devanbu, “Recovering clear, natural identifiers from obfuscated JavaScript names,” in Joint Meeting of the European Software Engineering Conference and the Symposium on the Foundations of Software Engineering , ser. ESEC/FSE ’17, 2017, pp. 683–693
2017
Cited alongside, same era.

Then

U. Alon, M. Zilberstein, O. Levy, and E. Yahav, “A general path-based representation for predicting program properties,” in Programming Language Design and Implementation , ser. PLDI ’18, 2018, pp. 404–419
2018
Later among the works it cites.
A. Jaffe, J. Lacomis, E. J. Schwartz, C. Le Goues, and B. Vasilescu, “Meaningful variable names for decompiled code: A machine translation approach,” in International Conference on Program Comprehension , ser. ICPC ’18, May 2018, pp. 20–30
2018
Later among the works it cites.
J. He, P. Ivanov, P. Tsankov, V. Raychev, and M. Vechev, “ Debin
2018
Later among the works it cites.
D. S. Katz, J. Ruchti, and E. Schulte, “Using recurrent neural networks for decompilation,” in International Conference on Software Analysis, Evolution and Reegnineering , ser. SANER ’18, 2018, pp. 346–356
2018
Later among the works it cites.
M. Allamanis, E. T. Barr, P. Devanbu, and C. Sutton, “A survey of machine learning for big code and naturalness,” ACM Computing Surveys (CSUR) , vol. 51, no. 4, p. 81, 2018
2018
Later among the works it cites.
M. Allamanis, M. Brockschmidt, and M. Khademi, “Learning to represent programs with graphs,” in International Conference on Learning Representations , ser. ICLR ’18, 2018
2018
Later among the works it cites.
T. Kudo and J. Richardson, “SentencePiece: A simple and language independent subword tokenizer and detokenizer for neural text processing,” in Proceedings of the 2018 Conference on Empirical Methods in Natural Language Processing: System Demonstrations , 2018, pp. 66–71
2018
Later among the works it cites.
Binutils. (2019) objdump. [Online]. Available: https://www.gnu.org/software/binutils/
2019
Closest in time.
IDA. (2019) Ida. [Online]. Available: https://www.hex-rays.com/products/ida/
2019
Closest in time.
Hex-Rays. (2019) The hex-rays decompiler. [Online]. Available: https://www.hex-rays.com/products/decompiler/
2019
Closest in time.
Ghidra. (2019) The ghidra decompiler. [Online]. Available: https://ghidra-sre.org/
2019
Closest in time.
Y. David, U. Alon, and E. Yahav, “Neural reverse engineering of stripped binaries,” 2019
2019
Closest in time.
U. Alon, O. Levy, and E. Yahav, “code2seq: Generating sequences from structured representations of code,” in ICLR , 2019
2019
Closest in time.
M. Allamanis, “The adverse effects of code duplication in machine learning models of code,” in Proceedings of the 2018 ACM SIGPLAN International Symposium on New Ideas, New Paradigms, and Reflections on Programming and Software . ACM, 2019
2019
Closest in time.

Beyond the bibliography

alphaXiv searches the wider corpus for related work and actual follow-ups.

Open on alphaXiv

alphaXiv is searching for related work…

Reading the bibliography…