🤖 AI

LLM4CodeRE: Generative AI for Code Decompilation Analysis and Reverse Engineering

The paper proposes LLM4CodeRE, a domain-adaptive large language model framework that employs multi-adapter and task-conditioned prefix fine-tuning strategies to achieve robust bidirectional code reverse engineering, outperforming existing tools in decompiling obfuscated malware and translating source code to assembly.

Original authors: Hamed Jelodar, Samita Bai, Tochukwu Emmanuel Nwankwo, Parisa Hamedi, Mohammad Meymani, Roozbeh Razavi-Far, Ali A. Ghorbani

Published 2026-04-08

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Hamed Jelodar, Samita Bai, Tochukwu Emmanuel Nwankwo, Parisa Hamedi, Mohammad Meymani, Roozbeh Razavi-Far, Ali A. Ghorbani

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you are a detective trying to solve a crime, but the only evidence you have is a shredded, scrambled, and encrypted diary written in a secret code. This is essentially what cybersecurity experts face when they try to analyze malware (harmful computer programs).

The original code of a virus is often hidden, stripped of labels, or deliberately scrambled (a process called "obfuscation") to hide its true purpose. To understand what the virus is doing, experts must perform Reverse Engineering: they have to take the machine's low-level language (Assembly code) and translate it back into human-readable source code.

This is incredibly hard, like trying to rebuild a complex Lego castle just by looking at a pile of loose, mixed-up bricks.

The Problem: The "Generic" Translator

Recently, powerful AI models (called LLMs) have become great at translating languages and writing code. However, most of these AIs were trained on "good" code—like open-source software or apps you download from an app store. They are like translators who only speak "Polite English."

When you ask them to translate "Malware Russian" (scrambled, malicious code), they get confused. They don't understand the slang, the hidden tricks, or the specific ways criminals hide their tracks. They try to force the malicious code into a "polite" shape, which often leads to wrong answers.

The Solution: LLM4CodeRE

The authors of this paper created a new AI system called LLM4CodeRE. Think of this as hiring a specialized detective translator who has spent years studying criminal diaries, not just polite novels.

Here is how they built it, using simple analogies:

1. The "Specialized Training" (Domain-Adaptive Pretraining)

Instead of just giving the AI a generic book of code, the researchers fed it a massive library of real-world malware. They showed the AI millions of examples of how viruses are scrambled and unscrambled.

Analogy: Imagine a language student who only studied Shakespeare. If you ask them to translate a gangster's slang, they will fail. But if you send them to live in a gangster neighborhood for a year (training on malware), they learn the specific slang, the hidden meanings, and the tricks. That is what LLM4CodeRE does.

2. The "Two-Way Street" (Bidirectional Translation)

Most tools only go one way: Machine Code $\to$ Human Code. But LLM4CodeRE is a two-way translator.

Decompilation (Assembly $\to$ Source): Taking the scrambled machine code and turning it back into readable code.
Recompilation (Source $\to$ Assembly): Taking readable code and turning it back into machine code.
Analogy: It's like a bilingual translator who can not only translate a speech from English to French, but also take a French speech and translate it back into English perfectly, ensuring the meaning hasn't changed. This helps verify if the translation is actually correct.

3. The "Smart Attachments" (Multi-Adapter & Seq2Seq)

The researchers didn't want to rebuild the entire AI brain for every new task. Instead, they used a clever strategy:

Multi-Adapter: Imagine the AI is a Swiss Army Knife. The main handle is the same, but they attach different "blades" (adapters) for different jobs. One blade is for translating Assembly to Source, another for Source to Assembly. This keeps the AI fast and efficient.
Seq2Seq Unified: Alternatively, they used "magic tags" (prefixes). You tell the AI, "Here is a job: Translate this," and the AI knows exactly how to handle it without needing a new blade.

4. The "Real-World Test" (Re-executability)

This is the most important part. Many AI tools produce code that looks right but doesn't work.

The Analogy: Imagine an AI writes a recipe for a cake. It looks perfect on paper, but if you bake it, it turns into a brick.
The Innovation: The researchers didn't just check if the code looked similar to the original. They actually compiled and ran the code in a safe, isolated sandbox (a digital "playpen"). If the code ran successfully without crashing, they gave it a high score. If it failed, they knew the AI was lying.

The Results

When they tested their new detective translator (LLM4CodeRE) against existing tools:

It understood the "criminal slang" (malware patterns) much better.
It produced code that was not only readable but actually worked when run.
It was better at both translating malware into human code and turning human code back into machine code.

Why This Matters

In the world of cybersecurity, speed is everything. If a new virus appears, experts need to understand it in minutes, not days. By using this specialized AI, we can automate the boring, difficult work of decoding viruses, allowing human experts to focus on stopping the threat rather than deciphering the code.

In short: They built an AI that speaks "Virus" fluently, can translate it back and forth, and actually checks if the translation works before handing it to the police.

1. Problem Statement

Code decompilation and reverse engineering are critical tasks in cybersecurity for analyzing malware, uncovering malicious intent, and developing defensive signatures. However, these tasks face significant challenges:

Obfuscation: Modern malware employs sophisticated techniques (packing, polymorphism, control flow flattening) that render traditional static and dynamic analysis tools brittle and labor-intensive.
Limitations of Existing LLMs: While Large Language Models (LLMs) have shown promise in code translation, most are pre-trained on benign, open-source code. They treat malware as "out-of-distribution" data, failing to capture specific obfuscation patterns, anti-debugging logic, and malicious API usage.
Lack of Bidirectional Support: Existing tools often focus on single-direction translation (Assembly $\to$ Source) and lack a unified framework for both decompilation and recompilation (Source $\to$ Assembly).
Evaluation Gaps: Prior work relies heavily on static similarity metrics (e.g., BLEU, exact match) rather than functional correctness, failing to verify if generated code can actually be compiled and executed.

2. Methodology: LLM4CodeRE Framework

The authors propose LLM4CodeRE, a domain-adaptive LLM framework designed for bidirectional code reverse engineering (Assembly $\leftrightarrow$ Source). The architecture consists of three hierarchical layers:

A. Malware-Aware Pretraining (CLM)

Corpus: The backbone model is pre-trained on a large-scale corpus of real-world malicious binaries, including disassembled assembly code, decompiled pseudo-code, and recovered source artifacts from PE files.
Normalization: Samples undergo instruction canonicalization, register renaming, and address randomization to reduce syntactic noise.
Objective: Causal Language Modeling (CLM) is used to teach the model the statistical and semantic characteristics of malicious software, including anti-analysis patterns.

B. Parameter-Efficient Fine-Tuning (PEFT)

To adapt the pre-trained backbone to specific tasks without catastrophic forgetting, the framework employs Low-Rank Adaptation (LoRA). Two complementary strategies are proposed for task specialization:

Multi-Adapter (MA) Strategy:
- Introduces lightweight, task-specific adapter modules (residual transformation layers) attached to the shared backbone.
- Each adapter handles a specific direction (e.g., Asm $\to$ Src or Src $\to$ Asm).
- Allows for dynamic activation of specific adapters at inference time.
Seq2Seq Unified (S2S) Strategy:
- Uses a decoder-only causal model augmented with task-conditioned prefix tokens.
- A learned prefix embedding ( $p_t$ ) conditions the model to perform the desired transformation (decompilation or recompilation) within a single autoregressive framework, eliminating the need for separate encoder-decoder pairs.

C. Training Protocol

Optimization: Uses BF16 precision, AdamW optimizer, and gradient accumulation to handle large batch sizes (effective batch size of 512) within GPU memory limits.
Data: Utilizes the SBAN dataset (676,151 aligned samples) and the PE-Machine Learning dataset for evaluation.

3. Key Contributions

First Malware-Aware CLM Pretraining: Introduces a pretraining framework specifically for LLM-based decompilation using real-world malicious binaries, enabling domain-specific representation learning.
Unified Bidirectional Framework: The first model to support both Assembly-to-Source decompilation and Source-to-Assembly translation within a single architecture, capable of modeling both benign and malicious behaviors.
Hybrid Adaptation Strategies: Proposes and compares Multi-Adapter and Seq2Seq Unified prefixing strategies for efficient task adaptation in reverse engineering.
Comprehensive Evaluation Protocol: Moves beyond static metrics to include Re-executability, testing whether generated code can be compiled (GCC -O2) and executed successfully in a sandboxed environment.

4. Experimental Results

The framework was evaluated against baselines like DeepSeek, LLM4Decompile, and WADEC using three metrics: Semantic Similarity (BERTScore), Edit Similarity (Normalized Levenshtein), and Re-executability.

Bidirectional Performance:
- Asm $\to$ Src: LLM4CodeRE (Multi-Adapter) achieved the highest semantic similarity (0.85) and edit similarity (0.63), outperforming DeepSeek and LLM4Decompile.
- Src $\to$ Asm: The Multi-Adapter variant again led with 0.64 semantic and 0.27 edit similarity, demonstrating robust generalization in the more challenging recompilation direction.
Re-executability (Functional Correctness):
- On the XLangKode dataset, the Seq2Seq Unified (S2S) variant achieved a 86% re-executability rate (successful compilation and execution).
- This significantly outperformed LLM4CodeRE (MA) at 53%, LLM4Decompile at 48%, and DeepSeek at 15%.
Domain Adaptation: Perplexity analysis confirmed that domain fine-tuning consistently reduced perplexity across all backbone models (Qwen, Llama, Mistral, DeepSeek), proving the efficacy of the malware-aware pretraining.

5. Significance and Future Work

Significance: LLM4CodeRE bridges the gap between generative AI and cybersecurity by explicitly modeling malware semantics. Its focus on re-executability ensures that the output is not just syntactically similar but functionally valid, a critical requirement for practical reverse engineering.
Limitations: Currently focused on Windows PE binaries; automated decompilation introduces label noise; sandboxed execution has limited behavioral coverage.
Future Directions: The authors plan to extend the framework to Android malware (APK, DEX, Smali) and explore cross-platform generalization between Windows and Android environments.

Conclusion: LLM4CodeRE represents a paradigm shift in automated reverse engineering, demonstrating that domain-adaptive LLMs can outperform general-purpose code models and traditional decompilers in both semantic fidelity and functional correctness.