Echo: Learning-based Matching Decompilation using Trusted Back Translation
Researchers introduce Echo, a matching decompiler using trusted back-translation that roughly doubles exact-match rates and outperforms GPT-5.6 and Codex on Mirai.
Echo performs matching decompilation by using compilation as trusted feedback for iterative search: a domain-specific model generates candidate code and compilation configurations, which are recompiled, compared at assembly level, and repaired via rule-based rewriting, neural refinement, and reasoning-based refinement. On function-level benchmarks, Echo produces 2.43x more exact matches than the strongest baseline and the highest structural similarity to ground truth. On the Mirai malware binary, it matches 2.75x and 7.4x as many functions as GPT-5.6 and Codex, respectively.
- Uses compilation as trusted feedback to guide iterative decompilation search
- Combines rule-based rewriting, neural refinement, and reasoning-based repair
- 2.43x more exact matches than the strongest baseline on benchmarks
- Outperforms GPT-5.6 and Codex on the Mirai malware binary
Full article171 words · extracted from arxiv.org · click to collapse
Neural decompilers can recover readable and recompilable source code from binaries, but their predictions remain difficult to trust. Matching decompilation addresses this problem by searching for source code whose recompiled assembly exactly matches the target, providing stronger evidence of correctness. However, exact matching remains challenging for optimized binaries under unknown compilation configurations. We present Echo, a matching decompilation system based on trusted back-translation. Our key insight is to use compilation not only for verification, but also as trusted feedback to guide iterative search. Echo first uses a domain-specific model to generate candidate programs and compilation configurations. It recompiles these candidates, measures assembly-level similarity, and synthesizes promising code-configuration pairs. Remaining mismatches are then progressively repaired using rule-based rewriting, neural refinement, and reasoning-based refinement. We evaluate Echo on function-level benchmarks and the Mirai malware binary. Compared with the strongest baseline, Echo produces 2.43x more exact matches on average and achieves the highest structural similarity to ground-truth source code. On Mirai, Echo matches 2.75x and 7.4x as many functions as GPT-5.6 and Codex, respectively.
Text extracted automatically; images, tables and formatting may be missing. Original: https://arxiv.org/abs/2609.18706