Echo: Learning-based Matching Decompilation using Trusted Back Translation
Jun Bi, Xiangxin Fang, Aarsh Chaube, José Wesley De Souza Magalhães, Rodrigo C. O. Rocha, Michael O'Boyle
cs.CR · cs.AI
Quick verdict
Echo uses compilation as trusted feedback for exact-match decompilation, reporting 2.43x GPT-5.6's match rate; strong, but query-budget asymmetry tempers it.
Summary
The paper presents Echo, a matching-decompilation system that recovers C source whose recompiled assembly exactly equals a target binary function, including under unknown compiler configurations. Its core idea, trusted back-translation (TBT), exploits compilation's determinism as feedback: a 1.3B domain-specific model jointly generates source candidates and configuration predictions; candidates are recompiled, scored by normalized assembly edit distance, and improved via evolutionary configuration synthesis, then rule-based AST rewriting, a fine-tuned neural refinement model conditioned on assembly diffs (~3M training pairs), and finally a reasoning LLM (at most 5 rounds). Trained on ~4M ExeBench functions with normalized source/assembly, it is evaluated on HumanEval, ExeBench, Synthesis (GCC-12 -O1/-O2/-O3, LLVM-14 -O3) and 62 Mirai functions. Echo reports 2.43x more exact matches than the strongest baseline (GPT-5.6), up to 8.13x versus smaller lifters, the highest CFG similarity (0.902-0.965), and 35.5% versus 12.9% exact-match on Mirai against test-time-scaled GPT-5.6. Main limitations: Echo consumes 100+100 model queries plus compilation loops per function versus single-query baselines (matched-budget evidence is partial); 'correctness guarantees' wording overstates what normalized assembly equality certifies; no variance or significance reporting; and evaluation is x86-64-only with a single real-world binary.
Review complete
Assessment at a glance
5
risk flags identified
● high 0
● medium 3
● low 2
5 strengths · 5 weaknesses · 5 author questions
Levels reflect verification complexity — not a quality score. Evolve never rates your paper.
Key claims under review
- Using deterministic compilation as trusted back-translation turns neural decompilation into an iterative search that yields 2.43x more exact matches on average than the strongest baseline (GPT-5.6) across four compiler settings.
- Echo jointly infers source code and unknown compilation configurations, and its evolutionary configuration synthesis achieves exact matches even when the true build configuration lies outside the search space.
- Optimizing assembly edit distance also improves behavioral equivalence (1.2x-4.31x over baselines) and yields the highest CFG structural similarity to ground-truth source (0.902-0.965).
- On the real-world Mirai binary, Echo exactly matches 35.5% of 62 deduplicated functions, 2.75x GPT-5.6 under 20-query test-time scaling and 7.4x an agentic Codex setup.
- Staged mismatch-guided refinement is necessary: rule-based, neural, and reasoning-based repairs address complementary mismatch classes, and either stage alone underperforms the combination (Figure 10).
Strengths
Reframes verification as feedback (TBT)
Section 3.1/Algorithm 1 model deterministic compilation as a backward operator, turning one-shot decompilation into search minimized by normalized edit distance (Eq. 1); mismatches also localize trusted regions for analysts (Figure 1, Section 2), a genuine twist on prior match-only criteria (Schulte et al., Decomperson, Pylingual).
Handles unknown compilation configurations
Joint code+config prediction (Section 4.1.1, Figure 5) plus evolutionary configuration synthesis over GCC 3-16 / Clang 7-21 and 29 flag sets (Section 4.2, Tables 4-5) lets Echo exactly match Mirai functions whose true build configuration falls outside the search space (Section 7.6).
Consistent multi-metric gains
Empirically justifies its optimization proxy
Transparent failure taxonomy and ablations
Weaknesses
Query-budget asymmetry in headline results
'Correctness guarantees' overclaim
No statistical uncertainty reporting
Narrow external validity
Reproducibility friction in the full configuration
Full Review Report
$1.99 · one-timeUnlock the complete preliminary analysis Evolve produced for this paper.
- All 5 strengths & 5 weaknesses, analyzed in detail
- 5 risk flags with severity, section & reviewer questions
- Methods & statistical evidence assessment
- 5 questions a peer reviewer would ask
- Full six-dimension evaluation report & recommendations
One-time purchase · this paper only
One-time purchase, this paper only. AI-generated preliminary analysis — not peer review.
Frequently asked questions
What is matching decompilation and why does an exact assembly match matter?
Matching decompilation searches for source code that, when recompiled, produces assembly identical to the target binary function after removing address-dependent artifacts. Because compilation is deterministic, an exact match is compiler-backed evidence that the recovered code reproduces the binary's code-generation behavior - much stronger evidence than code that merely compiles or passes a few tests, which matters for malware analysis and binary patching.
How much better is Echo than GPT-5.6 at decompilation?
On function-level benchmarks (HumanEval, ExeBench, Synthesis) under GCC and LLVM optimization, Echo reports on average 2.43x more exact matches than GPT-5.6, its strongest baseline. On the real-world Mirai malware binary, Echo exactly matches 35.5% of 62 functions versus 8.1% for single-query GPT-5.6, 12.9% for GPT-5.6 with 20 queries, and 4.8% for an agentic Codex setup. Note Echo uses many more model queries per function than the single-query baselines.
Does an exact match guarantee the decompiled code is semantically correct?
Not in a formal sense - semantic equivalence between programs is undecidable. An exact match under Echo's address-invariant normalization is strong evidence the recovered source reproduces the target's code generation under the tested compiler configuration, but it does not formally rule out behavioral differences outside compiled code (e.g., undefined behavior). The paper's phrase 'correctness guarantees' is stronger than what this evidence strictly supports.
What data was Echo trained on and is the system available?
Echo's 1.3B decompiler and refinement models are trained on about 4 million compilable C functions from ExeBench, compiled under sampled configurations spanning GCC 3-16 and Clang 7-21 with 29 flag sets; the authors state evaluation assembly was verified disjoint from training data. The paper promises an anonymous artifact repository with source code, scripts, and Hugging Face model checkpoints, though the repository link is a placeholder in this version.
About this review
This is an AI-generated preliminary review by Evolve.Pub, produced from the openly available text of the paper. It is not peer review and does not represent the authors' views. The canonical record of the paper is at the publisher link above.
- Numeric labels of Figures 7, 8, 10, and 11 arrived as jumbled OCR; per-bar rates could only be reconstructed from the text-stated multipliers, geomeans, and Table values.
- Which LLM4Decompile setting (one-shot vs matched-budget) is plotted in Figure 7 is not disambiguated in the extracted text.
- The artifact repository URL is a placeholder (anonymous.4open.science/xxxx), so stated reproducibility artifacts could not be inspected.
Go deeper on this paper
Wrote a paper? Stress-test it before reviewers do.
Upload your manuscript for the same structured scrutiny — reasoning, statistics, evidence, figures, and reproducibility.