Page 8 - 《软件学报》2026年第6期

软件学报 ISSN 1000-9825, CODEN RUXUEW E-mail: jos@iscas.ac.cn
2026,37(6):2327−2345 [doi: 10.13328/j.cnki.jos.007616] [CSTR: 32375.14.jos.007616] http://www.jos.org.cn
©中国科学院软件研究所版权所有. Tel: +86-10-62562563

*
BinDec: 面向 RISC-V 的 LLM 与符号执行协同反编译方法

李玉璋 1 , 张 熙 1 , 徐 涛 2

1
(北京邮电大学 网络空间安全学院, 北京 100876)
2
(清华大学 计算机科学与技术系, 北京 100084)
通信作者: 徐涛, E-mail: xtao@tsinghua.edu.cn

摘 要: 反编译是软件逆向工程中的基础技术, 其目标是从面向硬件的二进制代码中恢复出高级语言代码, 以支持
人工阅读、分析或重工程任务. 尽管该技术已得到广泛研究, 但传统基于规则的反编译器所生成的反编译代码往
往可读性较差, 且难以复用. 此外, 由于传统反编译器的开发周期较长, 其对 RISC-V 等新兴指令集架构的支持通常
较为滞后. 在当前大语言模型 (large language model, LLM) 技术广泛应用于自动化软件工程任务并取得显著成效
的背景下, 面向 RISC-V 架构的反编译需求, 提出了一种 LLM 与符号执行协同的反编译方法 BinDec. 该方法通过
LLM 生成与符号执行验证的交替迭代, 充分利用 LLM 的代码理解与生成能力, 以产生更易于理解与重用的反编
译代码; 同时借助符号执行的代码分析与验证能力, 确保生成结果的可靠性. 通过一系列实验对 BinDec 的有效性
进行了评估, 实验结果表明, 该方法在达到与传统反编译器相近的语义准确性的同时显著提升了代码的可读性.
关键词: 反编译; 大语言模型; 符号执行
中图法分类号: TP311

中文引用格式: 李玉璋, 张熙, 徐涛. BinDec: 面向RISC-V的LLM与符号执行协同反编译方法. 软件学报, 2026, 37(6): 2327–2345.
http://www.jos.org.cn/1000-9825/7616.htm
英文引用格式: Li YZ, Zhang X, Xu T. BinDec: LLM and Symbolic Execution Collaborative Decompilation Method for RISC-V. Ruan
Jian Xue Bao/Journal of Software, 2026, 37(6): 2327–2345 (in Chinese). http://www.jos.org.cn/1000-9825/7616.htm
BinDec: LLM and Symbolic Execution Collaborative Decompilation Method for RISC-V

1
1
LI Yu-Zhang , ZHANG Xi , XU Tao 2
1
(School of Cyberspace Security, Beijing University of Posts and Telecommunications, Beijing 100876, China)
2
(Department of Computer Science and Technology, Tsinghua University, Beijing 100084, China)
Abstract: Decompilation serves as a fundamental technique in software reverse engineering, aiming to recover high-level source code from
hardware-oriented binary programs to support human understanding, analysis, and re-engineering tasks. Although this technique has been
extensively studied, traditional rule-based decompilers often generate decompiled code with poor readability and limited reusability.
Moreover, due to long development cycles, support for emerging instruction set architectures such as RISC-V is typically delayed in
conventional decompilers. With the widespread adoption of large language models (LLMs) in automated software engineering tasks and
their demonstrated effectiveness, this study proposes BinDec, a RISC-V binary decompilation approach that synergistically integrates LLM
and symbolic execution. The proposed method alternates between LLM-based code generation and symbolic execution-based verification,
fully exploiting the code understanding and generation capabilities of LLM to produce decompiled code that is more readable and reusable,
while leveraging the analysis and verification capabilities of symbolic execution to ensure semantic correctness and reliability. The
effectiveness of the proposed method is evaluated through a series of experiments. Experimental results demonstrate that BinDec achieves
semantic accuracy comparable to that of traditional decompilers, while significantly improving the readability of the generated decompiled
code.

* 本文由“RISC-V 与人工智能系统软件前沿进展”专题特约编辑武延军研究员、谢涛教授、侯锐研究员、宋威研究员、邢明杰高级工
程师推荐.
收稿时间: 2025-09-07; 修改时间: 2025-10-20, 2025-12-08; 采用时间: 2025-12-17; jos 在线出版时间: 2025-12-26
CNKI 网络首发时间: 2026-03-12