# Awesome REA Papers [← Back to the README](../README.md#papers) · **English** · [简体中文](papers.zh-CN.md) **235 papers**, grouped by topic and ordered newest first. Each line shows the study’s opening sentence, venue, publication status and first author. [Browse the paper directory](https://awesomerea.org/papers/) · [Complete bibliography JSON](../data/papers.json) · [Suggest a paper](https://github.com/reacher-z/Awesome-REA/issues/new?template=paper.yml) ## Contents - [Reverse-engineering agent evaluation](#reverse-engineering-agent-evaluation) (14) - [Decompilation and symbol recovery](#decompilation-and-symbol-recovery) (110) - [Website reconstruction](#website-reconstruction) (31) - [Game reconstruction and reverse engineering](#game-reconstruction-and-reverse-engineering) (15) - [App reconstruction and analysis](#app-reconstruction-and-analysis) (16) - [Firmware analysis and rehosting](#firmware-analysis-and-rehosting) (27) - [Protocol inference and analysis](#protocol-inference-and-analysis) (22) Each paper’s “Full entry” holds its complete summary, scope and limitations, all authors and citation. ## Reverse-engineering agent evaluation [↑ Contents](#contents) - [**Humans vs. Machines: A Comparison With AI Agents in Software Reverse Engineering**](https://arxiv.org/abs/2610.14960) - Compares human and LLM-agent understanding and navigation on the same static reverse-engineering challenges, then studies how binary representations consume context windows. _{arXiv 2026 · Preprint · Samuele Doria et al. · [PDF](https://arxiv.org/pdf/2610.14960) · [Full entry](https://awesomerea.org/papers/paper-humans-machines-sre/)} - [**Training Language Model Agents to Find Vulnerabilities with CTF-Dojo**](https://proceedings.mlr.press/v306/zhuo26c.html) - CTF-Dojo is an execution environment for training LLM agents on capture-the-flag tasks: 658 challenges from 50 competitions held between 2011 and 2025, taken from pwn.college's CTF Archive and containerized with Docker. _{ICML 2026 · Conference paper · Terry Yue Zhuo et al. · [PDF](https://raw.githubusercontent.com/mlresearch/v306/main/assets/zhuo26c/zhuo26c.pdf) · [Code](https://github.com/amazon-science/CTF-Dojo) · [Full entry](https://awesomerea.org/papers/paper-ctf-dojo/)} - [**Reveree: Diagnosing LLM Reverse-Engineering Agents**](https://arxiv.org/abs/2609.01185) - Evaluates reverse-engineering agent traces through flag recovery, eight analysis milestones and action profiles. _{arXiv 2026 · Preprint · Hadjer Benkraouda et al. · [PDF](https://arxiv.org/pdf/2609.01185v1) · [Full entry](https://awesomerea.org/papers/paper-reveree/)} - [**The Next Challenge for Agentic Cybersecurity: A Realistic, Contamination-Free Reverse Engineering Benchmark**](https://arxiv.org/abs/2608.11469) - Introduces SRE-Bench, with privately authored programs and protected binary variants, to study agent recovery of program semantics while reducing training-data contamination. _{arXiv 2026 · Preprint · Jeremy Spence et al. · [PDF](https://arxiv.org/pdf/2608.11469) · [Full entry](https://awesomerea.org/papers/paper-sre-bench/)} - [**Automatically Attacking Software Reverse Engineering AI Agents**](https://papers.academic-conferences.org/index.php/eccws/article/view/4597) - A proof of concept for indirect prompt injection against Cline/GhidraMCP binary-analysis agents. _{ECCWS 2026 · Conference paper · Brian Crawford et al. · [PDF](https://papers.academic-conferences.org/index.php/eccws/article/download/4597/4412/17540) · [Full entry](https://awesomerea.org/papers/paper-attacking-re-ai-agents/)} - [**CrackMeBench: Binary Reverse Engineering for Agents**](https://arxiv.org/abs/2605.10597) - Evaluates agents on executable-checked CrackMe tasks: infer validation logic from binaries and submit an accepted input or artifact, while recording tool use, time, and scoring attempts. _{arXiv 2026 · Preprint · Isaac David et al. · [PDF](https://arxiv.org/pdf/2605.10597) · [Full entry](https://awesomerea.org/papers/paper-crackmebench/)} - [**Towards LLM-Resistant Software Protection: Agent Failure Patterns in CTF Reverse Engineering**](https://www.ndss-symposium.org/ndss-paper/auto-draft-657/) - Runs Claude Code, Codex CLI and ChatGPT-5.2 Pro on 24 crackme-style challenges selected from 15 international CTF events held in 2025, and attributes their failures to stages of an Observe–Comprehend–Plan loop and to three protection effects: concealment, complication and misdirection. _{Workshop on Binary Analysis Research (BAR) 2026 · Conference paper · Ryutaro Nishizaka et al. · [PDF](https://www.ndss-symposium.org/wp-content/uploads/bar2026-58.pdf) · [Full entry](https://awesomerea.org/papers/paper-llm-resistant-protection/)} - [**ProgramBench: Can Language Models Rebuild Programs From Scratch?**](https://arxiv.org/abs/2605.03546) - Evaluates black-box program reconstruction across 200 tasks: agents query an executable and read its documentation, then independently implement a codebase whose behavior is checked by generated tests. _{NeurIPS 2026 · Conference accepted · John Yang et al. · [PDF](https://arxiv.org/pdf/2605.03546v1) · [Code](https://github.com/facebookresearch/ProgramBench) · [Full entry](https://awesomerea.org/papers/paper-programbench/)} - [**Decompiling the Synergy: An Empirical Study of Human–LLM Teaming in Software Reverse Engineering**](https://www.ndss-symposium.org/ndss-paper/decompiling-the-synergy-an-empirical-study-of-human-llm-teaming-in-software-reverse-engineering/) - Studies how human analysts work with LLM assistance during static software reverse engineering. _{NDSS 2026 · Conference paper · Zion Leonahenahe Basque et al. · [PDF](https://www.ndss-symposium.org/wp-content/uploads/2026-f380-paper.pdf) · [Code](https://github.com/mahaloz/dec-synergy-study) · [Full entry](https://awesomerea.org/papers/paper-decompiling-synergy/)} - [**Cyber-Zero: Training Cybersecurity Agents without Runtime**](https://proceedings.iclr.cc/paper_files/paper/2026/hash/f9f54762cbb4fe4dbffdd4f792c31221-Abstract-Conference.html) - Cyber-Zero synthesizes training trajectories for capture-the-flag (CTF) agents from public writeups instead of running the challenges. _{ICLR 2026 · Conference paper · Terry Yue Zhuo et al. · [PDF](https://proceedings.iclr.cc/paper_files/paper/2026/file/f9f54762cbb4fe4dbffdd4f792c31221-Paper-Conference.pdf) · [Code](https://github.com/amazon-science/Cyber-Zero) · [Full entry](https://awesomerea.org/papers/paper-cyber-zero/)} - [**CREBench: Evaluating Large Language Models in Cryptographic Binary Reverse Engineering**](https://openreview.net/forum?id=tLYdf8hWJB) - Benchmarks cryptographic binary reverse engineering across algorithm recognition, key or IV extraction, wrapper reconstruction, and flag recovery using 432 controlled challenges. _{COLM 2026 · Conference paper · Baicheng Chen et al. · [PDF](https://arxiv.org/pdf/2604.03750v2) · [Code](https://github.com/wangyu-ovo/CREBench) · [Full entry](https://awesomerea.org/papers/paper-crebench/)} - [**EnIGMA: Interactive Tools Substantially Assist LM Agents in Finding Security Vulnerabilities**](https://proceedings.mlr.press/v267/abramovich25a.html) - EnIGMA extends SWE-agent for capture-the-flag challenges with interactive agent tools that keep a gdb debugging session or a pwntools server connection open across turns, alongside decompile and disassemble commands, an LM summarizer for long outputs, and category-specific demonstrations and guidelines. _{ICML 2025 · Conference paper · Talor Abramovich et al. · [PDF](https://raw.githubusercontent.com/mlresearch/v267/main/assets/abramovich25a/abramovich25a.pdf) · [Code](https://github.com/SWE-agent/SWE-agent/tree/v0.7) · [Full entry](https://awesomerea.org/papers/paper-enigma/)} - [**Cybench: A Framework for Evaluating Cybersecurity Capabilities and Risks of Language Models**](https://proceedings.iclr.cc/paper_files/paper/2025/hash/3e9412a9c1d93810ef3ef7825115016b-Abstract-Conference.html) - Cybench turns 40 professional-level capture-the-flag tasks from four competitions (HackTheBox Cyber Apocalypse 2024, SekaiCTF 2022–23, GlacierCTF and HKCert) into runnable agent tasks. _{ICLR 2025 · Conference paper · Andy K. Zhang et al. · [PDF](https://proceedings.iclr.cc/paper_files/paper/2025/file/3e9412a9c1d93810ef3ef7825115016b-Paper-Conference.pdf) · [Code](https://github.com/andyzorigin/cybench) · [Full entry](https://awesomerea.org/papers/paper-cybench/)} - [**NYU CTF Bench: A Scalable Open-Source Benchmark Dataset for Evaluating LLMs in Offensive Security**](https://proceedings.neurips.cc/paper_files/paper/2024/hash/69d97a6493fbf016fff0a751f253ad18-Abstract-Datasets_and_Benchmarks_Track.html) - NYU CTF Bench packages 200 manually validated challenges from CSAW CTF qualifying and final rounds held between 2017 and 2023, spanning cryptography, forensics, pwn, reverse engineering, web and miscellaneous tasks, with challenge.json metadata and Docker images for server-side challenges. _{NeurIPS 2024 Datasets and Benchmarks · Conference paper · Minghao Shao et al. · [PDF](https://proceedings.neurips.cc/paper_files/paper/2024/file/69d97a6493fbf016fff0a751f253ad18-Paper-Datasets_and_Benchmarks_Track.pdf) · [Code](https://github.com/NYU-LLM-CTF/NYU_CTF_Bench) · [Full entry](https://awesomerea.org/papers/paper-nyu-ctf-bench/)} ## Decompilation and symbol recovery [↑ Contents](#contents) - [**Locate, Then Reason: End-to-End Patch Presence Testing in Stripped Binaries**](https://arxiv.org/abs/2610.25071) - Locates patch-relevant code in stripped binaries using instruction-aligned retrieval and caller/callee context, then uses an LLM to screen candidate matches and compare patch-specific behavior with vulnerable and patched references. _{arXiv 2026 · Preprint · Huaijin Wang et al. · [PDF](https://arxiv.org/pdf/2610.25071v1) · [Full entry](https://awesomerea.org/papers/paper-patchalign/)} - [**Recall-Oriented Precise Binary-to-Source Function Matching**](https://arxiv.org/abs/2610.23546) - BScout matches decompiled functions to a source corpus using chunked embeddings and inlining-aware training. _{arXiv 2026 · Preprint · Junlin Li et al. · [PDF](https://arxiv.org/pdf/2610.23546v1) · [Full entry](https://awesomerea.org/papers/paper-bscout/)} - [**Decoding What iOS Location Services Send to Apple: An LLM Is an Unreliable Analyst but a Useful Toolmaker**](https://arxiv.org/abs/2610.21597) - Compares direct LLM recovery of Apple PBCodable schemas with an AI-written Extractor checked against compiled synthetic fixtures, published descriptors and captured traffic. _{arXiv 2026 · Preprint · Douglas Leith · [PDF](https://arxiv.org/pdf/2610.21597v1) · [Code](https://github.com/doug-leith/ios-protobuf-decoding) · [Full entry](https://awesomerea.org/papers/paper-ios-protobuf-extractor/)} - [**SoK: Are LLMs Reliable at Source Code Recovery? A Taxonomy and Empirical Evaluation**](https://arxiv.org/abs/2610.11556) - This SoK organizes LLM-assisted source-recovery designs and separates compilation, readability, structural and behavioral metrics. _{arXiv 2026 · Preprint · Varun Kohli et al. · [PDF](https://arxiv.org/pdf/2610.11556v1) · [Code](https://anonymous.4open.science/r/decompbench-65CB/) · [Full entry](https://awesomerea.org/papers/paper-sok-source-recovery-reliability/)} - [**The CodeInverter Suite: Structure- and Data-Aware Binary Decompilation with Efficient LLMs**](https://dl.acm.org/doi/10.1145/3832783.3837554) - CodeInverter studies function-level LLM decompilation using control-flow graphs and memory-to-data mappings extracted with IDA/objdump. _{ASE 2026 · Conference paper · Peipei Liu et al. · [PDF](https://arxiv.org/pdf/2503.07215v3) · [Code](https://github.com/LiuPeiP-CS/CodeInverter) · [Full entry](https://awesomerea.org/papers/paper-codeinverter-suite/)} - [**Beyond Text Matching: Towards Reference-Free Evaluation for Human-Oriented Binary Reverse Engineering**](https://dl.acm.org/doi/10.1145/3832783.3834339) - BinJudgeBench collects expert judgments for function naming, binary-code summaries and decompilation refinement. _{ASE 2026 · Conference paper · Xiuwei Shang et al. · [PDF](https://arxiv.org/pdf/2608.07038v1) · [Full entry](https://awesomerea.org/papers/paper-binjudge/)} - [**Decompiling Quantum Assembly into Structured Programs**](https://arxiv.org/abs/2610.05012) - Quelle recovers library calls, loops, functions and symbolic parameters from compiled OpenQASM. _{arXiv 2026 · Preprint · Pingchuan Ma et al. · [PDF](https://arxiv.org/pdf/2610.05012v1) · [Full entry](https://awesomerea.org/papers/paper-quelle/)} - [**ASAP: Assembly-Source Aligned Pseudocode Refinement For Binary Decompilation**](https://arxiv.org/abs/2610.06900) - ASAP aligns assembly and source representations during training, compresses assembly features into tokens, and supplies them alongside decompiler pseudocode to an LLM refiner. _{arXiv 2026 · Preprint · Yujian Zhuang et al. · [PDF](https://arxiv.org/pdf/2610.06900v1) · [Full entry](https://awesomerea.org/papers/paper-asap-decompilation/)} - [**Faultless: A Program Equivalence Technique for Validating and Evaluating Neural Decompilers**](https://arxiv.org/abs/2609.34089) - Compares neural-decompiler C output with deterministic decompilation or reference functions using symbolic execution and a specialized memory model. _{arXiv 2026 · Preprint · Luke Dramko et al. · [PDF](https://arxiv.org/pdf/2609.34089v1) · [Code](https://github.com/squaresLab/faultless) · [Full entry](https://awesomerea.org/papers/paper-faultless/)} - [**Between the Commits: Process, Error, and Claim Reliability in a Wholly AI-Authored Codebase**](https://arxiv.org/abs/2609.29744) - Studies development of the Extractor reverse-engineering tool through commits, available session logs and code-provenance tracing. _{arXiv 2026 · Preprint · Douglas Leith · [PDF](https://arxiv.org/pdf/2609.29744v1) · [Full entry](https://awesomerea.org/papers/paper-extractor-development-reliability/)} - [**Echo: Learning-based Matching Decompilation using Trusted Back Translation**](https://arxiv.org/abs/2609.18706) - Echo iteratively generates source and compiler configurations, recompiles candidates, and uses assembly differences to guide configuration search and code refinement. _{arXiv 2026 · Preprint · Jun Bi et al. · [PDF](https://arxiv.org/pdf/2609.18706v1) · [Full entry](https://awesomerea.org/papers/paper-echo-matching-decompilation/)} - [**A Memorization Floor for LLM Refinement of Decompiled Code**](https://arxiv.org/abs/2609.17236) - Studies whether LLM refinement of decompiled C recovers identifiers from input evidence or prior knowledge. _{arXiv 2026 · Preprint · Muhammad Asjad · [PDF](https://arxiv.org/pdf/2609.17236v1) · [Full entry](https://awesomerea.org/papers/paper-memorization-floor/)} - [**When LLM Decompilers Recompile More and Preserve Less**](https://arxiv.org/abs/2609.05370) - Decompile-Diverge builds function-level behavioral comparisons from source-derived drivers and fuzzed reference inputs. _{arXiv 2026 · Preprint · Chang Liu et al. · [PDF](https://arxiv.org/pdf/2609.05370v1) · [Full entry](https://awesomerea.org/papers/paper-decompile-diverge/)} - [**Decoupling is a Necessity: Transformation-Agnostic Decompiled Code Recovery under Optimization and Obfuscation**](https://arxiv.org/abs/2608.27889) - ReSource refines decompiled functions affected by compiler optimization and obfuscation. _{arXiv 2026 · Preprint · Zhiping Zhou et al. · [PDF](https://arxiv.org/pdf/2608.27889v1) · [Full entry](https://awesomerea.org/papers/paper-resource/)} - [**STILL: Recovering Lowered STL Semantics for LLM-assisted C++ Decompilation**](https://arxiv.org/abs/2608.26408) - STILL predicts function-level STL container presence from stripped control-flow graphs and turns those predictions into compact hints for LLM refinement of Ghidra output. _{arXiv 2026 · Preprint · Xiaohan Wang et al. · [PDF](https://arxiv.org/pdf/2608.26408v1) · [Full entry](https://awesomerea.org/papers/paper-still-stl/)} - [**The Evolution of Binary Decompilation in the Modern Era: A Taxonomy, Literature Review, and Future Perspectives**](https://arxiv.org/abs/2608.24955) - This survey maps traditional, dynamic, matching and neural decompilation approaches, then organizes type recovery, control-flow restructuring, naming and refinement tasks alongside evaluation metrics and benchmark choices. _{arXiv 2026 · Preprint · Omar Abusabha et al. · [PDF](https://arxiv.org/pdf/2608.24955v1) · [Full entry](https://awesomerea.org/papers/paper-evolution-binary-decompilation/)} - [**Lifting Optimized Binaries to Canonical Compiler IR via Structure-Aware Retrieval and Iterative Verification**](https://aclanthology.org/2026.acl-long.527/) - BRIDGE lifts stripped, optimized x86-64 and ARM64 functions, given as llvm-objdump disassembly, to LLVM IR. _{ACL 2026 · Conference paper · Xiaoao Zhu et al. · [PDF](https://aclanthology.org/2026.acl-long.527.pdf) · [Code](https://github.com/Azhu-c/BRIDGE-rag) · [Full entry](https://awesomerea.org/papers/paper-bridge-lifting/)} - [**Fool Me If You Can: On the Robustness of Binary Code Similarity Detection Models against Semantics-Preserving Transformations**](https://dl.acm.org/doi/10.1145/3797116) - The paper builds asmFooler to test whether learned binary code similarity detection (BCSD) models keep matching functions after semantics-preserving changes. _{Proceedings of the ACM on Software Engineering (FSE 2026) · Journal article · Jiyong Uhm et al. · [PDF](https://arxiv.org/pdf/2602.12681v1) · [Full entry](https://awesomerea.org/papers/paper-asmfooler/)} - [**MirrorCode: AI can rebuild entire programs from behavior alone**](https://arxiv.org/abs/2606.30182) - Tests reimplementation of 25 command-line programs using execute-only reference access, documentation and visible examples. _{arXiv 2026 · Preprint · Tom Adamczewski et al. · [PDF](https://arxiv.org/pdf/2606.30182v2) · [Code](https://github.com/epoch-research/MirrorCode) · [Full entry](https://awesomerea.org/papers/paper-mirrorcode/)} - [**SoK: AI-Augmented Binary Reversing**](https://arxiv.org/abs/2606.17398) - A systematization-of-knowledge survey of machine-learning, LLM and agentic approaches to binary reversing. _{arXiv 2026 · Preprint · Yujeong Kwon et al. · [PDF](https://arxiv.org/pdf/2606.17398v2) · [Full entry](https://awesomerea.org/papers/paper-sok-ai-binary-reversing/)} - [**Binary Decompilation LLM with Feedback-Driven Multi-Turn Refinement**](https://arxiv.org/abs/2606.16162) - AutoDecompiler trains function-level decompilation models to revise assembly- or pseudocode-derived outputs using compilation, execution and I/O feedback. _{arXiv 2026 · Preprint · Peipei Liu et al. · [PDF](https://arxiv.org/pdf/2606.16162v2) · [Code](https://zenodo.org/records/23120286) · [Full entry](https://awesomerea.org/papers/paper-autodecompiler/)} - [**LLM Agent-Assisted Reverse Engineering with Quantitative Readability Metrics**](https://arxiv.org/abs/2606.06838) - Uses a composite Quantitative Readability Score (QRS) to guide agents refining decompiled C. _{arXiv 2026 · Preprint · Neil Archibald et al. · [PDF](https://arxiv.org/pdf/2606.06838v1) · [Full entry](https://awesomerea.org/papers/paper-qrs-readability/)} - [**SCDBench: A Benchmark for LLM-Based Smart Contract Decompilers**](https://arxiv.org/abs/2605.29059) - Benchmarks LLM-based EVM decompilation on 600 source-verified Ethereum Solidity contracts, sampled in easy, medium and hard thirds from 772,736 unique bytecode–source pairs after near-duplicate filtering. _{arXiv 2026 · Preprint · Kaihua Qin et al. · [PDF](https://arxiv.org/pdf/2605.29059v1) · [Full entry](https://awesomerea.org/papers/paper-scdbench/)} - [**Semantic Validation of Packer Identification Tools: Characterization, Repair, and Downstream Impact**](https://arxiv.org/abs/2605.25923) - Uses unpacking outcomes as reference evidence to assess packer labels, normalizes heterogeneous tool results, and evaluates complementary signature/heuristic pools with static predicates derived from unpacker implementations. _{arXiv 2026 · Preprint · Fangtian Zhong et al. · [PDF](https://arxiv.org/pdf/2605.25923v3) · [Full entry](https://awesomerea.org/papers/paper-packer-identification-semantic-validation/)} - [**Decaf: Improving Neural Decompilation with Automatic Feedback and Search**](https://arxiv.org/abs/2605.11501) - Decaf samples multiple candidate decompilations, recompiles them and ranks them using compiler-derived byte distance or a learned reranker. _{arXiv 2026 · Preprint · Alexander Shypula et al. · [PDF](https://arxiv.org/pdf/2605.11501v1) · [Code](https://github.com/AlexShypula/decaf) · [Full entry](https://awesomerea.org/papers/paper-decaf/)} - [**NotDec: WebAssembly Decompilation With Inter-Procedural Type Recovery**](https://dl.acm.org/doi/10.1145/3744916.3787762) - NotDec lifts WebAssembly into SSA-based IR, uses Retypd-derived type constraints and pointer/value distinctions to recover structures, and emits C. _{ICSE 2026 · Conference paper · Jikai Wang et al. · [PDF](https://arxiv.org/pdf/2608.03286v1) · [Code](https://github.com/NotDec/NotDec) · [Full entry](https://awesomerea.org/papers/paper-notdec/)} - [**HELIOS: Hierarchical Graph Abstraction for Structure-Aware LLM Decompilation**](https://arxiv.org/abs/2601.14598) - HELIOS gives an LLM a hierarchical summary of binary control flow and function calls alongside decompiler output, with optional compiler feedback. _{arXiv 2026 · Preprint · Yonatan Gizachew Achamyeleh et al. · [PDF](https://arxiv.org/pdf/2601.14598) · [Full entry](https://awesomerea.org/papers/paper-helios/)} - [**The Deception Delta: Adversarial Evaluation of LLM-Based Smart Contract Bytecode Forensics**](https://arxiv.org/abs/2609.14098) - Evaluates how language models interpret raw EVM bytecode from purpose-built deceptive and control contracts. _{ACM CCS 2026 · Conference accepted · Timo Schefold · [PDF](https://arxiv.org/pdf/2609.14098v2) · [Full entry](https://awesomerea.org/papers/paper-deception-delta/)} - [**SK2Decompile: LLM-based Two-Phase Binary Decompilation from Skeleton to Skin**](https://proceedings.iclr.cc/paper_files/paper/2026/hash/9132583dd869acb0cafeb0ed25eb031a-Abstract-Conference.html) - Splits LLM decompilation into two phases: a Structure Recovery model turns decompiler pseudocode into an identifier-free IR that keeps control flow and data structures, trained with compiler-based RL rewards, and an Identifier Naming model then restores names under a semantic-similarity reward. _{ICLR 2026 · Conference paper · Hanzhuo Tan et al. · [PDF](https://proceedings.iclr.cc/paper_files/paper/2026/file/9132583dd869acb0cafeb0ed25eb031a-Paper-Conference.pdf) · [Code](https://github.com/albertan017/LLM4Decompile/tree/85b364bf093eb2ee4f3687cfe38a203fca89f23e/sk2decompile) · [Full entry](https://awesomerea.org/papers/paper-sk2decompile/)} - [**ShieldedCode: Learning Robust Representations for Virtual Machine Protected Code**](https://proceedings.iclr.cc/paper_files/paper/2026/hash/286976486c9bbfa2c2069b01b259b19d-Abstract-Conference.html) - ShieldedCode studies software protection from the defender's side: it trains code language models on pairs of C source functions and their virtualization-protected (VMP) x86-64 code so that the models can generate, compare and rank protected variants. _{ICLR 2026 · Conference paper · Mingqiao Mo et al. · [PDF](https://proceedings.iclr.cc/paper_files/paper/2026/file/286976486c9bbfa2c2069b01b259b19d-Paper-Conference.pdf) · [Full entry](https://awesomerea.org/papers/paper-shieldedcode/)} - [**Idioms: A Simple and Effective Framework for Turbo-Charging Local Neural Decompilation with Well-Defined Types**](https://www.ndss-symposium.org/ndss-paper/idioms-a-simple-and-effective-framework-for-turbo-charging-local-neural-decompilation-with-well-defined-types/) - Idioms fine-tunes code language models to turn Hex-Rays output for one target function into predicted original C together with definitions of the user-defined structs, unions and typedefs it uses. _{NDSS 2026 · Conference paper · Luke Dramko et al. · [PDF](https://www.ndss-symposium.org/wp-content/uploads/2026-f795-paper.pdf) · [Code](https://github.com/squaresLab/idioms) · [Full entry](https://awesomerea.org/papers/paper-idioms/)} - [**FidelityGPT: Correcting Decompilation Distortions with Retrieval Augmented Generation**](https://www.ndss-symposium.org/ndss-paper/fidelitygpt-correcting-decompilation-distortions-with-retrieval-augmented-generation/) - FidelityGPT post-processes existing decompiler output: an LLM labels lines with six distortion types, such as non-conventional dereferencing, redundant variables and confusing control flow, and then rewrites the labeled lines. _{NDSS 2026 · Conference paper · Zhiping Zhou et al. · [PDF](https://www.ndss-symposium.org/wp-content/uploads/2026-s989-paper.pdf) · [Code](https://github.com/ZhouZhiping045/FidelityGPT) · [Full entry](https://awesomerea.org/papers/paper-fidelitygpt/)} - [**CHISEL-ing Back Source Code with AI-enabled Iterative Recovery**](https://arxiv.org/abs/2608.27981) - CHISEL refines Ghidra pseudocode using compiler diagnostics and type-aware differential fuzzing against the original function. _{SURE @ ACM CCS 2026 · Conference accepted · Varun Kohli et al. · [PDF](https://arxiv.org/pdf/2608.27981v1) · [Code](https://github.com/VarunKohli18/chisel) · [Full entry](https://awesomerea.org/papers/paper-chisel-iterative-recovery/)} - [**REx86: A Local Large Language Model for Assisting in x86 Assembly Reverse Engineering**](https://doi.org/10.1109/ACSAC67867.2025.00024) - The paper fine-tunes eight local models from CodeLlama, Qwen2.5-Coder, and CodeGemma on 5,981 x86 assembly examples and evaluates their help with binary reverse engineering. _{2025 IEEE Annual Computer Security Applications Conference (ACSAC) · Conference paper · Darrin Lea et al. · [PDF](https://arxiv.org/pdf/2510.20975) · [Code](https://github.com/dlea8/REx86) · [Full entry](https://awesomerea.org/papers/paper-rex86/)} - [**Is This the Same Code? A Comprehensive Study of Decompilation Techniques for WebAssembly Binaries**](https://link.springer.com/chapter/10.1007/978-3-031-94448-2_6) - Measures how well existing WebAssembly decompilers recover C, with native-binary decompilers as the baseline. _{SecureComm 2024 2025 · Conference paper · Wei-Cheng Wu et al. · [PDF](https://arxiv.org/pdf/2411.02278v1) · [Full entry](https://awesomerea.org/papers/paper-wasm-decompiler-study/)} - [**BinMetric: A Comprehensive Binary Code Analysis Benchmark for Large Language Models**](https://www.ijcai.org/proceedings/2025/858) - BinMetric poses 1,000 questions across six binary-analysis tasks: call-site reconstruction, decompilation, signature recovery, binary code summarization, algorithm classification and assembly instruction generation. _{IJCAI 2025 · Conference paper · Xiuwei Shang et al. · [PDF](https://www.ijcai.org/proceedings/2025/0858.pdf) · [Full entry](https://awesomerea.org/papers/paper-binmetric/)} - [**Exploring the Potential of LLMs for Code Deobfuscation**](https://doi.org/10.1007/978-3-031-97620-9_15) - Studies LLMs as source-to-source deobfuscators for C functions protected with the Tigress obfuscator. _{DIMVA 2025 · Conference paper · David Beste et al. · [PDF](https://ndownloader.figshare.com/files/65792754) · [Code](https://github.com/DavidBeste/llm-code-deobfuscation) · [Full entry](https://awesomerea.org/papers/paper-llm-code-deobfuscation/)} - [**DecompileBench: A Comprehensive Benchmark for Evaluating Decompilers in Real-World Scenarios**](https://aclanthology.org/2025.findings-acl.1194/) - Evaluates traditional and LLM-based decompilers using functions from real programs, runtime behavioral checks, and an LLM-assisted assessment of analyst-facing code understandability. _{Findings of ACL 2025 · Conference paper · Zeyu Gao et al. · [PDF](https://aclanthology.org/2025.findings-acl.1194.pdf) · [Code](https://github.com/vul337/DecompileBench) · [Full entry](https://awesomerea.org/papers/paper-decompilebench/)} - [**Decompiling Smart Contracts with a Large Language Model**](https://arxiv.org/abs/2506.19624) - Converts Ethereum Virtual Machine bytecode into Solidity in two stages. _{arXiv 2025 · Preprint · Isaac David et al. · [PDF](https://arxiv.org/pdf/2506.19624v1) · [Full entry](https://awesomerea.org/papers/paper-llm-evm-decompiler/)} - [**DecLLM: LLM-Augmented Recompilable Decompilation for Enabling Programmatic Use of Decompiled Code**](https://dl.acm.org/doi/10.1145/3728958) - DecLLM repairs decompiler pseudocode that does not recompile into C that compiles and runs, so source-level tools such as CodeQL can be applied to binaries. _{Proceedings of the ACM on Software Engineering (ISSTA 2025) · Journal article · Wai Kin Wong et al. · [PDF](https://dl.acm.org/doi/pdf/10.1145/3728958) · [Full entry](https://awesomerea.org/papers/paper-decllm/)} - [**DiSCo: Towards Decompiling EVM Bytecode to Source Code using Large Language Models**](https://dl.acm.org/doi/10.1145/3729373) - DiSCo lifts Ethereum contract creation bytecode to Solidity source by prompting a frozen LLM, instead of emitting decompiler pseudocode. _{Proceedings of the ACM on Software Engineering (FSE 2025) · Journal article · Xing Su et al. · [PDF](https://dl.acm.org/doi/pdf/10.1145/3729373) · [Full entry](https://awesomerea.org/papers/paper-disco/)} - [**D-LiFT: Improving LLM-based Decompiler Backend via Code Quality-driven Fine-tuning**](https://arxiv.org/abs/2506.10125) - D-LIFT uses D-Score to guide LLM fine-tuning and output selection, improving decompiled code while prioritizing accuracy. _{arXiv 2025 · Preprint · Muqi Zou et al. · [PDF](https://arxiv.org/pdf/2506.10125) · [Full entry](https://awesomerea.org/papers/paper-d-lift/)} - [**ReF Decompile: Relabeling and Function Call Enhanced Decompile**](https://arxiv.org/abs/2502.12221) - ReF Decompile relabels jump targets and uses function calls to recover variable information when converting binary code to source code. _{arXiv 2025 · Preprint · Yunlong Feng et al. · [PDF](https://arxiv.org/pdf/2502.12221) · [Full entry](https://awesomerea.org/papers/paper-ref-decompile/)} - [**Unleashing the Power of Generative Model in Recovering Variable Names from Stripped Binary**](https://www.ndss-symposium.org/ndss-paper/unleashing-the-power-of-generative-model-in-recovering-variable-names-from-stripped-binary/) - GenNm suggests names for placeholder variables in decompiled code of stripped binaries by fine-tuning generative code models (CodeGemma-2B by default; CodeLlama-7B and a LoRA-tuned CodeLlama-34B are also tested). _{NDSS 2025 · Conference paper · Xiangzhe Xu et al. · [PDF](https://www.ndss-symposium.org/wp-content/uploads/2025-276-paper.pdf) · [Code](https://github.com/XZ-X/gennm-ndss-ae/tree/9955139b4c8d43144852a674bf317cbfaf32ed17) · [Full entry](https://awesomerea.org/papers/paper-gennm/)} - [**TypeForge: Synthesizing and Selecting Best-Fit Composite Data Types for Stripped Binaries**](https://ieeexplore.ieee.org/document/11023499) - TypeForge recovers composite data types, including struct layouts, unions and pointer or nesting relationships, from stripped binaries. _{IEEE S&P 2025 · Conference paper · Yanzhong Wang et al. · [PDF](https://noobone123.github.io/papers/typeforge-sp25.pdf) · [Code](https://github.com/noobone123/TypeForge) · [Full entry](https://awesomerea.org/papers/paper-typeforge/)} - [**Nova: Generative Language Models for Assembly Code with Hierarchical Attention and Contrastive Learning**](https://proceedings.iclr.cc/paper_files/paper/2025/hash/ef283d62b4bce30854a8d4827f331229-Abstract-Conference.html) - Nova is a generative LLM for x86-64 assembly, trained from DeepSeek-Coder checkpoints on stripped, normalized gcc -O0 to -O3 assembly built from AnghaBench and The Stack. _{ICLR 2025 · Conference paper · Nan Jiang et al. · [PDF](https://proceedings.iclr.cc/paper_files/paper/2025/file/ef283d62b4bce30854a8d4827f331229-Paper-Conference.pdf) · [Code](https://github.com/lt-asset/nova/tree/6dfaf438fb23a8f024d0297653571615631ad8f4) · [Full entry](https://awesomerea.org/papers/paper-nova/)} - [**Malsight: Exploring Malicious Source Code and Benign Pseudocode for Iterative Binary Malware Summarization**](https://doi.org/10.1109/TIFS.2025.3583552) - MALSIGHT writes natural-language summaries of stripped binary malware one function at a time. _{IEEE Transactions on Information Forensics and Security 2025 · Journal article · Haolang Lu et al. · [PDF](https://arxiv.org/pdf/2406.18379v3) · [Full entry](https://awesomerea.org/papers/paper-malsight/)} - [**Lares: LLM-driven Code Slice Semantic Search for Patch Presence Testing**](https://ieeexplore.ieee.org/document/11334274) - Lares tests whether a known 1-day vulnerability fix is present in a target binary function without recompiling the project. _{ASE 2025 · Conference paper · Siyuan Li et al. · [PDF](https://arxiv.org/pdf/2511.01252v1) · [Code](https://github.com/Siyuan-Li201/Lares) · [Full entry](https://awesomerea.org/papers/paper-lares/)} - [**Decompile-Bench: Million-Scale Binary-Source Function Pairs for Real-World Binary Decompilation**](https://papers.nips.cc/paper_files/paper/2025/hash/079cf13ae174c31f148207d94d213bdc-Abstract-Datasets_and_Benchmarks_Track.html) - Introduces two million C/C++ binary-source function pairs using a Compile-Trace-Filter pipeline, with an evaluation suite spanning translated HumanEval/MBPP tasks and recent GitHub functions. _{NeurIPS 2025 Datasets and Benchmarks · Conference paper · Hanzhuo Tan et al. · [PDF](https://papers.nips.cc/paper_files/paper/2025/file/079cf13ae174c31f148207d94d213bdc-Paper-Datasets_and_Benchmarks_Track.pdf) · [Code](https://github.com/albertan017/LLM4Decompile) · [Full entry](https://awesomerea.org/papers/paper-decompile-bench/)} - [**Beyond Classification: Inferring Function Names in Stripped Binaries via Domain Adapted LLMs**](https://www.ndss-symposium.org/ndss-paper/beyond-classification-inferring-function-names-in-stripped-binaries-via-domain-adapted-llms/) - SymGen infers function names for stripped binaries by generating them with a LoRA-fine-tuned Code Llama model instead of classifying over a fixed name vocabulary. _{NDSS 2025 · Conference paper · Linxi Jiang et al. · [PDF](https://www.ndss-symposium.org/wp-content/uploads/2025-797-paper.pdf) · [Code](https://github.com/OSUSecLab/SymGen) · [Full entry](https://awesomerea.org/papers/paper-symgen/)} - [**ReSym: Harnessing LLMs to Recover Variable and Data Structure Symbols from Stripped Binaries**](https://doi.org/10.1145/3658644.3670340) - Combines two fine-tuned language models with Prolog-based cross-function reasoning to infer local-variable symbols and user-defined data structures from stripped-binary decompilation. _{ACM CCS 2024 · Conference paper · Danning Xie et al. · [PDF](https://www.cs.purdue.edu/homes/lintan/publications/resym-ccs24.pdf) · [Code](https://github.com/lt-asset/resym) · [Full entry](https://awesomerea.org/papers/paper-resym/)} - [**Self-Constructed Context Decompilation with Fined-grained Alignment Enhancement**](https://aclanthology.org/2024.findings-emnlp.385/) - Adds two techniques to LLM decompilation of function-level x86-64 GCC assembly into C. _{Findings of EMNLP 2024 · Conference paper · Yunlong Feng et al. · [PDF](https://aclanthology.org/2024.findings-emnlp.385.pdf) · [Code](https://github.com/AlongWY/sccdec) · [Full entry](https://awesomerea.org/papers/paper-sc2dec/)} - [**LLM4Decompile: Decompiling Binary Code with Large Language Models**](https://aclanthology.org/2024.emnlp-main.203/) - Trains language models for assembly-to-C decompilation and for refining Ghidra pseudocode, evaluating whether recovered functions can be recompiled and executed correctly. _{EMNLP 2024 · Conference paper · Hanzhuo Tan et al. · [PDF](https://aclanthology.org/2024.emnlp-main.203.pdf) · [Code](https://github.com/albertan017/LLM4Decompile) · [Full entry](https://awesomerea.org/papers/paper-llm4decompile/)} - [**WaDec: Decompiling WebAssembly Using Large Language Model**](https://dl.acm.org/doi/10.1145/3691620.3695020) - WaDec decompiles WebAssembly text (wat) into C by fine-tuning CodeLlama-7b with LoRA on loop-level wat–C snippet pairs. _{ASE 2024 · Conference paper · Xinyu She et al. · [PDF](https://arxiv.org/pdf/2406.11346v3) · [Code](https://github.com/XinyuShe/WaDec/tree/e244f7172539478a5b64bbb86e1fd03e527cb6be) · [Full entry](https://awesomerea.org/papers/paper-wadec/)} - [**How Far Have We Gone in Binary Code Understanding Using Large Language Models**](https://ieeexplore.ieee.org/document/10795058) - Benchmarks 16 code and general LLMs on function name recovery and summarization of stripped binaries. _{ICSME 2024 · Conference paper · Xiuwei Shang et al. · [PDF](https://arxiv.org/pdf/2404.09836v3) · [Full entry](https://awesomerea.org/papers/paper-llm-binary-understanding/)} - [**CLAP: Learning Transferable Binary Code Representations with Natural Language Supervision**](https://dl.acm.org/doi/10.1145/3650212.3652145) - CLAP (Contrastive Language-Assembly Pre-training) learns assembly-function embeddings aligned with natural-language explanations. _{ACM ISSTA 2024 · Conference paper · Hao Wang et al. · [PDF](https://arxiv.org/pdf/2402.16928v1) · [Code](https://github.com/Hustcw/CLAP) · [Full entry](https://awesomerea.org/papers/paper-clap/)} - [**TYGR: Type Inference on Stripped Binaries using Graph Neural Networks**](https://www.usenix.org/conference/usenixsecurity24/presentation/zhu-chang) - TYGR infers the types of stack and heap variables in stripped binaries by running an architecture-agnostic, intra-procedural data-flow analysis on angr's VEX IR and classifying each variable's data-flow graph with a graph neural network. _{USENIX Security 2024 · Conference paper · Chang Zhu et al. · [PDF](https://www.usenix.org/system/files/usenixsecurity24-zhu-chang.pdf) · [Code](https://github.com/sefcom/TYGR) · [Full entry](https://awesomerea.org/papers/paper-tygr/)} - [**D-Helix: A Generic Decompiler Testing Framework Using Symbolic Differentiation**](https://www.usenix.org/conference/usenixsecurity24/presentation/zou) - Tests decompilers function by function on binaries without needing source code. _{USENIX Security 2024 · Conference paper · Muqi Zou et al. · [PDF](https://www.usenix.org/system/files/usenixsecurity24-zou.pdf) · [Code](https://github.com/purseclab/D-helix) · [Full entry](https://awesomerea.org/papers/paper-d-helix/)} - [**Code is not Natural Language: Unlock the Power of Semantics-Oriented Graph Representation for Binary Code Similarity Detection**](https://www.usenix.org/conference/usenixsecurity24/presentation/he-haojie) - HermesSim detects binary code similarity by lifting each function to Ghidra P-code and building a semantics-oriented graph that exposes operand structure inside instructions, def-use, control-flow and effect-order relations, while dropping semantics-independent details such as which register temporarily holds a value. _{USENIX Security 2024 · Conference paper · Haojie He et al. · [PDF](https://www.usenix.org/system/files/usenixsecurity24-he-haojie.pdf) · [Code](https://github.com/NSSL-SJTU/HermesSim) · [Full entry](https://awesomerea.org/papers/paper-hermessim/)} - [**A Taxonomy of C Decompiler Fidelity Issues**](https://www.usenix.org/conference/usenixsecurity24/presentation/dramko) - Open-codes decompiled/original C function pairs to classify how decompiler output departs from the source beyond missing names and types. _{USENIX Security 2024 · Conference paper · Luke Dramko et al. · [PDF](https://www.usenix.org/system/files/usenixsecurity24-dramko.pdf) · [Full entry](https://awesomerea.org/papers/paper-decompiler-fidelity-taxonomy/)} - [**CodeArt: Better Code Models by Attention Regularization When Symbols Are Lacking**](https://dl.acm.org/doi/10.1145/3643752) - CodeArt pre-trains a BERT-sized encoder from scratch on 26 million stripped x86-64 functions built from jTrans's BinaryCorp. _{Proceedings of the ACM on Software Engineering (FSE 2024) · Journal article · Zian Su et al. · [PDF](https://arxiv.org/pdf/2402.11842v1) · [Code](https://github.com/ziansu/codeart) · [Full entry](https://awesomerea.org/papers/paper-codeart/)} - [**StackSight: Unveiling WebAssembly through Large Language Models and Neurosymbolic Chain-of-Thought Decompilation**](https://proceedings.mlr.press/v235/fang24e.html) - StackSight decompiles WebAssembly text-format functions into C++ with LLM prompting. _{ICML 2024 · Conference paper · Weike Fang et al. · [PDF](https://raw.githubusercontent.com/mlresearch/v235/main/assets/fang24e/fang24e.pdf) · [Full entry](https://awesomerea.org/papers/paper-stacksight/)} - [**STRIDE: Simple Type Recognition In Decompiled Executables**](https://arxiv.org/abs/2407.02733) - STRIDE predicts the names and types of variables in decompiler output without a neural model. _{arXiv 2024 · Preprint · Harrison Green et al. · [PDF](https://arxiv.org/pdf/2407.02733v1) · [Code](https://github.com/hgarrereyn/STRIDE) · [Full entry](https://awesomerea.org/papers/paper-stride/)} - [**Exploring the Efficacy of Large Language Models (GPT-4) in Binary Reverse Engineering**](https://arxiv.org/abs/2406.06637) - The paper evaluates GPT-4 for binary reverse engineering through interpretation of human-written and decompiled code, from basic code explanation to malware analysis. _{arXiv 2024 · Preprint · Saman Pordanesh et al. · [PDF](https://arxiv.org/pdf/2406.06637) · [Full entry](https://awesomerea.org/papers/paper-gpt4-binary-re/)} - [**Assessing LLMs in Malicious Code Deobfuscation of Real-world Malware Campaigns**](https://arxiv.org/abs/2404.19715) - The paper evaluates four LLMs on deobfuscating real-world malicious scripts from the Emotet malware campaign and examines their use in reverse engineering. _{arXiv 2024 · Preprint · Constantinos Patsakis et al. · [PDF](https://arxiv.org/pdf/2404.19715) · [Full entry](https://awesomerea.org/papers/paper-llm-malware-deobfuscation/)} - [**Cross-Inlining Binary Function Similarity Detection**](https://dl.acm.org/doi/10.1145/3597503.3639080) - Studies binary function similarity when function inlining makes one binary function correspond to several source functions. _{ICSE 2024 · Conference paper · Ang Jia et al. · [PDF](https://arxiv.org/pdf/2401.05739v1) · [Code](https://github.com/island255/cross-inlining_binary_function_similarity) · [Full entry](https://awesomerea.org/papers/paper-cross-inlining-bfsd/)} - [**BinaryAI: Binary Software Composition Analysis via Intelligent Binary Source Code Matching**](https://dl.acm.org/doi/10.1145/3597503.3639100) - BinaryAI identifies which open-source C/C++ libraries a stripped binary reuses by matching its functions to source code. _{ICSE 2024 · Conference paper · Ling Jiang et al. · [PDF](https://arxiv.org/pdf/2401.11161v3) · [Full entry](https://awesomerea.org/papers/paper-binaryai/)} - [**FoC: Figure out the Cryptographic Functions in Stripped Binaries with LLMs**](https://arxiv.org/abs/2403.18403) - FoC uses FoC-BinLLM to summarize cryptographic functions in stripped binaries and FoC-Sim to retrieve similar implementations. _{arXiv 2024 · Preprint · Xiuwei Shang et al. · [PDF](https://arxiv.org/pdf/2403.18403) · [Full entry](https://awesomerea.org/papers/paper-foc/)} - [**SLaDe: A Portable Small Language Model Decompiler for Optimized Assembly**](https://ieeexplore.ieee.org/document/10444788) - SLaDe translates function-level assembly into C with a 200M-parameter encoder–decoder model, code-specific tokenization and PsycheC type completion. _{IEEE/ACM CGO 2024 · Conference paper · Jordi Armengol-Estapé et al. · [PDF](https://arxiv.org/pdf/2305.12520v3) · [Code](https://zenodo.org/records/10205121) · [Full entry](https://awesomerea.org/papers/paper-slade/)} - [**CEBin: A Cost-Effective Framework for Large-Scale Binary Code Similarity Detection**](https://arxiv.org/abs/2402.18818) - CEBin combines code embeddings to shortlist candidate functions with pairwise comparison to detect similar binary code, including vulnerable functions. _{arXiv 2024 · Preprint · Hao Wang et al. · [PDF](https://arxiv.org/pdf/2402.18818) · [Code](https://github.com/Hustcw/CEBin) · [Full entry](https://awesomerea.org/papers/paper-cebin/)} - [**“Len or index or count, anything but v1”: Predicting Variable Names in Decompilation Output with Transfer Learning**](https://ieeexplore.ieee.org/document/10646727) - VarBERT suggests variable names for IDA Hex-Rays and Ghidra decompiler output with a BERT-style model pre-trained on 5.2M human-written C functions from Debian and fine-tuned on decompiled code; it also predicts whether each variable came from the developer or was introduced by the decompiler. _{IEEE S&P 2024 · Conference paper · Kuntal Kumar Pal et al. · [PDF](https://www.atipriya.com/files/papers/varbert_oakland24.pdf) · [Code](https://github.com/sefcom/VarBERT/tree/76f221a5e0af43a36169818cbbfd6e8dd3c98cdc) · [Full entry](https://awesomerea.org/papers/paper-varbert/)} - [**DeGPT: Optimizing Decompiler Output with LLM**](https://www.ndss-symposium.org/ndss-paper/degpt-optimizing-decompiler-output-with-llm/) - Refines existing C-like decompiler output through three coordinated roles that select, propose and check changes. _{NDSS 2024 · Conference paper · Peiwei Hu et al. · [PDF](https://www.ndss-symposium.org/wp-content/uploads/2024-401-paper.pdf) · [Code](https://github.com/PeiweiHu/DeGPT) · [Full entry](https://awesomerea.org/papers/paper-degpt/)} - [**Assemblage: Automatic Binary Dataset Construction for Machine Learning**](https://proceedings.neurips.cc/paper_files/paper/2024/hash/6bbefc73a187dd42e0dc065b4e7a0615-Abstract-Datasets_and_Benchmarks_Track.html) - Assemblage is a distributed system that crawls GitHub and vcpkg, builds C/C++ projects under many compiler configurations, and records source-to-binary mappings such as function addresses, source code, comments and PDB or DWARF debug information. _{NeurIPS 2024 Datasets and Benchmarks · Conference paper · Chang Liu et al. · [PDF](https://proceedings.neurips.cc/paper_files/paper/2024/file/6bbefc73a187dd42e0dc065b4e7a0615-Paper-Datasets_and_Benchmarks_Track.pdf) · [Code](https://github.com/Assemblage-Dataset/Assemblage) · [Full entry](https://awesomerea.org/papers/paper-assemblage/)} - [**Binary Code Summarization: Benchmarking ChatGPT/GPT-4 and Other Large Language Models**](https://arxiv.org/abs/2312.09601) - BinSum benchmarks LLMs on summarizing binary functions in natural language. _{arXiv 2023 · Preprint · Xin Jin et al. · [PDF](https://arxiv.org/pdf/2312.09601v1) · [Full entry](https://awesomerea.org/papers/paper-binsum/)} - [**Refining Decompiled C Code with Large Language Models**](https://arxiv.org/abs/2310.06530) - The paper proposes a two-step hybrid LLM approach to refine IDA-Pro decompiled C code for recompilation. _{arXiv 2023 · Preprint · Wai Kin Wong et al. · [PDF](https://arxiv.org/pdf/2310.06530) · [Full entry](https://awesomerea.org/papers/paper-dec-gpt/)} - [**kTrans: Knowledge-Aware Transformer for Binary Code Embedding**](https://arxiv.org/abs/2308.12659) - kTrans uses a knowledge-aware Transformer to embed binary code. _{arXiv 2023 · Preprint · Wenyu Zhu et al. · [PDF](https://arxiv.org/pdf/2308.12659) · [Code](https://github.com/Learner0x5a/kTrans-release) · [Full entry](https://awesomerea.org/papers/paper-ktrans/)} - [**Decompiling x86 Deep Neural Network Executables**](https://www.usenix.org/conference/usenixsecurity23/presentation/liu-zhibo) - BTD (Bin to DNN) decompiles stripped 64-bit x86 executables emitted by deep-learning compilers into model specifications: operator types, network topology, dimensions and parameters. _{USENIX Security 2023 · Conference paper · Zhibo Liu et al. · [PDF](https://www.usenix.org/system/files/usenixsecurity23-liu-zhibo.pdf) · [Code](https://github.com/monkbai/DNN-decompiler/tree/33227a0b34f87c490efc734d667ac56530f5074a) · [Full entry](https://awesomerea.org/papers/paper-btd/)} - [**XFL: Naming Functions in Binaries with Extreme Multi-label Learning**](https://ieeexplore.ieee.org/document/10179439) - XFL treats function naming in stripped binaries as extreme multi-label classification: names are split into tokens, and PfastreXML ranks which tokens from a vocabulary of frequent labels fit each function. _{IEEE S&P 2023 · Conference paper · James Patrick-Evans et al. · [PDF](https://arxiv.org/pdf/2107.13404v4) · [Code](https://github.com/lmu-plai/xfl) · [Full entry](https://awesomerea.org/papers/paper-xfl/)} - [**Revisiting Binary Code Similarity Analysis Using Interpretable Feature Engineering and Lessons Learned**](https://doi.org/10.1109/TSE.2022.3187689) - Builds BinKit, a reproducible cross-compilation benchmark of 243,128 binaries and 36,256,322 functions from 51 GNU packages, covering 1,352 combinations of eight architectures, nine GCC and Clang versions, five optimization levels, and PIE, LTO, no-inline and Obfuscator-LLVM options. _{IEEE Transactions on Software Engineering 2023 · Journal article · Dongkwan Kim et al. · [PDF](https://arxiv.org/pdf/2011.10749v4) · [Code](https://github.com/SoftSec-KAIST/BinKit) · [Full entry](https://awesomerea.org/papers/paper-binkit/)} - [**Asteria-Pro: Enhancing Deep-Learning Based Binary Code Similarity Detection by Incorporating Domain Knowledge**](https://arxiv.org/abs/2301.00511) - Asteria-Pro adds domain-knowledge pre-filtration and re-ranking to Tree-LSTM-based binary code similarity detection. _{arXiv 2023 · Preprint · Shouguo Yang et al. · [PDF](https://arxiv.org/pdf/2301.00511) · [Full entry](https://awesomerea.org/papers/paper-asteria-pro/)} - [**SymLM: Predicting Function Names in Stripped Binaries via Context-Sensitive Execution-Aware Code Embeddings**](https://dl.acm.org/doi/10.1145/3548606.3560612) - SymLM predicts function names for stripped binaries as sets of name words. _{ACM CCS 2022 · Conference paper · Xin Jin et al. · [PDF](https://xinjin95.github.io/assets/pdf/SymLM_ccs2022_paper.pdf) · [Code](https://github.com/OSUSecLab/SymLM) · [Full entry](https://awesomerea.org/papers/paper-symlm/)} - [**How Machine Learning Is Solving the Binary Function Similarity Problem**](https://www.usenix.org/conference/usenixsecurity22/presentation/marcelli) - Measures binary function similarity research by re-implementing ten representative approaches from the security, programming-language and machine-learning communities in one IDA Pro-based framework, from fuzzy hashing (Catalog1, FunctionSimSearch) to graph neural network, NLP-encoder and transformer models. _{USENIX Security 2022 · Conference paper · Andrea Marcelli et al. · [PDF](https://www.usenix.org/system/files/sec22-marcelli.pdf) · [Code](https://github.com/Cisco-Talos/binary_function_similarity) · [Full entry](https://awesomerea.org/papers/paper-binary-function-similarity/)} - [**DeepDi: Learning a Relational Graph Convolutional Network Model on Instructions for Fast and Accurate Disassembly**](https://www.usenix.org/conference/usenixsecurity22/presentation/yu-sheng) - DeepDi disassembles x86 and x64 binaries by decoding a superset of candidate instructions, linking them in an Instruction Flow Graph of forward, backward and overlap relations, and classifying true instructions with a Relational Graph Convolutional Network; heuristics and a small classifier then recover function entry points. _{USENIX Security 2022 · Conference paper · Sheng Yu et al. · [PDF](https://www.usenix.org/system/files/sec22-yu-sheng.pdf) · [Code](https://github.com/DeepBitsTechnology/DeepDi) · [Full entry](https://awesomerea.org/papers/paper-deepdi/)} - [**Decomperson: How Humans Decompile and What We Can Learn From It**](https://www.usenix.org/conference/usenixsecurity22/presentation/burk) - Reframes manual reverse engineering as perfect decompilation: writing source that, compiled with the original toolchain and options, reproduces the target functions’ binary code exactly. _{USENIX Security 2022 · Conference paper · Kevin Burk et al. · [PDF](https://www.usenix.org/system/files/sec22-burk.pdf) · [Code](https://github.com/decompetition/server) · [Full entry](https://awesomerea.org/papers/paper-decomperson/)} - [**Augmenting Decompiler Output with Learned Variable Names and Types**](https://www.usenix.org/conference/usenixsecurity22/presentation/chen-qibin) - Introduces DIRTY, a Transformer model that recommends variable names and types from decompiled code and layout information, together with the DIRT corpus for training and evaluation. _{USENIX Security 2022 · Conference paper · Qibin Chen et al. · [PDF](https://arxiv.org/pdf/2108.06363) · [Code](https://github.com/CMUSTRUDEL/DIRTY) · [Full entry](https://awesomerea.org/papers/paper-dirty/)} - [**jTrans: Jump-Aware Transformer for Binary Code Similarity Detection**](https://dl.acm.org/doi/10.1145/3533767.3534367) - jTrans embeds binary functions for similarity search with a BERT-style Transformer. _{ACM ISSTA 2022 · Conference paper · Hao Wang et al. · [PDF](https://arxiv.org/pdf/2205.12713v1) · [Code](https://github.com/vul337/jTrans) · [Full entry](https://awesomerea.org/papers/paper-jtrans/)} - [**ExeBench: an ML-scale dataset of executable C functions**](https://dl.acm.org/doi/10.1145/3520312.3534867) - ExeBench is a dataset, not a decompiler. _{ACM SIGPLAN MAPS 2022 · Conference paper · Jordi Armengol-Estapé et al. · [PDF](https://dl.acm.org/doi/pdf/10.1145/3520312.3534867) · [Code](https://github.com/jordiae/exebench/tree/8b47d483c2e39ea40a304fbaac46e41a1a14272f) · [Full entry](https://awesomerea.org/papers/paper-exebench/)} - [**Elipmoc: Advanced Decompilation of Ethereum Smart Contracts**](https://dl.acm.org/doi/10.1145/3527321) - Elipmoc decompiles Ethereum Virtual Machine bytecode into a structured three-address intermediate representation for security analyses and reverse engineering. _{Proceedings of the ACM on Programming Languages (OOPSLA 2022) · Journal article · Neville Grech et al. · [PDF](https://yanniss.github.io/elipmoc-oopsla22.pdf) · [Code](https://github.com/nevillegrech/gigahorse-toolchain) · [Full entry](https://awesomerea.org/papers/paper-elipmoc/)} - [**Pop Quiz! Can a Large Language Model Help With Reverse Engineering?**](https://arxiv.org/abs/2202.01142) - Tests whether OpenAI’s Codex model code-davinci-001 can answer reverse-engineering questions about C code in a zero-shot question-and-answer prompt. _{arXiv 2022 · Preprint · Hammond Pearce et al. · [PDF](https://arxiv.org/pdf/2202.01142v1) · [Full entry](https://awesomerea.org/papers/paper-pop-quiz-llm-re/)} - [**Beyond the C: Retargetable Decompilation using Neural Machine Translation**](https://www.ndss-symposium.org/ndss-paper/auto-draft-298/) - BTC (Beyond The C) treats decompilation as plain-text translation from compiler-emitted x86-64 assembly to source code. _{Workshop on Binary Analysis Research (BAR) 2022 · Conference paper · Iman Hosseini et al. · [PDF](https://www.ndss-symposium.org/wp-content/uploads/bar2022_23009_paper.pdf) · [Code](https://figshare.com/s/2c68b9c181e80f4e3b06) · [Full entry](https://awesomerea.org/papers/paper-beyond-the-c/)} - [**Asteria: Deep Learning-based AST-Encoding for Cross-platform Binary Code Similarity Detection**](https://doi.org/10.1109/DSN48987.2021.00036) - ASTERIA uses a Tree-LSTM to encode function ASTs and compare binary functions across platforms. _{2021 51st Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN) · Conference paper · Shouguo Yang et al. · [PDF](https://arxiv.org/pdf/2108.06082) · [Full entry](https://awesomerea.org/papers/paper-asteria/)} - [**Trex: Learning Execution Semantics from Micro-Traces for Binary Similarity**](https://arxiv.org/abs/2012.08680) - Trex learns execution semantics from function micro-traces, then uses that knowledge to match semantically similar binary functions. _{arXiv 2020 · Preprint · Kexin Pei et al. · [PDF](https://arxiv.org/pdf/2012.08680) · [Full entry](https://awesomerea.org/papers/paper-trex/)} - [**Neural reverse engineering of stripped binaries using augmented control flow graphs**](https://dl.acm.org/doi/10.1145/3428293) - Nero predicts names for procedures in stripped x86-64 Linux executables; it does not produce decompiled code. _{Proceedings of the ACM on Programming Languages (OOPSLA 2020) · Journal article · Yaniv David et al. · [PDF](https://arxiv.org/pdf/1902.09122v4) · [Code](https://github.com/tech-srl/Nero/tree/7dac9f5748974ea8f39b5f29bb3c7d33f971077e) · [Full entry](https://awesomerea.org/papers/paper-nero/)} - [**How far we have come: testing decompilation correctness of C decompilers**](https://dl.acm.org/doi/10.1145/3395363.3397370) - Tests whether C decompilers preserve program behavior. _{ACM ISSTA 2020 · Conference paper · Zhibo Liu et al. · [PDF](https://dl.acm.org/doi/pdf/10.1145/3395363.3397370) · [Code](https://github.com/monkbai/DecFuzzer) · [Full entry](https://awesomerea.org/papers/paper-decfuzzer/)} - [**Binary Rewriting without Control Flow Recovery**](https://dl.acm.org/doi/10.1145/3385412.3385972) - E9Patch statically rewrites x86-64 binaries by inserting jumps to trampolines without moving any other instruction, so the original set of jump targets is preserved and control-flow recovery, symbolization and debug information are not needed. _{PLDI 2020 · Conference paper · Gregory J. Duck et al. · [PDF](https://comp.nus.edu.sg/~gregory/papers/e9patch.pdf) · [Code](https://github.com/GJDuck/e9patch) · [Full entry](https://awesomerea.org/papers/paper-e9patch/)} - [**RetroWrite: Statically Instrumenting COTS Binaries for Fuzzing and Sanitization**](https://ieeexplore.ieee.org/document/9152762) - RetroWrite statically rewrites 64-bit position-independent Linux binaries by generating reassembleable assembly, so instrumentation can be inserted as if at compile time. _{IEEE S&P 2020 · Conference paper · Sushant Dinesh et al. · [PDF](https://hexhive.epfl.ch/publications/files/20Oakland.pdf) · [Code](https://github.com/HexHive/retrowrite) · [Full entry](https://awesomerea.org/papers/paper-retrowrite/)} - [**BinRec: Dynamic Binary Lifting and Recompilation**](https://dl.acm.org/doi/10.1145/3342195.3387550) - BinRec lifts an executable to LLVM IR from dynamic traces instead of static disassembly, then lowers the IR back to a recovered binary, so compiler passes can optimize, harden or otherwise transform it. _{EuroSys 2020 · Conference paper · Anil Altinay et al. · [PDF](https://download.vusec.net/papers/binrec_eurosys20.pdf) · [Code](https://github.com/trailofbits/binrec-tob) · [Full entry](https://awesomerea.org/papers/paper-binrec/)} - [**Towards usable automated detection of CPU architecture and endianness for arbitrary binary files and object code sequences**](https://doi.org/10.1145/3374664.3375742) - The paper builds open datasets and tools to identify CPU architecture and endianness in binary files and object code. _{Proceedings of the Tenth ACM Conference on Data and Application Security and Privacy 2020 · Conference paper · Sami Kairajärvi et al. · [PDF](https://arxiv.org/pdf/1908.05459) · [Full entry](https://awesomerea.org/papers/paper-isadetect/)} - [**Egalito: Layout-Agnostic Binary Recompilation**](https://dl.acm.org/doi/10.1145/3373376.3378470) - Egalito statically recompiles stripped x86-64 and ARM64 binaries, using the metadata that position-independent executables and libraries carry to recover a complete disassembly in which every code and data cross-reference becomes an explicit link. _{ASPLOS 2020 · Conference paper · David Williams-King et al. · [PDF](https://www.cs.columbia.edu/~junfeng/papers/egalito-asplos20.pdf) · [Code](https://github.com/columbia/egalito) · [Full entry](https://awesomerea.org/papers/paper-egalito/)} - [**DIRE: A Neural Approach to Decompiled Identifier Naming**](https://doi.org/10.1109/ASE.2019.00064) - Combines lexical and structural information from decompiler output to predict meaningful variable names, with a training and evaluation corpus derived from compiled C projects. _{ASE 2019 · Conference paper · Jeremy Lacomis et al. · [PDF](https://arxiv.org/pdf/1909.09029) · [Code](https://github.com/pcyin/dire) · [Full entry](https://awesomerea.org/papers/paper-dire/)} - [**Manticore: A User-Friendly Symbolic Execution Framework for Binaries and Smart Contracts**](https://arxiv.org/abs/1907.03890) - Manticore uses dynamic symbolic execution to analyze binaries and Ethereum smart contracts. _{arXiv 2019 · Preprint · Mark Mossberg et al. · [PDF](https://arxiv.org/pdf/1907.03890) · [Full entry](https://awesomerea.org/papers/paper-manticore/)} - [**InternalBlue - Bluetooth Binary Patching and Experimentation Framework**](https://doi.org/10.1145/3307334.3326089) - The paper reverse engineers Broadcom Bluetooth controllers and presents InternalBlue for patching their firmware. _{Proceedings of the 17th Annual International Conference on Mobile Systems, Applications, and Services 2019 · Conference paper · Dennis Mantz et al. · [PDF](https://arxiv.org/pdf/1905.00631) · [Full entry](https://awesomerea.org/papers/paper-internalblue/)} - [**Towards Neural Decompilation**](https://arxiv.org/abs/1905.08325) - The paper trains a neural machine translation decompiler using a compiler. _{arXiv 2019 · Preprint · Omer Katz et al. · [PDF](https://arxiv.org/pdf/1905.08325) · [Full entry](https://awesomerea.org/papers/paper-neural-decompilation/)} - [**ICSREF: A Framework for Automated Reverse Engineering of Industrial Control Systems Binaries**](https://doi.org/10.14722/ndss.2019.23271) - ICSREF automates reverse engineering of PLC binaries compiled with CODESYS. _{Proceedings 2019 Network and Distributed System Security Symposium · Conference paper · Anastasis Keliris et al. · [PDF](https://arxiv.org/pdf/1812.03478) · [Full entry](https://awesomerea.org/papers/paper-icsref/)} - [**Coda: An End-to-End Neural Program Decompiler**](https://proceedings.neurips.cc/paper_files/paper/2019/hash/093b60fd0557804c8ba0cbf1453da22f-Abstract.html) - Coda decompiles the assembly of short functions into C in two phases. _{NeurIPS 2019 · Conference paper · Cheng Fu et al. · [PDF](https://proceedings.neurips.cc/paper_files/paper/2019/file/093b60fd0557804c8ba0cbf1453da22f-Paper.pdf) · [Full entry](https://awesomerea.org/papers/paper-coda/)} - [**A Cross-Architecture Instruction Embedding Model for Natural Language Processing-Inspired Binary Code Analysis**](https://arxiv.org/abs/1812.09652) - The paper learns instruction embeddings that capture semantic relationships within and across architectures. _{arXiv 2018 · Preprint · Kimberly Redmond et al. · [PDF](https://arxiv.org/pdf/1812.09652) · [Full entry](https://awesomerea.org/papers/paper-cross-arch-instruction-embedding/)} - [**Debin: Predicting Debug Information in Stripped Binaries**](https://dl.acm.org/doi/10.1145/3243734.3243866) - Debin predicts debug information for stripped ELF binaries on x86, x64 and ARM. _{ACM CCS 2018 · Conference paper · Jingxuan He et al. · [PDF](https://files.sri.inf.ethz.ch/website/papers/ccs18-debin.pdf) · [Code](https://github.com/eth-sri/debin) · [Full entry](https://awesomerea.org/papers/paper-debin/)} - [**rev.ng: A Unified Binary Analysis Framework to Recover CFGs and Function Boundaries**](https://dl.acm.org/doi/10.1145/3033019.3033028) - rev.ng lifts binaries to LLVM IR through QEMU's tiny code generator, so one front end covers every architecture QEMU supports and the output is compilable IR. _{CC 2017 · Conference paper · Alessandro Di Federico et al. · [PDF](https://nebelwelt.net/publications/files/17CC.pdf) · [Code](https://github.com/revng/revng) · [Full entry](https://awesomerea.org/papers/paper-revng/)} - [**Ramblr: Making Reassembly Great Again**](https://www.ndss-symposium.org/ndss2017/ndss-2017-programme/ramblr-making-reassembly-great-again/) - Ramblr produces reassembleable disassembly: assembly recovered from a stripped binary that can be edited and assembled again with an off-the-shelf assembler. _{NDSS 2017 · Conference paper · Ruoyu Wang et al. · [PDF](https://www.ndss-symposium.org/wp-content/uploads/2017/09/ndss2017_10-5_Wang_paper_0.pdf) · [Full entry](https://awesomerea.org/papers/paper-ramblr/)} - [**No More Gotos: Decompilation Using Pattern-Independent Control-Flow Structuring and Semantics-Preserving Transformations**](https://www.ndss-symposium.org/ndss2015/ndss-2015-programme/no-more-gotos-decompilation-using-pattern-independent-control-flow-structuring-and-semantics/) - DREAM is a decompiler whose control-flow structuring recovers loops, conditionals and switch statements from a recovered control-flow graph without matching predefined region patterns. _{NDSS 2015 · Conference paper · Khaled Yakdan et al. · [PDF](https://www.ndss-symposium.org/wp-content/uploads/2017/09/11_4_2.pdf) · [Full entry](https://awesomerea.org/papers/paper-dream/)} ## Website reconstruction [↑ Contents](#contents) - [**PrismaCoder: Pushing the Boundaries of Open Multimodal Code Intelligence through Decomposed Rubric Synthesis**](https://arxiv.org/abs/2610.20538) - Trains visual-code models using separate code and rendered-output rubrics for data filtering and reinforcement learning. _{arXiv 2026 · Preprint · Qiushi Sun et al. · [PDF](https://arxiv.org/pdf/2610.20538v1) · [Full entry](https://awesomerea.org/papers/paper-prismacoder/)} - [**State-Aware Generation of Deployable Websites from Visual Prototypes and Requirements**](https://arxiv.org/abs/2610.17861) - VisStateCoder links visual prototype elements, project files, interaction requirements and render evidence in a project state graph, then uses those links to generate websites and limit subsequent repairs to selected files. _{arXiv 2026 · Preprint · Ruwei Pan et al. · [PDF](https://arxiv.org/pdf/2610.17861v1) · [Full entry](https://awesomerea.org/papers/paper-visstatecoder/)} - [**TaoD2C-Bench: Benchmarking MLLMs for Industrial UI Code Generation Beyond Visual Fidelity**](https://arxiv.org/abs/2610.10374) - TaoD2C-Bench reconstructs interfaces from design images, layer metadata and component-library documentation. _{arXiv 2026 · Preprint · Chengwei Shi et al. · [PDF](https://arxiv.org/pdf/2610.10374v1) · [Full entry](https://awesomerea.org/papers/paper-taod2c-bench/)} - [**Vision2Web: A Hierarchical Benchmark for Visual Website Development with Agent Verification**](https://proceedings.mlr.press/v306/he26n.html) - Benchmarks website development from visual prototypes and written requirements across 100 static-page, 66 interactive-frontend and 27 full-stack tasks, combining workflow-based functional checks with model-judged visual comparison. _{ICML 2026 · Conference paper · Zehai He et al. · [PDF](https://raw.githubusercontent.com/mlresearch/v306/main/assets/he26n/he26n.pdf) · [Code](https://github.com/zai-org/Vision2Web) · [Full entry](https://awesomerea.org/papers/paper-vision2web/)} - [**IChart2Code: Benchmarking Multimodal Large Language Models for Interactive Chart Code Generation**](https://arxiv.org/abs/2609.32413) - Benchmarks reconstruction of interactive charts from a reference screenshot, local data and specified actions. _{arXiv 2026 · Preprint · Xu Zhang et al. · [PDF](https://arxiv.org/pdf/2609.32413v1) · [Full entry](https://awesomerea.org/papers/paper-ichart2code/)} - [**Stage-Supervised Latent Reasoning for Single-Shot JavaScript Deobfuscation**](https://arxiv.org/abs/2609.27058) - Uses intermediate Webcrack rewrites to supervise Coconut-style latent reasoning for JavaScript deobfuscation. _{arXiv 2026 · Preprint · Rong Feng et al. · [PDF](https://arxiv.org/pdf/2609.27058v1) · [Full entry](https://awesomerea.org/papers/paper-stage-supervised-js-deobfuscation/)} - [**ProgramDistill: From Interactive Web Apps to Verifiable Reference-Guided SWE Tasks**](https://arxiv.org/abs/2609.18805) - Evaluates recovery of web-app behavior from a live reference with hidden source. _{arXiv 2026 · Preprint · Jeonghye Kim et al. · [PDF](https://arxiv.org/pdf/2609.18805v1) · [Code](https://huggingface.co/datasets/microsoft/ProgramDistill) · [Full entry](https://awesomerea.org/papers/paper-programdistill/)} - [**WebWorld: The Browser as a World Model for Self-Improving Web Code**](https://arxiv.org/abs/2608.30530) - Uses typed browser interaction contracts to check progress and preserve previously verified capabilities while improving generated web code. _{arXiv 2026 · Preprint · [Authors: see the paper](https://arxiv.org/abs/2608.30530) · [PDF](https://arxiv.org/pdf/2608.30530v1) · [Full entry](https://awesomerea.org/papers/paper-webworld-browser-feedback/)} - [**Does It Render Everywhere? A Study of Cross-Environment Compatibility in MLLM-Generated Webpages**](https://arxiv.org/abs/2608.12518) - WebCompat evaluates screenshot-reconstructed webpages across browsers and devices. _{arXiv 2026 · Preprint · Ziyun Guo et al. · [PDF](https://arxiv.org/pdf/2608.12518v1) · [Code](https://github.com/ZiyunGuo/WebCompat) · [Full entry](https://awesomerea.org/papers/paper-webcompat/)} - [**UI2App: Benchmarking Visual Interaction Inference in Executable Web Application Generation**](https://arxiv.org/abs/2607.06306) - UI2App evaluates runnable React/TypeScript applications generated from 600 screenshots across 95 web applications. _{arXiv 2026 · Preprint · Grace Man Chen et al. · [PDF](https://arxiv.org/pdf/2607.06306v2) · [Code](https://github.com/chenmancm169/UI2App) · [Full entry](https://awesomerea.org/papers/paper-ui2app/)} - [**Dashboard2Code: Evaluating Multimodal Models on Reconstructing Interactive Dashboards**](https://aclanthology.org/2026.acl-long.1750/) - Evaluates agents that actively explore a running dashboard and reconstruct its appearance and interaction logic. _{ACL 2026 · Conference paper · Tianhao Niu et al. · [PDF](https://aclanthology.org/2026.acl-long.1750.pdf) · [Code](https://github.com/nth2000/Dashboard2Code) · [Full entry](https://awesomerea.org/papers/paper-dashboard2code/)} - [**UniCoder: Unified Visual-to-Code Generation via Symbolic Rewards and Reference-Guided Code Optimization**](https://arxiv.org/abs/2606.31732) - UniCoder trains a visual-to-code model for charts, SVGs and webpages. _{arXiv 2026 · Preprint · Yaozhi Zheng et al. · [PDF](https://arxiv.org/pdf/2606.31732v1) · [Code](https://github.com/JimmyZhengyz/unicoder) · [Full entry](https://awesomerea.org/papers/paper-unicoder/)} - [**CASCADE: LLM-powered JavaScript Deobfuscator at Google**](https://doi.org/10.1145/3786583.3786873) - Uses Gemini to locate the prelude functions that Obfuscator.IO inserts for string obfuscation, then applies constant-propagation and inlining passes in the JSIR compiler IR to restore string literals and API names deterministically. _{ICSE-SEIP 2026 · Conference paper · Shan Jiang et al. · [PDF](https://arxiv.org/pdf/2507.17691v2) · [Code](https://github.com/google/jsir) · [Full entry](https://awesomerea.org/papers/paper-cascade/)} - [**ScreenCoder: Advancing Visual-to-Code Generation for Front-End Automation via Modular Multimodal Agents**](https://arxiv.org/abs/2507.22827) - Splits screenshot-to-code generation among grounding, planning and generation agents that label UI regions, build a hierarchical layout tree and write HTML/CSS. _{EMNLP 2026 · Conference accepted · Yilei Jiang et al. · [PDF](https://arxiv.org/pdf/2507.22827v2) · [Code](https://github.com/leigest519/ScreenCoder) · [Full entry](https://awesomerea.org/papers/paper-screencoder/)} - [**IWR-Bench: Can LVLMs reconstruct interactive webpage from a user interaction video?**](https://proceedings.iclr.cc/paper_files/paper/2026/hash/55bfedfd31489e5ae83c9ce8eec7b0e1-Abstract-Conference.html) - Tests reconstruction of interactive webpages from user-interaction videos and supplied static assets. _{ICLR 2026 · Conference paper · Yang Chen et al. · [PDF](https://proceedings.iclr.cc/paper_files/paper/2026/file/55bfedfd31489e5ae83c9ce8eec7b0e1-Paper-Conference.pdf) · [Code](https://github.com/SIGMME/IWR-Bench) · [Full entry](https://awesomerea.org/papers/paper-iwr-bench/)} - [**From Obfuscated to Obvious: A Comprehensive JavaScript Deobfuscation Tool for Security Analysis**](https://www.ndss-symposium.org/ndss-paper/from-obfuscated-to-obvious-a-comprehensive-javascript-deobfuscation-tool-for-security-analysis/) - JSimplifier recovers readable JavaScript from obfuscated scripts in three stages. _{NDSS 2026 · Conference paper · Dongchao Zhou et al. · [PDF](https://www.ndss-symposium.org/wp-content/uploads/2026-f2198-paper.pdf) · [Code](https://github.com/XingTuLab/JSIMPLIFIER) · [Full entry](https://awesomerea.org/papers/paper-jsimplifier/)} - [**JsDeObsBench: Measuring and Benchmarking LLMs for JavaScript Deobfuscation**](https://doi.org/10.1145/3719027.3744871) - Builds an execution-verifiable JavaScript deobfuscation benchmark by applying seven JavaScript-Obfuscator transformations to Project CodeNet programs with test cases, then scores LLM and tool outputs for syntax, execution, code simplification and similarity to the original code. _{ACM CCS 2025 · Conference paper · Guoqiang Chen et al. · [PDF](https://arxiv.org/pdf/2506.20170v1) · [Code](https://github.com/Ch3nYe/JsDeObsBench) · [Full entry](https://awesomerea.org/papers/paper-jsdeobsbench/)} - [**Interaction2Code: Benchmarking MLLM-based Interactive Webpage Code Generation from Interactive Prototyping**](https://doi.org/10.1109/ASE63991.2025.00028) - Benchmarks reconstruction of interactive webpages from screenshots before and after an interaction. _{ASE 2025 · Conference paper · Jingyu Xiao et al. · [PDF](https://arxiv.org/pdf/2411.03292v3) · [Code](https://github.com/WebPAI/Interaction2Code) · [Full entry](https://awesomerea.org/papers/paper-interaction2code/)} - [**LaTCoder: Converting Webpage Design to Code with Layout-as-Thought**](https://doi.org/10.1145/3711896.3737016) - LaTCoder converts webpage design images to HTML/CSS by making layout an explicit intermediate step. _{KDD 2025 · Conference paper · Yi Gui et al. · [PDF](https://arxiv.org/pdf/2508.03560v1) · [Code](https://github.com/CGCL-codes/naturalcc/tree/5f84062064947a0e2137ebda0bd3a9ae8ceb1736/examples/latcoder) · [Full entry](https://awesomerea.org/papers/paper-latcoder/)} - [**WebUIBench: A Comprehensive Benchmark for Evaluating Multimodal Large Language Models in WebUI-to-Code**](https://aclanthology.org/2025.findings-acl.815/) - Diagnoses webpage-to-code capability through visual perception, HTML programming, image-to-HTML understanding, and screenshot reconstruction tasks. _{Findings of ACL 2025 · Conference paper · Zhiyu Lin et al. · [PDF](https://aclanthology.org/2025.findings-acl.815.pdf) · [Full entry](https://awesomerea.org/papers/paper-webuibench/)} - [**WAFFLE: Fine-tuning Multi-Modal Model for Automated Front-End Development**](https://aclanthology.org/2025.acl-long.1208/) - WAFFLE fine-tunes multimodal LLMs to generate HTML/CSS from UI screenshots. _{ACL 2025 · Conference paper · Shanchao Liang et al. · [PDF](https://aclanthology.org/2025.acl-long.1208.pdf) · [Code](https://github.com/lt-asset/Waffle/tree/5ca57f8b64b0fa8827f1f310afe6ac1afc63d088) · [Full entry](https://awesomerea.org/papers/paper-waffle/)} - [**Divide-and-Conquer: Generating UI Code from Screenshots**](https://doi.org/10.1145/3729364) - Recursively divides a webpage screenshot along visual separation lines, has a multimodal model generate HTML/CSS for each leaf segment, and assembles child code upward into the full page; evaluated with GPT-4o, Gemini and Claude models and a small developer study. _{Proceedings of the ACM on Software Engineering (FSE 2025) · Journal article · Yuxuan Wan et al. · [PDF](https://arxiv.org/pdf/2406.16386v3) · [Code](https://github.com/WebPAI/DCGen) · [Full entry](https://awesomerea.org/papers/paper-dcgen/)} - [**StructEval: Benchmarking LLMs' Capabilities to Generate Structural Outputs**](https://arxiv.org/abs/2505.20139) - Evaluates generation and conversion of structured outputs, including HTML, React and SVG, with separate checks for format adherence and structural correctness. _{arXiv 2025 · Preprint · [Authors: see the paper](https://arxiv.org/abs/2505.20139) · [PDF](https://arxiv.org/pdf/2505.20139v3) · [Code](https://github.com/TIGER-AI-Lab/StructEval) · [Full entry](https://awesomerea.org/papers/paper-structeval/)} - [**WebCode2M: A Real-World Dataset for Code Generation from Webpage Designs**](https://dl.acm.org/doi/10.1145/3696410.3714889) - WebCode2M pairs about 2.56 million real-world webpage screenshots with purified HTML/CSS code and element bounding-box layout trees. _{WWW 2025 · Conference paper · Yi Gui et al. · [PDF](https://arxiv.org/pdf/2404.06369v2) · [Code](https://github.com/CGCL-codes/naturalcc/tree/main/examples/webcode2m) · [Full entry](https://awesomerea.org/papers/paper-webcode2m/)} - [**Sketch2Code: Evaluating Vision-Language Models for Interactive Web Design Prototyping**](https://aclanthology.org/2025.naacl-long.198/) - Sketch2Code benchmarks vision-language models on turning rough hand-drawn wireframe sketches into HTML webpage prototypes. _{NAACL 2025 · Conference paper · Ryan Li et al. · [PDF](https://aclanthology.org/2025.naacl-long.198.pdf) · [Code](https://github.com/SALT-NLP/Sketch2Code) · [Full entry](https://awesomerea.org/papers/paper-sketch2code/)} - [**Design2Code: Benchmarking Multimodal Code Generation for Automated Front-End Engineering**](https://aclanthology.org/2025.naacl-long.199/) - Evaluates reconstruction of frontend code from webpage screenshots using real-world reference pages, visual-element and layout metrics, and human assessment. _{NAACL 2025 · Conference paper · Chenglei Si et al. · [PDF](https://aclanthology.org/2025.naacl-long.199.pdf) · [Code](https://github.com/NoviScl/Design2Code) · [Full entry](https://awesomerea.org/papers/paper-design2code/)} - [**Large Language Models for Code Analysis: Do LLMs Really Do Their Job?**](https://www.usenix.org/conference/usenixsecurity24/presentation/fang) - Evaluates GPT-3.5-turbo, GPT-4, LLaMA-2-13B, Code-LLaMA-2-13B-Instruct and StarChat-Beta on explaining what de-commented JavaScript, Python and C code does, then repeats the task on JavaScript obfuscated with JavaScript Obfuscator (identifier renaming, dead-code injection, control-flow flattening and string splitting) and with Wobfuscator’s WebAssembly transformation. _{USENIX Security 2024 · Conference paper · Chongzhou Fang et al. · [PDF](https://www.usenix.org/system/files/usenixsecurity24-fang.pdf) · [Full entry](https://awesomerea.org/papers/paper-llm-code-analysis/)} - [**Unlocking the conversion of Web Screenshots into HTML Code with the WebSight Dataset**](https://arxiv.org/abs/2403.09029) - WebSight is a synthetic dataset of 2 million HTML documents paired with full-page screenshots for training screenshot-to-HTML models. _{arXiv 2024 · Preprint · Hugo Laurençon et al. · [PDF](https://arxiv.org/pdf/2403.09029v1) · [Full entry](https://awesomerea.org/papers/paper-websight/)} - [**Web2Code: A Large-scale Webpage-to-Code Dataset and Evaluation Framework for Multimodal LLMs**](https://proceedings.nips.cc/paper_files/paper/2024/hash/cb66be286795d71f89367d596bf78ea7-Abstract-Datasets_and_Benchmarks_Track.html) - Studies screenshot-to-HTML reconstruction through instruction tuning and two evaluation benchmarks. _{NeurIPS 2024 Datasets and Benchmarks · Conference paper · Sukmin Yun et al. · [PDF](https://proceedings.neurips.cc/paper_files/paper/2024/file/cb66be286795d71f89367d596bf78ea7-Paper-Datasets_and_Benchmarks_Track.pdf) · [Code](https://github.com/MBZUAI-LLM/web2code) · [Full entry](https://awesomerea.org/papers/paper-web2code/)} - [**Understanding JavaScript Event-Based Interactions**](https://doi.org/10.1145/2568225.2568268) - Clematis helps developers understand a JavaScript web application's runtime behavior from a recorded user session. _{ICSE 2014 · Conference paper · Saba Alimadadi et al. · [PDF](https://people.ece.ubc.ca/amesbah/resources/papers/clematis-icse14.pdf) · [Code](https://github.com/saltlab/clematis/tree/7b2479a09721699eaaa24f6e258df5e2beb35d0a) · [Full entry](https://awesomerea.org/papers/paper-clematis/)} - [**Crawling Ajax-Based Web Applications through Dynamic Analysis of User Interface State Changes**](https://dl.acm.org/doi/10.1145/2109205.2109208) - Crawljax infers a state-flow graph of an Ajax web application by driving it in a real browser. _{ACM Transactions on the Web 2012 · Journal article · Ali Mesbah et al. · [PDF](https://dl.acm.org/doi/pdf/10.1145/2109205.2109208) · [Code](https://github.com/crawljax/crawljax) · [Full entry](https://awesomerea.org/papers/paper-crawljax/)} ## Game reconstruction and reverse engineering [↑ Contents](#contents) - [**Schema: Discovering Unknown Environments via Agentic Program Induction**](https://arxiv.org/abs/2609.39140) - Infers executable models of game state and transition rules from interaction. _{arXiv 2026 · Preprint · Guanning Zeng et al. · [PDF](https://arxiv.org/pdf/2609.39140v1) · [Code](https://github.com/guanning03/Schema) · [Full entry](https://awesomerea.org/papers/paper-schema-program-induction/)} - [**SWE-Game: Can Coding Agents Build the Games We Want?**](https://arxiv.org/abs/2609.33678) - Evaluates construction, completion, repair and Godot-to-Unity porting against executable reference games. _{arXiv 2026 · Preprint · Xiaoyu Chen et al. · [PDF](https://arxiv.org/pdf/2609.33678v3) · [Full entry](https://awesomerea.org/papers/paper-swe-game/)} - [**GameReplica: A Benchmark for Black-Box Visual Game Replication by Vision-Language Agents**](https://arxiv.org/abs/2609.22308) - Evaluates whether vision-language agents can infer hidden game rules through screenshots and active interaction, then build runnable single-file HTML replicas across 125 tasks from 25 web games, each with five difficulty levels. _{arXiv 2026 · Preprint · Boyu Qiao et al. · [PDF](https://arxiv.org/pdf/2609.22308v1) · [Full entry](https://awesomerea.org/papers/paper-gamereplica/)} - [**Tycho: Active Abstraction with Programmatic World Models for ARC-AGI-3**](https://arxiv.org/abs/2607.28287) - Tycho constructs editable Python models of game state, transitions, rendering and outcomes from action/observation histories in unfamiliar ARC-AGI-3 games. _{arXiv 2026 · Preprint · Jens Lehmann et al. · [PDF](https://arxiv.org/pdf/2607.28287v1) · [Code](https://github.com/NIMI-research/Tycho) · [Full entry](https://awesomerea.org/papers/paper-tycho/)} - [**RevengeBench: Reverse Engineering Code-Space Policies from Behavioral Experiments**](https://arxiv.org/abs/2606.26094) - Tests whether agents can recover executable decision policies from behavioral traces and self-designed opponent probes, using 75 synthetic policies across five game arenas and measuring held-out action agreement and downstream competitive value. _{arXiv 2026 · Preprint · Babak Rahmani et al. · [PDF](https://arxiv.org/pdf/2606.26094v1) · [Code](https://github.com/bethgelab/revenge-bench) · [Full entry](https://awesomerea.org/papers/paper-revengebench/)} - [**SPRITE: From Static Mockups to Engine-Ready Game UI**](https://doi.org/10.1145/3772363.3798742) - Transforms game-interface screenshots into editable engine assets through hierarchical YAML, visual grounding, asset extraction, and Unity UXML/USS synthesis, with evaluation on a curated game-UI benchmark and review by three senior UI/UX designers. _{CHI EA 2026 (poster/extended abstract) · Conference paper · Yunshu Bai et al. · [PDF](https://baiyunshu.github.io/sprite.github.io/Source/chiea26-516.pdf) · [Full entry](https://awesomerea.org/papers/paper-sprite-game-ui/)} - [**PoE-World: Compositional World Modeling with Products of Programmatic Experts**](https://papers.nips.cc/paper_files/paper/2025/hash/262dd62fd1bbb30d6a6b4d578f5e65ff-Abstract-Conference.html) - PoE-World represents an Atari world model as an exponentially weighted product of many small Python programs, or programmatic experts, each synthesized by an LLM to explain one aspect of the observed dynamics; learned weights and optional synthesized hard constraints combine them. _{NeurIPS 2025 · Conference paper · Wasu Top Piriyakulkij et al. · [PDF](https://proceedings.neurips.cc/paper_files/paper/2025/file/262dd62fd1bbb30d6a6b4d578f5e65ff-Paper-Conference.pdf) · [Code](https://github.com/topwasu/poe-world/tree/b499fb16a60793840a8ad97b3739518c7505ca3a) · [Full entry](https://awesomerea.org/papers/paper-poe-world/)} - [**Diffusion Models Are Real-Time Game Engines**](https://proceedings.iclr.cc/paper_files/paper/2025/hash/b71ecea210f7159f31e46631fe5c838f-Abstract-Conference.html) - GameNGen learns to simulate DOOM interactively with a diffusion model instead of game code. _{ICLR 2025 · Conference paper · Dani Valevski et al. · [PDF](https://proceedings.iclr.cc/paper_files/paper/2025/file/b71ecea210f7159f31e46631fe5c838f-Paper-Conference.pdf) · [Full entry](https://awesomerea.org/papers/paper-gamengen/)} - [**WorldCoder, a Model-Based LLM Agent: Building World Models by Writing Code and Interacting with the Environment**](https://papers.nips.cc/paper_files/paper/2024/hash/820c61a0cd419163ccbd2c33b268816e-Abstract-Conference.html) - WorldCoder learns executable Python transition and reward models from environment interactions and natural-language goals. _{NeurIPS 2024 · Conference paper · Hao Tang et al. · [PDF](https://papers.neurips.cc/paper_files/paper/2024/file/820c61a0cd419163ccbd2c33b268816e-Paper-Conference.pdf) · [Code](https://github.com/haotang1995/WorldCoder) · [Full entry](https://awesomerea.org/papers/paper-worldcoder/)} - [**Generating Code World Models with Large Language Models Guided by Monte Carlo Tree Search**](https://proceedings.neurips.cc/paper_files/paper/2024/hash/6f479ea488e0908ac8b1b37b27fd134c-Abstract-Conference.html) - GIF-MCTS generates executable Python transition and reward models from natural-language environment descriptions and offline state-transition trajectories, using prediction feedback to generate, improve and repair code. _{NeurIPS 2024 · Conference paper · Nicola Dainese et al. · [PDF](https://proceedings.neurips.cc/paper_files/paper/2024/file/6f479ea488e0908ac8b1b37b27fd134c-Paper-Conference.pdf) · [Code](https://github.com/nicoladainese96/code-world-models) · [Full entry](https://awesomerea.org/papers/paper-code-world-models/)} - [**Combining Functional and Automata Synthesis to Discover Causal Reactive Programs**](https://dl.acm.org/doi/10.1145/3571249) - AutumnSynth synthesizes a program in Autumn, a functional reactive language for Atari-style grid worlds, from a trace of observed frames and user actions such as clicks and arrow keys. _{Proceedings of the ACM on Programming Languages (POPL 2023) · Journal article · Ria Das et al. · [PDF](https://dl.acm.org/doi/pdf/10.1145/3571249) · [Full entry](https://awesomerea.org/papers/paper-autumnsynth/)} - [**MappyLand: Fast, Accurate Mapping for Console Games**](https://ojs.aaai.org/index.php/AIIDE/article/view/18892) - MappyLand, a Rust rewrite of the earlier Mappy system, instruments the FCEUMM NES emulator core to map action/adventure games as they are played from controller inputs. _{AIIDE 2021 · Conference paper · Joseph C. Osborn et al. · [PDF](https://ojs.aaai.org/index.php/AIIDE/article/download/18892/18657) · [Code](https://github.com/faim-lab/mappy/tree/bbf99dd0f53c0986250c9020e3a7a75f9732b19f) · [Full entry](https://awesomerea.org/papers/paper-mappyland/)} - [**Learning to Simulate Dynamic Environments with GameGAN**](https://ieeexplore.ieee.org/document/9156900) - GameGAN learns an action-conditioned neural simulator of a game from recorded frames and the actions taken, without access to the game’s logic or engine. _{CVPR 2020 · Conference paper · Seung Wook Kim et al. · [PDF](https://openaccess.thecvf.com/content_CVPR_2020/papers/Kim_Learning_to_Simulate_Dynamic_Environments_With_GameGAN_CVPR_2020_paper.pdf) · [Code](https://github.com/nv-tlabs/GameGAN_code) · [Full entry](https://awesomerea.org/papers/paper-gamegan/)} - [**Mechanics Automatically Recognized via Interactive Observation: Jumping**](https://doi.org/10.1145/3102071.3102104) - Infers platform-game jump mechanics by running controlled experiments in a modified FCEUX NES emulator. _{FDG 2017 · Conference paper · Adam Summerville et al. · [PDF](https://arxiv.org/pdf/1707.03865v1) · [Full entry](https://awesomerea.org/papers/paper-nes-jump-mechanics/)} - [**Game Engine Learning from Video**](https://www.ijcai.org/proceedings/2017/518) - Learns a rule-based forward simulator of a 2D game from gameplay video. _{IJCAI 2017 · Conference paper · Matthew Guzdial et al. · [PDF](https://www.ijcai.org/proceedings/2017/0518.pdf) · [Full entry](https://awesomerea.org/papers/paper-game-engine-learning/)} ## App reconstruction and analysis [↑ Contents](#contents) - [**From Dead Code and Static Requirements to Working Engines: Software Revival with Coding Agents**](https://arxiv.org/abs/2609.36161) - ReviveBench evaluates repair of nonrunning software and source-unavailable implementation of bounded computational and transactional engines from open specifications, using hidden reference-based checks. _{arXiv 2026 · Preprint · Tianyu Liu et al. · [PDF](https://arxiv.org/pdf/2609.36161v1) · [Full entry](https://awesomerea.org/papers/paper-revivebench/)} - [**From Code to Requirements: Agentic Reverse Engineering of Business Rules at Enterprise Scale**](https://arxiv.org/abs/2609.22719) - Uses seven agents and human review to recover business requirements from source, tests, configuration and documentation. _{arXiv 2026 · Preprint · Garima Agrawal et al. · [PDF](https://arxiv.org/pdf/2609.22719v1) · [Full entry](https://awesomerea.org/papers/paper-agentic-business-rule-recovery/)} - [**On the Viability of Requirements Generation from Code: An Experience Report**](https://doi.org/10.1109/REW72749.2026.00023) - Studies a RAG-based, human-supervised pipeline for recovering requirements and code traces from two projects. _{IEEE REW 2026 / AIRE · Conference paper · Alexander Korn et al. · [PDF](https://arxiv.org/pdf/2606.25550v1) · [Full entry](https://awesomerea.org/papers/paper-requirements-generation-viability/)} - [**From Visual Widgets to UI Code: Efficient Tool-Grounded Generation**](https://arxiv.org/abs/2608.12611) - WidgetGen reconstructs widget screenshots as React JSX. _{MUCG @ ECCV 2026 · Conference accepted · Houston H. Zhang et al. · [PDF](https://arxiv.org/pdf/2608.12611v1) · [Full entry](https://awesomerea.org/papers/paper-widgetgen/)} - [**Agentic Reverse Engineering: From I/O to Code with Discovery Agent**](https://arxiv.org/abs/2605.15334) - Synthesizes executable programs from input/output observations using LLM-guided evolutionary search, progressively revealed examples, simple-to-complex mutations and execution-error feedback. _{NeurIPS 2026 · Conference accepted · Yihong Dong et al. · [PDF](https://arxiv.org/pdf/2605.15334v2) · [Code](https://github.com/JiaruQian/IO2Code) · [Full entry](https://awesomerea.org/papers/paper-dio-agent/)} - [**UIOrchestra: Generating High-Fidelity Code from UI Designs with a Multi-agent System**](https://aclanthology.org/2025.findings-emnlp.150/) - UIOrchestra converts static mobile UI designs into React/CSS through layout-description, code-generation and rendered-image comparison agents. _{Findings of EMNLP 2025 · Conference paper · Chuhuai Yue et al. · [PDF](https://aclanthology.org/2025.findings-emnlp.150.pdf) · [Full entry](https://awesomerea.org/papers/paper-uiorchestra/)} - [**DeclarUI: Bridging Design and Development with Automated Declarative UI Code Generation**](https://doi.org/10.1145/3715726) - Combines visual component extraction, multimodal models, page-transition graphs and iterative checks to reconstruct multi-page mobile UI code from designs or screenshots, evaluated with React Native, Flutter and ArkUI. _{Proceedings of the ACM on Software Engineering (FSE 2025) · Journal article · Ting Zhou et al. · [PDF](https://xinyi-hou.github.io/files/zhou2024bridging.pdf) · [Code](https://github.com/security-pride/DeclarUI) · [Full entry](https://awesomerea.org/papers/paper-declarui/)} - [**On Benchmarking Code LLMs for Android Malware Analysis**](https://dl.acm.org/doi/10.1145/3713081.3731745) - CAMA is a framework for benchmarking how code LLMs read decompiled Android malware. _{ISSTA Companion 2025 (LLMSC Workshop) · Conference paper · Yiling He et al. · [PDF](https://arxiv.org/pdf/2504.00694v2) · [Full entry](https://awesomerea.org/papers/paper-cama/)} - [**Machine Learning-Based Prototyping of Graphical User Interfaces for Mobile Apps**](https://doi.org/10.1109/TSE.2018.2844788) - ReDraw turns screenshots or design mock-ups into native Android GUI prototypes by detecting components, classifying widget types with a CNN, and assembling a plausible view hierarchy with a data-driven nearest-neighbor method. _{IEEE Transactions on Software Engineering 2020 · Journal article · Kevin Moran et al. · [PDF](https://arxiv.org/pdf/1802.02312v2) · [Full entry](https://awesomerea.org/papers/paper-redraw/)} - [**pix2code: Generating Code from a Graphical User Interface Screenshot**](https://doi.org/10.1145/3220134.3220135) - Learns screenshot-to-DSL generation for native Android XML, iOS Storyboards and web HTML/CSS interfaces, then compiles the DSL into platform UI code. _{EICS 2018 · Conference paper · Tony Beltramelli · [PDF](https://arxiv.org/pdf/1705.07962v2) · [Code](https://github.com/tonybeltramelli/pix2code) · [Full entry](https://awesomerea.org/papers/paper-pix2code/)} - [**From UI Design Image to GUI Skeleton: A Neural Machine Translator to Bootstrap Mobile GUI Implementation**](https://doi.org/10.1145/3180155.3180240) - UI2code translates a mobile UI image into an Android component hierarchy and layout skeleton using a neural encoder-decoder. _{ICSE 2018 · Conference paper · Chunyang Chen et al. · [PDF](https://chunyang-chen.github.io/publication/ui2code.pdf) · [Code](https://github.com/ccywch/UI2code) · [Full entry](https://awesomerea.org/papers/paper-ui2code/)} - [**Rico: A Mobile App Dataset for Building Data-Driven Design Applications**](https://doi.org/10.1145/3126594.3126651) - Rico is a dataset of Android app designs and a runtime mining system that needs no access to or modification of app source code. _{UIST 2017 · Conference paper · Biplab Deka et al. · [PDF](https://ranjithakumar.net/resources/rico.pdf) · [Full entry](https://awesomerea.org/papers/paper-rico/)} - [**Statistical Deobfuscation of Android Applications**](https://dl.acm.org/doi/10.1145/2976749.2978422) - DeGuard reverses layout obfuscation in Android APKs, predicting original names for the fields, methods, classes and packages that ProGuard renames. _{ACM CCS 2016 · Conference paper · Benjamin Bichsel et al. · [PDF](https://files.sri.inf.ethz.ch/website/papers/deguard.pdf) · [Full entry](https://awesomerea.org/papers/paper-deguard/)} - [**Reverse Engineering Mobile Application User Interfaces with REMAUI (T)**](https://ieeexplore.ieee.org/abstract/document/7372013) - Reconstructs native Android UI code from screenshots or design bitmaps using OCR, computer vision, and layout heuristics; evaluates visual similarity and view hierarchies on 488 screenshots from over 100 Android and iOS applications. _{ASE 2015 · Conference paper · Tuan Anh Nguyen et al. · [PDF](https://c.csallner.org/papers/nguyen15reverse.pdf) · [Code](https://github.com/soumikmohianuta/pixtoapp) · [Full entry](https://awesomerea.org/papers/paper-remaui/)} - [**Guided GUI Testing of Android Apps with Minimal Restart and Approximate Learning**](https://doi.org/10.1145/2509136.2509552) - SwiftHand generates test inputs for Android apps while learning an approximate GUI model during testing. _{OOPSLA 2013 · Conference paper · Wontae Choi et al. · [PDF](https://people.eecs.berkeley.edu/~ksen/papers/swifthand.pdf) · [Code](https://github.com/wtchoi/SwiftHand/tree/b2b45acd636ab63beb0969401d1ee2c77fa0530d) · [Full entry](https://awesomerea.org/papers/paper-swifthand/)} - [**GUI ripping: reverse engineering of graphical user interfaces for testing**](https://ieeexplore.ieee.org/document/1287256) - GUI ripping reverse engineers a test model from a running desktop application rather than from its source code or specifications. _{WCRE 2003 · Conference paper · Atif Memon et al. · [PDF](https://www.cs.umd.edu/~atif/papers/MemonWCRE2003.pdf) · [Full entry](https://awesomerea.org/papers/paper-gui-ripping/)} ## Firmware analysis and rehosting [↑ Contents](#contents) - [**SoK: A Large-Scale Empirical Study of Emulation-Based Dynamic Analysis Research for ARM Cortex-M Firmware (Extended Version)**](https://arxiv.org/abs/2609.38872) - Organizes 24 MCU analysis tools into configuration recovery, emulation, fuzzing and diagnosis stages, then evaluates the runnable, pipeline-compatible subset on 4,571 filtered Cortex-M firmware images. _{arXiv (extended version) 2026 · Preprint · Hongyuan Li et al. · [PDF](https://arxiv.org/pdf/2609.38872v1) · [Code](https://github.com/IoTS-P/LargeRehostingTesting) · [Full entry](https://awesomerea.org/papers/paper-cortexm-emulation-sok/)} - [**POZZER: A Power Side Channel-guided Fuzzer for Black-Box Embedded Systems**](https://arxiv.org/abs/2609.23583) - Builds a noise-tolerant pseudo execution-flow graph from one power trace per test input, using newly observed behavior as LibAFL feedback. _{arXiv 2026 · Preprint · Pouya Narimani et al. · [PDF](https://arxiv.org/pdf/2609.23583v1) · [Full entry](https://awesomerea.org/papers/paper-pozzer/)} - [**Reactive Peripheral Modeling for Faithful Firmware Rehosting**](https://arxiv.org/abs/2608.29737) - Bluezz models peripherals as stateful event-condition-action systems, coordinating interrupts, MMIO and DMA rather than treating accesses independently. _{arXiv 2026 · Preprint · Qinying Wang et al. · [PDF](https://arxiv.org/pdf/2608.29737v1) · [Full entry](https://awesomerea.org/papers/paper-bluezz-rpm/)} - [**Khost: KVM-based Near Native MCU Firmware Rehosting**](https://www.usenix.org/conference/usenixsecurity26/presentation/wang-chunlin) - Extends KVM with MCU instruction handling, memory mapping and interrupt modeling to rehost firmware on ARMv8-A hosts. _{USENIX Security '26 2026 · Conference paper · Chunlin Wang et al. · [PDF](https://www.usenix.org/system/files/usenixsecurity26-wang-chunlin.pdf) · [Code](https://github.com/seclab-fudan/Khost) · [Full entry](https://awesomerea.org/papers/paper-khost/)} - [**FirmPilot: Evidence-Guided Multi-Agent Environment Recovery for IoT Firmware Rehosting**](https://arxiv.org/abs/2607.14903) - FirmPilot reconstructs QEMU execution environments through coordinated retrieval, planning, filesystem, persistent-state and network recovery. _{arXiv 2026 · Preprint · Yanbing Shen et al. · [PDF](https://arxiv.org/pdf/2607.14903v1) · [Full entry](https://awesomerea.org/papers/paper-firmpilot/)} - [**FirmCure:Towards Autonomous and Adaptive Rehosting of Linux-Based Firmware**](https://arxiv.org/abs/2606.24549) - FirmCure combines static dependency analysis, iterative boot-configuration repair and runtime fault diagnosis to rehost Linux firmware in QEMU. _{arXiv 2026 · Preprint · Chuan Hong et al. · [PDF](https://arxiv.org/pdf/2606.24549v1) · [Full entry](https://awesomerea.org/papers/paper-firmcure/)} - [**SatBleed: Security of Commoditized Communication Modules in Satellites**](https://doi.org/10.1109/SP63933.2026.00213) - Studies satellite communication modules through hardware inspection, firmware reverse engineering, protocol analysis, partial rehosting and targeted testing. _{IEEE S&P 2026 · Conference paper · Ulysse Planta et al. · [PDF](https://arxiv.org/pdf/2610.06258v1) · [Code](https://github.com/EmsecCispa/SatBleed) · [Full entry](https://awesomerea.org/papers/paper-satbleed/)} - [**User-Space Dependency-Aware Rehosting for Linux-Based Firmware Binaries**](https://www.ndss-symposium.org/ndss-paper/user-space-dependency-aware-rehosting-for-linux-based-firmware-binaries/) - FIRMWELL reconstructs the execution environment of Linux firmware services by running their initialization processes, locating blocking dependencies and repairing missing system-level behavior. _{NDSS 2026 · Conference paper · Chuan Qin et al. · [PDF](https://www.ndss-symposium.org/wp-content/uploads/2026-s249-paper.pdf) · [Code](https://github.com/qc9c/Firmwell) · [Full entry](https://awesomerea.org/papers/paper-firmwell/)} - [**Target-Centric Firmware Rehosting with Penguin**](https://www.ndss-symposium.org/ndss-paper/auto-draft-634/) - Penguin rehosts embedded Linux firmware from an extracted filesystem by deriving an editable configuration of emulation transformations, such as file changes, pseudofiles, NVRAM values and network interfaces, from static analysis. _{Workshop on Binary Analysis Research (BAR) 2025 · Conference paper · Andrew Fasano et al. · [PDF](https://www.ndss-symposium.org/wp-content/uploads/bar2025-final10.pdf) · [Code](https://github.com/rehosting/penguin) · [Full entry](https://awesomerea.org/papers/paper-penguin/)} - [**What Your Firmware Tells You Is Not How You Should Emulate It: A Specification-Guided Approach for Firmware Emulation**](https://dl.acm.org/doi/10.1145/3548606.3559386) - SEmu builds microcontroller peripheral models from vendor reference manuals rather than from the firmware itself. _{ACM CCS 2022 · Conference paper · Wei Zhou et al. · [PDF](https://arxiv.org/pdf/2208.07833v3) · [Code](https://github.com/MCUSec/SEmu/tree/6dc8be91f6809f34af972a93c9dd972f85145a00) · [Full entry](https://awesomerea.org/papers/paper-semu/)} - [**Fuzzware: Using Precise MMIO Modeling for Effective Firmware Fuzzing**](https://www.usenix.org/conference/usenixsecurity22/presentation/scharnowski) - Rehosts monolithic ARM Cortex-M firmware for fuzzing, using locally scoped symbolic execution to model memory-mapped I/O accesses and focus input mutations on values relevant to firmware logic. _{USENIX Security 2022 · Conference paper · Tobias Scharnowski et al. · [PDF](https://www.usenix.org/system/files/sec22-scharnowski.pdf) · [Code](https://github.com/fuzzware-fuzzer/fuzzware) · [Full entry](https://awesomerea.org/papers/paper-fuzzware/)} - [**ECMO: Peripheral Transplantation to Rehost Embedded Linux Kernels**](https://doi.org/10.1145/3460120.3484753) - ECMO transplants peripheral drivers into embedded Linux kernels to boot firmware in QEMU. _{Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security · Conference paper · Muhui Jiang et al. · [PDF](https://arxiv.org/pdf/2105.14295) · [Full entry](https://awesomerea.org/papers/paper-ecmo/)} - [**Jetset: Targeted Firmware Rehosting for Embedded Systems**](https://www.usenix.org/conference/usenixsecurity21/presentation/johnson) - Jetset rehosts firmware only as far as an analyst-chosen goal address, such as the point where a fuzzer can inject input. _{USENIX Security 2021 · Conference paper · Evan Johnson et al. · [PDF](https://www.usenix.org/system/files/sec21-johnson.pdf) · [Code](https://github.com/aerosec/jetset) · [Full entry](https://awesomerea.org/papers/paper-jetset/)} - [**Automatic Firmware Emulation through Invalidity-guided Knowledge Inference**](https://www.usenix.org/conference/usenixsecurity21/presentation/zhou) - µEmu emulates ARM Cortex-M microcontroller firmware without real hardware or hand-written peripheral models by symbolically executing the image with unknown peripheral registers as symbols. _{USENIX Security 2021 · Conference paper · Wei Zhou et al. · [PDF](https://www.usenix.org/system/files/sec21-zhou.pdf) · [Code](https://github.com/MCUSec/uEmu/tree/c82fc0a36a28ab5f96001b0682adcf9783e20346) · [Full entry](https://awesomerea.org/papers/paper-uemu/)} - [**SoK: Enabling Security Analyses of Embedded Systems via Rehosting**](https://dl.acm.org/doi/10.1145/3433210.3453093) - Systematizes rehosting: moving embedded firmware from its physical hardware into a virtual environment that models enough hardware behavior for dynamic analysis such as fuzzing and symbolic execution. _{ACM ASIA CCS 2021 · Conference paper · Andrew Fasano et al. · [PDF](https://dl.acm.org/doi/pdf/10.1145/3433210.3453093) · [Code](https://github.com/rehosting/rehosting_sok) · [Full entry](https://awesomerea.org/papers/paper-rehosting-sok/)} - [**Conware: Automated Modeling of Hardware Peripherals**](https://dl.acm.org/doi/10.1145/3433210.3437532) - Conware builds reusable software models of hardware peripherals from recordings of real firmware–peripheral interactions. _{ACM ASIA CCS 2021 · Conference paper · Chad Spensky et al. · [PDF](https://sites.cs.ucsb.edu/~chris/research/doc/asiaccs21_conware.pdf) · [Code](https://github.com/ucsb-seclab/conware/tree/05dfdf5552d5c05dfca32137487fc8b3aadcd256) · [Full entry](https://awesomerea.org/papers/paper-conware/)} - [**Snipuzz: Black-box Fuzzing of IoT Firmware via Message Snippet Inference**](https://arxiv.org/abs/2105.05445) - Snipuzz fuzzes IoT firmware as a client, using device responses to infer message snippets that guide mutations. _{ACM CCS 2021 · Conference accepted · Xiaotao Feng et al. · [PDF](https://arxiv.org/pdf/2105.05445) · [Full entry](https://awesomerea.org/papers/paper-snipuzz/)} - [**DICE: Automatic Emulation of DMA Input Channels for Dynamic Firmware Analysis**](https://ieeexplore.ieee.org/document/9519398) - DICE adds DMA input emulation to microcontroller firmware emulators that model neither peripherals nor DMA controllers. _{IEEE S&P 2021 · Conference paper · Alejandro Mera et al. · [PDF](https://arxiv.org/pdf/2007.01502v3) · [Code](https://github.com/RiS3-Lab/DICE-DMA-Emulation/tree/2b3b8c8b722abdbd7ff9e35fc7b02914fddf75df) · [Full entry](https://awesomerea.org/papers/paper-dice/)} - [**From Library Portability to Para-rehosting: Natively Executing Microcontroller Software on Commodity Hardware**](https://doi.org/10.14722/ndss.2021.24308) - The paper uses a POSIX-based portable MCU and replaceable peripheral drivers to rehost MCU software for native execution and security testing on commodity hardware. _{Proceedings 2021 Network and Distributed System Security Symposium · Conference paper · Wenqiang Li et al. · [PDF](https://arxiv.org/pdf/2107.12867) · [Full entry](https://awesomerea.org/papers/paper-para-rehosting/)} - [**FirmAE: Towards Large-Scale Emulation of IoT Firmware for Dynamic Analysis**](https://doi.org/10.1145/3427228.3427294) - Extends Firmadyne with empirically derived interventions for boot, networking, NVRAM, kernel behavior, and other runtime failures, enabling Linux router and IP-camera firmware web services to run for dynamic analysis. _{ACSAC 2020 · Conference paper · Mingeun Kim et al. · [PDF](https://syssec.kaist.ac.kr/pub/2020/kim_acsac2020.pdf) · [Code](https://github.com/pr0v3rbs/FirmAE) · [Full entry](https://awesomerea.org/papers/paper-firmae/)} - [**HALucinator: Firmware Re-hosting Through Abstraction Layer Emulation**](https://www.usenix.org/conference/usenixsecurity20/presentation/clements) - HALucinator rehosts monolithic ARM Cortex-M firmware by identifying hardware-abstraction-library functions and replacing them with authored Python handlers and peripheral models. _{USENIX Security 2020 · Conference paper · Abraham A Clements et al. · [PDF](https://www.usenix.org/system/files/sec20-clements.pdf) · [Code](https://github.com/embedded-sec/halucinator) · [Full entry](https://awesomerea.org/papers/paper-halucinator/)} - [**On Manually Reverse Engineering Communication Protocols of Linux Based IoT Systems**](https://arxiv.org/abs/2007.11981) - Presents a manual framework for reverse engineering communication protocols in embedded Linux IoT systems. _{arXiv 2020 · Preprint · Kaizheng Liu et al. · [PDF](https://arxiv.org/pdf/2007.11981) · [Full entry](https://awesomerea.org/papers/paper-manually-re-iot-protocols/)} - [**BaseSAFE: Baseband SAnitized Fuzzing through Emulation**](https://doi.org/10.1145/3395351.3399360) - BaseSAFE partially rehosts closed-source cellular baseband firmware for instrumented fuzzing and uses a sanitizing allocator to detect heap buffer overflows. _{Proceedings of the 13th ACM Conference on Security and Privacy in Wireless and Mobile Networks 2020 · Conference paper · Dominik Maier et al. · [PDF](https://arxiv.org/pdf/2005.07797) · [Full entry](https://awesomerea.org/papers/paper-basesafe/)} - [**Frankenstein: Advanced Wireless Fuzzing to Exploit New Bluetooth Escalation Targets**](https://arxiv.org/abs/2006.09809) - Frankenstein emulates Bluetooth firmware dumps and fuzzes a virtual modem. _{USENIX Security 2020 · Conference accepted · Jan Ruge et al. · [PDF](https://arxiv.org/pdf/2006.09809) · [Full entry](https://awesomerea.org/papers/paper-frankenstein/)} - [**Towards Automated Dynamic Analysis for Linux-based Embedded Firmware**](https://doi.org/10.14722/ndss.2016.23415) - Firmadyne crawls, extracts and emulates Linux-based firmware for network-connected commercial devices such as routers and IP cameras. _{NDSS 2016 · Conference paper · Daming D. Chen et al. · [PDF](https://www.ndss-symposium.org/wp-content/uploads/2017/09/towards-automated-dynamic-analysis-linux-based-embedded-firmware.pdf) · [Code](https://github.com/firmadyne/firmadyne) · [Full entry](https://awesomerea.org/papers/paper-firmadyne/)} - [**Automated Dynamic Firmware Analysis at Scale: A Case Study on Embedded Web Interfaces**](https://arxiv.org/abs/1511.03609) - The paper emulates firmware images and uses static and dynamic tools to find vulnerabilities in embedded web interfaces. _{arXiv 2015 · Preprint · Andrei Costin et al. · [PDF](https://arxiv.org/pdf/1511.03609) · [Full entry](https://awesomerea.org/papers/paper-dynamic-firmware-analysis-at-scale/)} - [**Avatar: A Framework to Support Dynamic Security Analysis of Embedded Systems’ Firmwares**](https://www.ndss-symposium.org/ndss2014/ndss-2014-programme/avatar-framework-support-dynamic-security-analysis-embedded-systems-firmwares/) - Avatar runs embedded firmware in an instrumented emulator, S²E on QEMU, while forwarding memory-mapped I/O to the real device and injecting the device's interrupts back into the emulator, so firmware that depends on undocumented peripherals can still be analyzed dynamically. _{NDSS 2014 · Conference paper · Jonas Zaddach et al. · [PDF](https://www.ndss-symposium.org/wp-content/uploads/2017/09/02_3_1.pdf) · [Code](https://github.com/avatarone/avatar-python) · [Full entry](https://awesomerea.org/papers/paper-avatar/)} ## Protocol inference and analysis [↑ Contents](#contents) - [**Protocol Reverse Engineering via Deep Transfer Learning**](https://doi.org/10.1145/3797124) - Transfers field-boundary patterns from standardized protocol traces labeled by Tshark to poorly documented target protocols. _{Proceedings of the ACM on Software Engineering / FSE 2026 · Journal article · Yanyang Zhao et al. · [PDF](https://dl.acm.org/doi/pdf/10.1145/3797124) · [Full entry](https://awesomerea.org/papers/paper-transre/)} - [**RFCLLM: Evaluating LLMs' Reasoning Ability of Network Protocol State Machines**](https://arxiv.org/abs/2609.13389) - Tests reasoning over protocol state machines using 1,482 questions across 16 protocols. _{Findings of EMNLP 2026 · Conference accepted · Anqi Chen et al. · [PDF](https://arxiv.org/pdf/2609.13389v1) · [Code](https://anonymous.4open.science/r/rfcllm) · [Full entry](https://awesomerea.org/papers/paper-rfcllm/)} - [**Recovering Process Variables from Industrial Network Traffic via Search-Based Optimization**](https://arxiv.org/abs/2608.16403) - PVParser recovers process-variable layouts from industrial traffic and historian records. _{CCS 2026 · Conference accepted · Chuan Sheng et al. · [PDF](https://arxiv.org/pdf/2608.16403v2) · [Full entry](https://awesomerea.org/papers/paper-pvparser/)} - [**ICEPRE: ICS Protocol Reverse Engineering via Data-Driven Concolic Execution**](https://dl.acm.org/doi/10.1145/3728982) - Infers message-field boundaries by following concrete message-guided paths through binary protocol parsers, then symbolically replaying them to extract byte-level data flow. _{Proceedings of the ACM on Software Engineering (ISSTA 2025) · Journal article · Yibo Qu et al. · [PDF](https://dl.acm.org/doi/pdf/10.1145/3728982) · [Code](https://github.com/QYbPtqyb/ICEPRE) · [Full entry](https://awesomerea.org/papers/paper-icepre/)} - [**Unleashing the Power of LLM to Infer State Machine From the Protocol Implementation**](https://doi.org/10.1109/IWQoS65803.2025.11143461) - ProtocolGPT infers protocol state machines from implementation source code with a retrieval-augmented LLM. _{IWQoS 2025 · Conference paper · Haiyang Wei et al. · [PDF](https://arxiv.org/pdf/2405.00393v4) · [Full entry](https://awesomerea.org/papers/paper-protocolgpt/)} - [**BinPRE: Enhancing Field Inference in Binary Analysis Based Protocol Reverse Engineering**](https://dl.acm.org/doi/10.1145/3658644.3690299) - Infers protocol-message field boundaries and semantics from instrumented server binaries and input messages. _{ACM CCS 2024 · Conference paper · Jiayi Jiang et al. · [PDF](https://tingsu.github.io/files/ccs24-BinPRE.pdf) · [Code](https://github.com/ecnusse/BinPRE) · [Full entry](https://awesomerea.org/papers/paper-binpre/)} - [**DynPRE: Protocol Reverse Engineering via Dynamic Inference**](https://www.ndss-symposium.org/ndss-paper/dynpre-protocol-reverse-engineering-via-dynamic-inference/) - DynPRE starts from captured client–server traces and then interacts with a live protocol server to infer message formats and types. _{NDSS 2024 · Conference paper · Zhengxiong Luo et al. · [PDF](https://www.ndss-symposium.org/wp-content/uploads/2024-83-paper.pdf) · [Full entry](https://awesomerea.org/papers/paper-dynpre/)} - [**Lifting Network Protocol Implementation to Precise Format Specification with Security Applications**](https://dl.acm.org/doi/10.1145/3576915.3616614) - NetLifter statically lifts source-available C protocol parsers into BNF-style message grammars and first-order constraints between packet fields. _{ACM CCS 2023 · Conference paper · Qingkai Shi et al. · [PDF](https://qingkaishi.github.io/public_pdfs/CCS23.pdf) · [Code](https://github.com/qingkaishi/netlifter) · [Full entry](https://awesomerea.org/papers/paper-netlifter/)} - [**Extracting Protocol Format as State Machine via Controlled Static Loop Analysis**](https://arxiv.org/abs/2305.13483) - The paper extracts protocol message formats from parser code by analyzing parsing loops as state machines. _{arXiv 2023 · Preprint · Qingkai Shi et al. · [PDF](https://arxiv.org/pdf/2305.13483) · [Full entry](https://awesomerea.org/papers/paper-protocol-format-state-machine/)} - [**BinaryInferno: A Semantic-Driven Approach to Field Inference for Binary Message Formats**](https://www.ndss-symposium.org/ndss-paper/binaryinferno-a-semantic-driven-approach-to-field-inference-for-binary-message-formats/) - Infers partial binary-message formats from static message samples without instrumenting an executable. _{NDSS 2023 · Conference paper · Jared Chandler et al. · [PDF](https://www.ndss-symposium.org/wp-content/uploads/2023/02/ndss2023_s131_paper.pdf) · [Code](https://github.com/binaryinferno/binaryinferno) · [Full entry](https://awesomerea.org/papers/paper-binaryinferno/)} - [**The Closer You Look, The More You Learn: A Grey-box Approach to Protocol State Machine Learning**](https://doi.org/10.1145/3548606.3559365) - StateInspector learns protocol Mealy machines by combining active message queries with snapshots of runtime memory, without requiring the target’s source code. _{ACM CCS 2022 · Conference paper · Chris McMahon Stone et al. · [PDF](https://tomchothia.gitlab.io/Papers/greyboxstatelearning_ccs2022.pdf) · [Code](https://github.com/ChrisMcMStone/state-inspector) · [Full entry](https://awesomerea.org/papers/paper-stateinspector/)} - [**Fingerprinting and analysis of Bluetooth devices with automata learning**](https://doi.org/10.1007/s10703-023-00425-y) - Learns Mealy-machine models of Bluetooth Low Energy implementations on physical peripherals by active automata learning. _{Formal Methods in System Design 2022 · Journal article · Andrea Pferscher et al. · [PDF](https://arxiv.org/pdf/2211.16074v2) · [Code](https://github.com/apferscher/ble-learning) · [Full entry](https://awesomerea.org/papers/paper-ble-automata-learning/)} - [**Automated Attack Synthesis by Extracting Finite State Machines from Protocol Specification Documents**](https://arxiv.org/abs/2202.09470) - Extracts protocol FSMs from RFC prose using technical word representations, zero-shot text mapping, and rules, then uses the extracted FSMs to synthesize attacks. _{IEEE Symposium on Security and Privacy 2022 · Conference accepted · Maria Leonor Pacheco et al. · [PDF](https://arxiv.org/pdf/2202.09470) · [Full entry](https://awesomerea.org/papers/paper-attack-synthesis-fsm/)} - [**Noncompliance as Deviant Behavior: An Automated Black-box Noncompliance Checker for 4G LTE Cellular Devices**](https://dl.acm.org/doi/10.1145/3460120.3485388) - DIKEUE checks 4G LTE control-plane (NAS and RRC) implementations in commercial phones and modems for noncompliance through differential testing rather than predefined security properties. _{ACM CCS 2021 · Conference paper · Syed Rafiul Hussain et al. · [PDF](https://syed-rafiul-hussain.github.io/wp-content/uploads/2021/09/dikeue.pdf) · [Code](https://github.com/SyNSec-den/DIKEUE/tree/5975807883265e275ef533f18a0c21b56e3b4e8a) · [Full entry](https://awesomerea.org/papers/paper-dikeue/)} - [**NetPlier: Probabilistic Network Protocol Reverse Engineering from Message Traces**](https://www.ndss-symposium.org/ndss-paper/netplier-probabilistic-network-protocol-reverse-engineering-from-message-traces/) - Uses multiple sequence alignment and probabilistic keyword-field inference to cluster network messages by type, evaluated across ten protocols with downstream format and state-machine analysis. _{NDSS 2021 · Conference paper · Yapeng Ye et al. · [PDF](https://www.ndss-symposium.org/wp-content/uploads/ndss2021_4A-5_24531_paper.pdf) · [Code](https://github.com/yapengye/NetPlier) · [Full entry](https://awesomerea.org/papers/paper-netplier/)} - [**LibreCAN: Automated CAN Message Translator**](https://dl.acm.org/doi/10.1145/3319535.3363190) - LibreCAN reverse-engineers proprietary CAN message formats from traffic recorded at a vehicle's OBD-II port, without the OEM's DBC translation files. _{ACM CCS 2019 · Conference paper · Mert D. Pesé et al. · [PDF](https://rtcl.eecs.umich.edu/rtclweb/assets/publications/2019/fv075-peseA.pdf) · [Full entry](https://awesomerea.org/papers/paper-librecan/)} - [**Automatic Wireless Protocol Reverse Engineering**](https://www.usenix.org/conference/woot19/presentation/pohl) - Infers message formats of proprietary wireless protocols from demodulated physical-layer captures: it aligns messages by preamble and sync word, then uses RSSI and dedicated engines to label length, address, sequence-number and checksum fields, optionally using known addresses or field positions. _{13th USENIX Workshop on Offensive Technologies (WOOT 19) 2019 · Conference paper · Johannes Pohl et al. · [PDF](https://www.usenix.org/system/files/woot19-paper_pohl.pdf) · [Code](https://github.com/jopohl/urh) · [Full entry](https://awesomerea.org/papers/paper-wireless-protocol-re/)} - [**NEMESYS: Network Message Syntax Reverse Engineering by Analysis of the Intrinsic Structure of Individual Messages**](https://www.usenix.org/conference/woot18/presentation/kleber) - Infers approximate field boundaries within individual binary-protocol messages from changes in bit congruence, and introduces Format Match Score to compare inferred segmentation with known protocol dissectors. _{12th USENIX Workshop on Offensive Technologies (WOOT 18) 2018 · Conference paper · Stephan Kleber et al. · [PDF](https://www.usenix.org/system/files/conference/woot18/woot18-paper-kleber.pdf) · [Code](https://github.com/vs-uulm/nemesys) · [Full entry](https://awesomerea.org/papers/paper-nemesys/)} - [**Towards Automated Protocol Reverse Engineering Using Semantic Information**](https://dl.acm.org/doi/10.1145/2590296.2590346) - Infers the vocabulary of an undocumented protocol, its message types and formats, from communication traces. _{ACM ASIA CCS 2014 · Conference paper · Georges Bossert et al. · [PDF](https://dl.acm.org/doi/pdf/10.1145/2590296.2590346) · [Code](https://github.com/netzob/netzob) · [Full entry](https://awesomerea.org/papers/paper-netzob/)} - [**Prospex: Protocol Specification Extraction**](https://ieeexplore.ieee.org/document/5207640) - Prospex infers message formats and a protocol state machine from execution traces of a Linux server handling client sessions. _{IEEE S&P 2009 · Conference paper · Paolo Milani Comparetti et al. · [PDF](https://sites.cs.ucsb.edu/~chris/research/doc/oakland09_prospex.pdf) · [Full entry](https://awesomerea.org/papers/paper-prospex/)} - [**Tupni: Automatic Reverse Engineering of Input Formats**](https://dl.acm.org/doi/10.1145/1455770.1455820) - Tupni infers an input format from an execution trace of an x86 program parsing one input, using byte-level dynamic taint tracking. _{ACM CCS 2008 · Conference paper · Weidong Cui et al. · [PDF](https://dl.acm.org/doi/pdf/10.1145/1455770.1455820) · [Full entry](https://awesomerea.org/papers/paper-tupni/)} - [**Polyglot: Automatic Extraction of Protocol Message Format using Dynamic Binary Analysis**](https://dl.acm.org/doi/10.1145/1315245.1315286) - Polyglot infers the format of a message that a program receives by monitoring how the program binary processes it, an approach the authors call shadowing. _{ACM CCS 2007 · Conference paper · Juan Caballero et al. · [PDF](https://dl.acm.org/doi/pdf/10.1145/1315245.1315286) · [Full entry](https://awesomerea.org/papers/paper-polyglot/)}