Analyzing Chain of Thought (CoT) Approaches in Control Flow Code Deobfuscation Tasks

• URL: http://arxiv.org/abs/2604.15390v2
• Date: Thu, 23 Apr 2026 11:47:08 GMT
• Title: Analyzing Chain of Thought (CoT) Approaches in Control Flow Code Deobfuscation Tasks
• Abstract summary: Chain-of-Thought (CoT) prompting is guided through explicit, step-by-step reasoning tailored for code analysis.<n>We focus on control flow obfuscation, including Control Flow Flattening (CFF), Opaque Predicates, and their combination.<n>We show that CoT prompting significantly improves deobfuscation quality compared with simple prompting.
• Score: 39.1560117358229
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Code deobfuscation is the task of recovering a readable version of a program while preserving its original behavior. In practice, this often requires days or even months of manual work with complex and expensive analysis tools. In this paper, we explore an alternative approach based on Chain-of-Thought (CoT) prompting, where a large language model is guided through explicit, step-by-step reasoning tailored for code analysis. We focus on control flow obfuscation, including Control Flow Flattening (CFF), Opaque Predicates, and their combination, and we measure both structural recovery of the control flow graph and preservation of program semantics. We evaluate five state-of-the-art large language models and show that CoT prompting significantly improves deobfuscation quality compared with simple prompting. We validate our approach on a diverse set of standard C benchmarks and report results using both structural metrics for control flow graphs and semantic metrics based on output similarity. Among the tested models and by applying CoT, GPT5 achieves the strongest overall performance, with an average gain of about 16% in control-flow graph reconstruction and about 20.5% in semantic preservation across our benchmarks compared to zero-shot prompting. Our results also show that model performance depends not only on the obfuscation level and the chosen obfuscator but also on the intrinsic complexity of the original control flow graph. Collectively, these findings suggest that CoT-guided large language models can serve as effective assistants for code deobfuscation, providing improved code explainability, more faithful control flow graph reconstruction, and better preservation of program behavior while potentially reducing the manual effort needed for reverse engineering.

Related papers

• From Open Loop to Closed Loop: A Test-Time Iterative Optimization Framework for Reference-Consistent Image Generation [108.02425846269234]
  controllable image generation has made significant strides by incorporating visual reference conditions.<n>Existing methods predominantly operate as open-loop systems.<n>We propose a novel test-time iterative optimization framework that reformulates reference-consistent generation as a closed-loop dynamic tracking problem.
  arXiv  Detail & Related papers  (2026-07-06T05:36:30Z)
• Heaviside Continuity of Rolling Coefficients for Eliminating Epistemic Entropy in Large Language Models [0.0]
  Heaviside Continuity of Rolling Coefficients (HCRC) is a verification-first execution framework.<n>It reformulates inference as predicate-gated state transitions governed by a Heaviside Gate.<n>HCRC combines model confidence with independent verification signals from a parallel worker architecture, allowing execution to advance only when correctness predicates are satisfied.
  arXiv  Detail & Related papers  (2026-07-06T00:29:34Z)
• The Code Whisperer: LLM and Graph-Based AI for Smell and Vulnerability Resolution [42.25743513043402]
  The Code Whisperer is a hybrid framework that combines graph-based program analysis with large language models to detect, explain, and repair maintainability and security issues.<n>We evaluate the framework on multi-language datasets and compare it with rule-based analyzers and single-model baselines.
  arXiv  Detail & Related papers  (2026-04-12T20:10:48Z)
• Autonomous Chain-of-Thought Distillation for Graph-Based Fraud Detection [73.9189065770752]
  Graph-based fraud detection on text-attributed graphs (TAGs) requires jointly modeling rich textual semantics and relational dependencies.<n>We propose FraudCoT, a unified framework that advances TAG-based fraud detection through autonomous, graph-aware chain-of-thought (CoT) reasoning and scalable LLM-GNN co-training.
  arXiv  Detail & Related papers  (2026-01-30T13:12:12Z)
• Larger Is Not Always Better: Leveraging Structured Code Diffs for Comment Inconsistency Detection [3.0208923532626444]
  Comment inconsistency arises when developers modify code but neglect to update the corresponding comments.<n>Recent approaches to code-comment inconsistency (CCI) detection leverage Large Language Models (LLMs)<n>We propose a Just-In-Time CCI detection approach built upon the CodeT5+ backbone.
  arXiv  Detail & Related papers  (2025-12-22T21:17:31Z)
• Can LLMs Recover Program Semantics? A Systematic Evaluation with Symbolic Execution [1.5377279217726239]
  Obfuscation poses a persistent challenge for software engineering tasks such as program comprehension, maintenance, testing, and vulnerability detection.<n>We investigate whether fine-tuned language models can effectively deobfuscate programs and restore analyzability.
  arXiv  Detail & Related papers  (2025-11-24T13:55:20Z)
• CodeRL+: Improving Code Generation via Reinforcement with Execution Semantics Alignment [98.87395842351627]
  Large Language Models (LLMs) excel at code generation by learning from vast code corpora.<n>A fundamental semantic gap remains between their training on textual patterns and the goal of functional correctness.<n>We propose CodeRL+, a novel approach that integrates execution semantics alignment into the RLVR training pipeline for code generation.
  arXiv  Detail & Related papers  (2025-10-21T09:48:06Z)
• Scaling Code-Assisted Chain-of-Thoughts and Instructions for Model Reasoning [65.20602712957725]
  Caco is a novel framework that automates the synthesis of high-quality, verifiable, and diverse instruction-CoT reasoning data.<n>Our work establishes a paradigm for building self-sustaining, trustworthy reasoning systems without human intervention.
  arXiv  Detail & Related papers  (2025-10-05T07:59:24Z)
• ReF Decompile: Relabeling and Function Call Enhanced Decompile [50.86228893636785]
  The goal of decompilation is to convert compiled low-level code (e.g., assembly code) back into high-level programming languages.<n>This task supports various reverse engineering applications, such as vulnerability identification, malware analysis, and legacy software migration.
  arXiv  Detail & Related papers  (2025-02-17T12:38:57Z)
• VisualCoder: Guiding Large Language Models in Code Execution with Fine-grained Multimodal Chain-of-Thought Reasoning [10.70881967278009]
  We introduce VisualCoder, a simple yet effective approach that enhances code reasoning by integrating multimodal Chain-of-Thought snippets (CoT) reasoning with a visual Control Flow Graph (CFG)<n>We address challenges in multimodal CoT integration through a reference mechanism, ensuring consistency between code and its execution path, thereby improving performance in program behavior prediction, error detection, and output generation.
  arXiv  Detail & Related papers  (2024-10-30T19:07:01Z)
• A Transformer-based Approach for Source Code Summarization [86.08359401867577]
  We learn code representation for summarization by modeling the pairwise relationship between code tokens. We show that despite the approach is simple, it outperforms the state-of-the-art techniques by a significant margin.
  arXiv  Detail & Related papers  (2020-05-01T23:29:36Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.