No Bit Left Behind: Using Brute-Force Lifting to Achieve Fully Static Binary Recompilation

• URL: http://arxiv.org/abs/2609.16423v1
• Date: Mon, 14 Sep 2026 23:00:09 GMT
• Title: No Bit Left Behind: Using Brute-Force Lifting to Achieve Fully Static Binary Recompilation
• Abstract summary: This article presents a fully static, whole-program binary lifting system requiring no runtime translation support on the target.<n>We have implemented this approach as a prototype binary runtimer from x86-64 binaries to LLVM IR, requiring no code/data runtimes.
• Score: 1.5034998782245808
• License: http://creativecommons.org/licenses/by-sa/4.0/
• Abstract: Binary recompilation is a technique for operating directly on executable code. It promises to automate two important tasks: retrofitting security mitigations onto legacy binaries, and migrating binaries across instruction set architectures (ISAs). Yet today, there is no fully automated system that can reliably lift arbitrary binary executables to a compiler intermediate representation (IR) such as LLVM IR, or that can fully statically and reliably translate non-trivial binary executables from one ISA to another. The main underlying problem is that recovering a program's control flow graph (CFG) statically is impossible in general: computed branches can jump to targets that cannot be determined without actually running the program. Existing systems resort to runtime fallback mechanisms, requiring a significant portion of the binary translation machinery to accompany the translated program on the target machine. This article presents a fully static, whole-program binary lifting system requiring no runtime translation support on the target. Rather than attempting to distinguish code from data, we treat every byte offset as a potential branch target and lift the entire binary in a brute-force manner, constructing a superset CFG that conservatively contains all feasible control flows. Statically unresolvable computed branches are thereby reduced to lookups in a dispatch table that points to the corresponding translated control flow path. We have implemented this approach as a prototype binary recompiler from x86-64 binaries to LLVM IR, requiring no code/data heuristics. We validate it with a fully static cross-compilation to AArch64, achieved by reusing existing LLVM backends with no modification.

Related papers

• SEDCoT: Enhancing LLM-Based COBOL Code Translation via Symbolic Execution and Delta Debugging [49.898541267264115]
  Maintenance is increasingly challenging due to outdated technologies, sparse documentation, and developer retirement.<n>Traditional rule-based transcompilers yield outputs that are difficult to read and maintain.<n>We propose SEDCoT, a novel-to-C translation framework.
  arXiv  Detail & Related papers  (2026-07-05T03:07:10Z)
• Decaf: Improving Neural Decompilation with Automatic Feedback and Search [64.02615739798277]
  High-level syntax, identifiers, and custom data types are generally lost as the compiler translates human-readable code to low-level machine code.<n>Generative AI models are a natural fit for reconstructing high-level syntax, identifiers, and types.<n>We argue that compiler feedback can be used to dramatically improve the semantic correctness of neural decompiler outputs via search.
  arXiv  Detail & Related papers  (2026-05-12T04:21:26Z)
• Deterministic Fully-Static Whole-Binary Translation without Heuristics [4.112095753709181]
  Elevator translates entire x86-64 executables to AArch64 debug information, source code, or assumptions about code layout.<n>We evaluate Elevator on a diverse corpus of real-world binaries, including the entire SPECint 2006 suite.
  arXiv  Detail & Related papers  (2026-05-08T19:25:06Z)
• Constraint-Guided Multi-Agent Decompilation for Executable Binary Recovery [47.704311990064554]
  Decompilation is essential for security analysis, malware reverse engineering, and legacy software maintenance.<n>We present a multi-agent framework that transforms decompiled code into re-executable source through Multi-level Constraint-Guided Decompilation (MCGD)<n>Our framework achieves 84-97% re-executability, improving baseline decompiler output by 28-89 percentage points.
  arXiv  Detail & Related papers  (2026-04-27T01:28:11Z)
• Superset Decompilation [7.989066784325648]
  decompilation is the reverse of compilation and can be structured as a sequence of modular passes.<n>We formalize this as provenance-guided superset decompilation (PGSD), a framework that monotonically derives facts about the binary into a relation store.<n>Mandel implements PGSD as a declarative reverse engineering framework that lifts Linux ELF binaries to C99 through a granular intermediate representation in 35K lines of Rust and Datalog.
  arXiv  Detail & Related papers  (2026-03-30T03:47:19Z)
• PCodeTrans: Translate Decompiled Pseudocode to Compilable and Executable Equivalent [8.576619291429969]
  PCodeTrans bridges the gap between decompilation, recompilation, and rigorous function-level dynamic validation.<n>It achieves 100% function-level compilability on unstripped binaries alongside 99.55% and 99.89% test-validated behavioral consistency.
  arXiv  Detail & Related papers  (2026-03-16T05:54:24Z)
• Residual Context Diffusion Language Models [90.07635240595926]
  Residual Context Diffusion (RCD) is a module that converts discarded token representations into contextual residuals and injects them back for the next denoising step.<n>RCD consistently improves frontier dLLMs by 5-10 points in accuracy with minimal extra computation overhead.
  arXiv  Detail & Related papers  (2026-01-30T13:16:32Z)
• Context-Guided Decompilation: A Step Towards Re-executability [50.71992919223209]
  Binary decompilation plays an important role in software security analysis, reverse engineering and malware understanding.<n>Recent advances in large language models (LLMs) have enabled neural decompilation, but the generated code is typically only semantically plausible.<n>We propose ICL4Decomp, a hybrid decompilation framework that leverages in-context learning (ICL) to guide LLMs toward generating re-executable source code.
  arXiv  Detail & Related papers  (2025-11-03T17:21:39Z)
• ReF Decompile: Relabeling and Function Call Enhanced Decompile [50.86228893636785]
  The goal of decompilation is to convert compiled low-level code (e.g., assembly code) back into high-level programming languages.<n>This task supports various reverse engineering applications, such as vulnerability identification, malware analysis, and legacy software migration.
  arXiv  Detail & Related papers  (2025-02-17T12:38:57Z)
• LeanBin: Harnessing Lifting and Recompilation to Debloat Binaries [1.1749374602770741]
  LeanBin is a new binary debloating and specialization tool. It harnesses lifting and recompilation, based on observed execution traces.
  arXiv  Detail & Related papers  (2024-06-23T16:46:05Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.