DIRECT : A Transformer-based Model for Decompiled Identifier Renaming (2021)

Abstract: Decompiling binary executables to high-level code is an important step in reverse engineering scenarios, such as malware analysis and legacy code maintenance. However, the generated high-level code is difficult to understand since the original variable names are lost. In this paper, we leverage transformer models to reconstruct the original variable names from decompiled code. Inherent differences between code and natural language present certain challenges in applying conventional transformer-based architectures to variable name recovery. We propose DIRECT, a novel transformer-based architecture customized specifically for the task at hand. We evaluate our model on a dataset of decompiled functions and find that DIRECT outperforms the previous state-of-the-art model by up to 20%. We also present ablation studies evaluating the impact of each of our modifications. We make the source code of DIRECT available to encourage reproducible research.

## introduction proprietary software often comes in binary form, making it difficult to comprehend its functionality, as many high-level code abstractions (e.g., meaningful variable names, code structures, etc.) are lost when source code is compiled to binaries. to extract meaningful information from binaries, software analysts typically use reverse engineering that converts binary executables into another form that can be more easily comprehended @xcite . reverse engineering is often applied in binary code inspection, legacy software maintenance, malware analysis, and cyber forensics. for example, reverse engineering uncovered the rebirth of zeus malware variants during the coronavirus pandemic of 2020 @xcite . traditionally, the primary reverse engineering tools are disassemblers, which extract assembly instructions from a binary executable. however, in recent years, decompilers like ghidra @xcite and hex rays (hex-rays) have become practical and popular. they produce a source code-like approximation of the binary code as shown in figure 1 . while these tools can retrieve the approximate code structure, they introduce variable names that have no semantic meaning, drastically reducing code readability and comprehensibility @xcite @xcite . ## design figure 2 provides an overview of direct. in this section we detail each of the problems we encountered and the design decision solutions. ## conclusion and future work the problem of variable name reconstruction poses certain challenges for traditional transformer-based models. specifically, the variable length of the prediction target, the constraints imposed by code syntax, architecture limitations that make long sequences difficult, and the task specific nonuniformity of token significance. in this work, we developed a series of solutions to address these issues, namely 1) an encoding/decoding scheme to handle arbitrary sub-token length prediction, 2) a specialized prediction algorithm, 3) a customized identifier token coefficient weighting scheme, and 4) a splitting and combining algorithm for standard transformers to handle sequences of arbitrary length. in addition to empirical studies evaluating the effectiveness of each of these techniques, we also combined them to create direct, a practical open-sourced identifier renaming engine. we evaluated direct using a standard benchmark dataset against the state of the art, dire @xcite , and found that direct provides a 20% improvement. we hope that in addition to an opensourced tool, this work functions as a roadmap for other researchers trying to solve the types of problems we encountered when adapting transformerbased models to code analysis tasks. future work could leverage the abstract syntax tree (ast) of each function, and employ new transformer architectures like xlnet @xcite to avoid splitting up the input while handling longer sequences. our approach might also improve the results of other code analysis tasks like type inference, function re-naming, docstring prediction, and function boundary identification.