EVENT DOSSIER
The study proposes the Decompile-Diverge tool to detect the issue where LLM decompilers lose key behaviors during code refactoring. Tests based on eight systems, nine configurations, and real GitHub function and CVE vulnerability data revealed that although the refactoring rate increased from 75% to 90% with Ghidra, the behavior matching rate dropped to 62%. Among 300 test cases, the overall difference rate was 4.9%, with some systems reaching up to 13%. Refactored code with disclosed vulnerabilities completely lacked crash traces. Existing testing suites could not detect such failures, while the new tool identifies deviations by comparing the behavior changes of refactored code under the same inputs using synthetic drivers and fuzzy testing datasets. Analysis shows that this divergence stems from LLMs replacing unknown placeholders left by traditional tools with introduced fields, types, call relationships, and guard conditions.
LLM 反编译器在重构代码时可能丢失关键行为，本文提出 Decompile-Diverge 工具以检测此类偏差。研究基于八种系统九种配置及真实 GitHub 函数与 CVE 漏洞数据发现，尽管 LLM 反编译器的可重构率从 Ghidra 的 75% 提升至 90%，但其行为匹配率却降至 62%；在 300 个测试用例中，4.9% 的整体差异率最高达单系统的 13%，且部分已披露漏洞的重构代码中完全缺失崩溃痕迹。现有测试套件无法捕捉此类失效，而新工具通过合成驱动程序与模糊测试语料库，对比重构代码在相同输入下的行为变化以识别偏差。分析表明，这种分歧源于 LLM 将传统工具留下的未知占位符替换为引入的字段、类型、调用关系及守卫条件。