Deobfuscation techniques play a crucial role in enhancing the readability and analyzability of obfuscated code, thereby facilitating more effective reverse engineering and security analysis. However, the majority of existing deobfuscation research has primarily focused on the source code level, with limited effectiveness in deobfuscating binary code. Despite the emergence of Large Language Models (LLMs) and their effective application in the deobfuscation domain, there remains a lack of research leveraging LLMs for deobfuscating ARM binary code. In this paper, we construct a high-quality dataset of obfuscated ARM assembly code, comprising seven types of single obfuscations and seven types of multiple obfuscations. Based on this, we propose LLM-DAS, the first deobfuscation system specifically designed for ARM binary code and grounded in large language models. LLM-DAS consists of two finetuned large models tailored for obfuscation detection and deobfuscation, respectively, and we evaluate its performance. The experimental results demonstrate that the obfuscation detection component achieves an average accuracy and precision of 91.96% and 94.94%, respectively. In terms of deobfuscation performance, it attains a maximum average SacreBLEU score of 26.21, representing improvements of 20.09 and 17.11 compared to Llama3 and Qwen2.5, which have the same parameter scale. Furthermore, when evaluated against three metrics within the Obfuscation Quality Quantification Framework, LLM-DAS also outperforms the aforementioned two models.

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

LLM-DAS: An LLM-Powered Deobfuscation System for ARM Binary Code

  • Jiahan Liu,
  • Jing Jing,
  • Jian Lin,
  • Haonan Sun,
  • Bing Zhu

摘要

Deobfuscation techniques play a crucial role in enhancing the readability and analyzability of obfuscated code, thereby facilitating more effective reverse engineering and security analysis. However, the majority of existing deobfuscation research has primarily focused on the source code level, with limited effectiveness in deobfuscating binary code. Despite the emergence of Large Language Models (LLMs) and their effective application in the deobfuscation domain, there remains a lack of research leveraging LLMs for deobfuscating ARM binary code. In this paper, we construct a high-quality dataset of obfuscated ARM assembly code, comprising seven types of single obfuscations and seven types of multiple obfuscations. Based on this, we propose LLM-DAS, the first deobfuscation system specifically designed for ARM binary code and grounded in large language models. LLM-DAS consists of two finetuned large models tailored for obfuscation detection and deobfuscation, respectively, and we evaluate its performance. The experimental results demonstrate that the obfuscation detection component achieves an average accuracy and precision of 91.96% and 94.94%, respectively. In terms of deobfuscation performance, it attains a maximum average SacreBLEU score of 26.21, representing improvements of 20.09 and 17.11 compared to Llama3 and Qwen2.5, which have the same parameter scale. Furthermore, when evaluated against three metrics within the Obfuscation Quality Quantification Framework, LLM-DAS also outperforms the aforementioned two models.