ReCopilot: Reverse Engineering Copilot in Binary Analysis

2025-05-22

AI Summary

Binary analysis tasks—such as function name recovery and variable type inference—rely heavily on expert knowledge and suffer from limited automation. To address this, we propose BinLLM, the first domain-specialized large language model for binary reverse engineering. Our method introduces (i) a novel context modeling mechanism that jointly encodes data-flow and call graphs to enhance semantic awareness; (ii) a test-time reasoning expansion strategy to strengthen long-chain logical reasoning; and (iii) a three-stage training paradigm comprising continual pretraining, supervised fine-tuning, and direct preference optimization. Evaluated on a comprehensive binary analysis benchmark, BinLLM achieves a 13% absolute accuracy improvement over state-of-the-art tools and general-purpose LLMs on both function naming and variable typing tasks. This advancement significantly reduces reliance on human expert knowledge while advancing automation in low-level program understanding.

Technology Category

• Machine Learning: Large Multimodal Models (LMMs)
• Natural Language Processing: (Large) Language Models
• Knowledge Representation and Reasoning: Logic Programming

Application Category

• Semantics and Knowledge: Data modeling to support human-machine intelligence, including LLMs agents, intelligent system behavior, explanations, and user-friendly interactions
• Search and Retrieval-Augmented AI: Search Tool Learning with LLM: Teaching LLMs to invoke search and make use of retrieved information
• User Modeling, Personalization and Recommendation: Large Language Models (LLM) for user modeling and recommendation

Abstract

Binary analysis plays a pivotal role in security domains such as malware detection and vulnerability discovery, yet it remains labor-intensive and heavily reliant on expert knowledge. General-purpose large language models (LLMs) perform well in programming analysis on source code, while binaryspecific LLMs are underexplored. In this work, we present ReCopilot, an expert LLM designed for binary analysis tasks. ReCopilot integrates binary code knowledge through a meticulously constructed dataset, encompassing continue pretraining (CPT), supervised fine-tuning (SFT), and direct preference optimization (DPO) stages. It leverages variable data flow and call graph to enhance context awareness and employs test-time scaling to improve reasoning capabilities. Evaluations on a comprehensive binary analysis benchmark demonstrate that ReCopilot achieves state-of-the-art performance in tasks such as function name recovery and variable type inference on the decompiled pseudo code, outperforming both existing tools and LLMs by 13%. Our findings highlight the effectiveness of domain-specific training and context enhancement, while also revealing challenges in building super long chain-of-thought. ReCopilot represents a significant step toward automating binary analysis with interpretable and scalable AI assistance in this domain.

Problem

• Automating labor-intensive binary analysis tasks
• Enhancing binary-specific LLMs for security applications
• Improving accuracy in function and variable analysis

Innovation

• Expert LLM for binary analysis tasks
• Integrates binary code via CPT, SFT, DPO
• Leverages data flow and call graphs