[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"doc-detail-82353-en":3,"doc-seo-82353-105":29,"detail-sidebar-cat-0-en-105":91},{"code":4,"msg":5,"data":6},0,"success",{"doc_id":7,"user_id":8,"nickname":9,"user_avatar":10,"doc_module":4,"category_id":11,"category_name":12,"doc_title":13,"doc_description":14,"doc_content":15,"file_id":16,"file_url":17,"file_type":18,"file_size":19,"view_count":20,"is_deleted":4,"is_public":20,"is_downloadable":20,"audit_status":20,"page_count":21,"language":22,"language_code":23,"site_id":24,"html_lang":23,"table_of_contents":25,"faqs":26,"seo_title":13,"seo_description":14,"update_tm":27,"read_time":28},82353,687197207919,"Theodora","https://ap-avatar.wpscdn.com/avatar/a000253d6f5f7c60be?x-image-process=image/resize,m_fixed,w_180,h_180&k=1779446848396160552",6,"Technology","Practical Source Code Recovery from Binary Functions Using Anchor-Based Retrieval and LLM Reasoning","A practical pipeline recovers source code from stripped binary functions by integrating reverse engineering, anchor-based source code retrieval, and large language model reasoning. The method identifies the source function from a source code database rather than producing approximate decompiled pseudocode. It extracts anchors (strings, constants, external calls, and function names via Ghidra), retrieves candidate files through inverted-index search, narrows to likely snippets, and re-ranks with an LLM using disassembly, decompiled text, and source metadata. Confident matches become anchors in later passes.","arXiv :2607 .09452v 1 [ cs . SE] 10 Jul 2026  \nPractical Source Code Recovery from Binary Functions Using Anchor-Based Retrieval and LLM Reasoning  \nCharles Edward Gagnon 1[0009−0008−4647−4398], Steven H. H.  \nDing 1[0000−0003−4513−200X], Philippe Charland2[0000−0003−4051−9942], and  \nBenjamin C. M. Fung 1[0000−0001−8423−2906]  \n1 McGill University, Montreal, QC H3A 0G4, Canada [charles.e.gagnon@mail.mcgill.ca](charles.e.gagnon@mail.mcgill.ca) , {steven.h.ding, [ben.fung}@mcgill.ca](ben.fung}@mcgill.ca)  \n2 Defence Research and Development Canada  \nAbstract. We present a practical pipeline for recovering source code from stripped binary functions by combining reverse engineering, anchorbased source code retrieval, and large language model reasoning. Our binary-to-source-code retrieval method attempts to identify the source function from a source code database, rather than generating approximate decompiled pseudocode. It extracts anchors such as strings, constants, external calls, and available function names using Ghidra, retrieves candidate files via an inverted-index search database, narrows candidates to likely function snippets, and re-ranks them with a large language model (LLM) based on disassembly, decompiled code, and source metadata. Confident matches can also serve as anchors in later passes.  \nIn an evaluation backed by our high-fidelity source code database on a stripped, optimized tcpdump binary, our proposed binary-to-source matching method achieves 95 .2% assembly instruction coverage. Experiments on a GitHub-based retrieval database showed lower performance with 35.5% instruction coverage on average, mainly due to retrieval misses. These results show that source-level binary recovery excels with high-quality databases and remains a useful tool in noisy environments.  \nKeywords: Binary-to-source code matching · Reverse engineering · Source code recovery · Binary analysis · Anchor-based retrieval · Large language models.  \n1 Introduction  \nWith the ever-increasing rate of software production, reverse engineering unknown executables has become a major bottleneck for cybersecurity. Organizations must analyze a growing number of binaries originating from commercial software, malware samples, firmware images, and third-party dependencies. While software development has benefited greatly from automation and advancements in tooling, the reverse engineering process remains largely dependent on  \n2 C. Gagnon et al.  \nexpert analysts and manual investigation. As a result, the time required to understand and assess compiled software increasingly limits the speed at which security teams can investigate incidents and detect threats.  \nBinary code reverse engineering is a challenging task that, even today, requires heavy human intervention. No automatic reverse engineering tool exists because compilers are fundamentally irreversible functions [1] . A compiler strictly maintains the semantic rules of the underlying source code, but removes all other helpful information. With optimizations enabled, a compiler will liberally get rid of object identifiers, control-flow structures, logical ordering, data structures, and even whole functions. As such, even a perfect system cannot recover as much information from the compiled binary as what was initially present in the source code. There exists a variety of tools that try to automatically obtain pseudocode from binary code. These are usually categorized as decompilers [4] . However, more than a decompiler is needed to build a deep understanding of unknown software. The decompiled output represents the semantic meaning of the software, but lacks the structure, comments, and identifiers used by the developer to make sense of the code.  \nIn this work, we present a method that fully recovers the source code of unknown binary functions. Our approach takes advantage of the significant presence of open source software in modern applications [16,15] . Our method is practical because it read","cbCaitP4TQCtU7nk","https://ap.wps.com/l/cbCaitP4TQCtU7nk","pdf",423063,1,12,"English","en",105,"# Abstract\n# Introduction\n# Related Works","[{\"question\":\"What is the main goal of the proposed method?\",\"answer\":\"Recover source code for unknown, stripped binary functions by matching them to the correct source-level function in a database.\"},{\"question\":\"How does anchor-based retrieval work in this pipeline?\",\"answer\":\"It extracts anchors such as strings, constants, external calls, and available function names using Ghidra, then uses an inverted-index search database to retrieve candidate files and narrow them to likely function snippets.\"},{\"question\":\"How is the final matching decided using the LLM?\",\"answer\":\"A large language model re-ranks candidate snippets by evaluating disassembly, decompiled code, and source metadata; confident matches can also be reused as anchors in later passes.\"}]",1784179830,30,{"code":4,"msg":30,"data":31},"ok",{"site_id":24,"language":23,"slug":32,"title":13,"keywords":33,"description":14,"schema_data":34,"social_meta":86,"head_meta":88,"extra_data":90,"updated_unix":27},"practical-source-code-recovery-from-binary-functions-using-anchor-based-retrieval-and-llm-reasoning","",{"@graph":35,"@context":85},[36,53,68],{"@type":37,"itemListElement":38},"BreadcrumbList",[39,43,47,50],{"item":40,"name":41,"@type":42,"position":20},"https://docshare.wps.com","Home","ListItem",{"item":44,"name":45,"@type":42,"position":46},"https://docshare.wps.com/document/","Document",2,{"item":48,"name":12,"@type":42,"position":49},"https://docshare.wps.com/document/technology/",3,{"item":51,"name":13,"@type":42,"position":52},"https://docshare.wps.com/document/practical-source-code-recovery-from-binary-functions-using-anchor-based-retrieval-and-llm-reasoning/82353/",4,{"url":51,"name":13,"@type":54,"author":55,"headline":13,"publisher":57,"fileFormat":60,"inLanguage":23,"description":14,"dateModified":61,"datePublished":62,"encodingFormat":60,"isAccessibleForFree":63,"interactionStatistic":64},"DigitalDocument",{"name":9,"@type":56},"Person",{"url":40,"name":58,"@type":59},"DocShare","Organization","application/pdf","2026-07-17","2026-07-16",true,{"@type":65,"interactionType":66,"userInteractionCount":20},"InteractionCounter",{"@type":67},"ViewAction",{"@type":69,"mainEntity":70},"FAQPage",[71,77,81],{"name":72,"@type":73,"acceptedAnswer":74},"What is the main goal of the proposed method?","Question",{"text":75,"@type":76},"Recover source code for unknown, stripped binary functions by matching them to the correct source-level function in a database.","Answer",{"name":78,"@type":73,"acceptedAnswer":79},"How does anchor-based retrieval work in this pipeline?",{"text":80,"@type":76},"It extracts anchors such as strings, constants, external calls, and available function names using Ghidra, then uses an inverted-index search database to retrieve candidate files and narrow them to likely function snippets.",{"name":82,"@type":73,"acceptedAnswer":83},"How is the final matching decided using the LLM?",{"text":84,"@type":76},"A large language model re-ranks candidate snippets by evaluating disassembly, decompiled code, and source metadata; confident matches can also be reused as anchors in later passes.","https://schema.org",{"og:url":51,"og:type":87,"og:title":13,"og:site_name":58,"og:description":14},"article",{"robots":89,"canonical":51},"index,follow",{"doc_id":7,"site_id":24},{"code":4,"msg":5,"data":92},[93,97,101,105,110,113,118,122,127,130,134],{"id":20,"doc_module":4,"doc_module_name":45,"category_name":94,"show_sort_weight":95,"slug":96},"Story & Novel",90,"story-novel",{"id":46,"doc_module":4,"doc_module_name":45,"category_name":98,"show_sort_weight":99,"slug":100},"Literature",80,"literature",{"id":52,"doc_module":4,"doc_module_name":45,"category_name":102,"show_sort_weight":103,"slug":104},"Exam",70,"exam",{"id":106,"doc_module":4,"doc_module_name":45,"category_name":107,"show_sort_weight":108,"slug":109},5,"Comic",60,"comic",{"id":11,"doc_module":4,"doc_module_name":45,"category_name":12,"show_sort_weight":111,"slug":112},50,"technology",{"id":114,"doc_module":4,"doc_module_name":45,"category_name":115,"show_sort_weight":116,"slug":117},7,"Healthcare",40,"healthcare",{"id":119,"doc_module":4,"doc_module_name":45,"category_name":120,"show_sort_weight":28,"slug":121},8,"Research & Report","research-report",{"id":123,"doc_module":4,"doc_module_name":45,"category_name":124,"show_sort_weight":125,"slug":126},9,"Religion & Spirituality",20,"religion-spirituality",{"id":125,"doc_module":4,"doc_module_name":45,"category_name":128,"show_sort_weight":125,"slug":129},"World Cup","world-cup",{"id":131,"doc_module":4,"doc_module_name":45,"category_name":132,"show_sort_weight":131,"slug":133},10,"Lifestyle","lifestyle",{"id":135,"doc_module":4,"doc_module_name":45,"category_name":136,"show_sort_weight":106,"slug":137},19,"General","general"]