LLMs Enable Brute-Force Decompilation of Binary Programs, Raising Software Security Concerns

Summary

A researcher has demonstrated that Large Language Models can successfully automate the decompilation and modernization of compiled binary programs, specifically targeting a legacy Multi-user Dungeon (MUD) game. The approach leverages LLMs' natural strengths in summarization and translation to convert decompiled pseudo-C code from tools like Ghidra into modern, readable programming languages. The researcher chose an old MajorMUD binary specifically because its source code was never included in LLM training data, ensuring the model couldn't simply recall memorized code.

The technique combines decompilation tools with LLM-powered code conversion and differential testing to verify functional equivalence. While initial attempts to work directly with assembly code failed, using Ghidra's pseudo-C output as an intermediate representation proved effective. The approach is not limited to legacy games—it applies equally to modernizing enterprise binaries or converting legacy COBOL systems to contemporary languages.

The research highlights two key LLM capabilities: their ability to identify patterns across large codebases (summarization) and perform accurate language-to-language translation. With sufficiently large context windows, LLMs can understand how variables and functions are used throughout decompiled code, despite the loss of human-readable names and other metadata during compilation. The researcher suggests that with proper resources, fine-tuning models specifically for decompilation could yield even stronger results, as the task represents a closed system with verifiable correct outcomes.

• The technique uses differential testing to verify that converted code maintains functional equivalence with original binaries

Editorial Opinion

This research represents a watershed moment for both software preservation and cybersecurity. While the ability to resurrect and modernize legacy software with lost source code offers tremendous value for maintaining critical infrastructure, it simultaneously demolishes a long-held assumption that compiled binaries provide meaningful protection for proprietary algorithms. Organizations relying on binary obfuscation for intellectual property protection should take note—the era of "security through compilation" is effectively over.