# How to write C decompiler using AI?

I would like to learn more whether it is possible and how to write a program which decompiles executable binary (an object file) to the C source. I'm not asking exactly 'how', but rather how this can be achieved.

Given the following hello.c file (as example):

#include <stdio.h>
int main() {
printf("Hello World!");
}


Then after compilation (gcc hello.c) I've got the binary file like:

$hexdump -C a.out | head 00000000 cf fa ed fe 07 00 00 01 03 00 00 80 02 00 00 00 |................| 00000010 0f 00 00 00 b0 04 00 00 85 00 20 00 00 00 00 00 |.......... .....| 00000020 19 00 00 00 48 00 00 00 5f 5f 50 41 47 45 5a 45 |....H...__PAGEZE| 00000030 52 4f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |RO..............| 00000040 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 |................| 00000050 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 00000060 00 00 00 00 00 00 00 00 19 00 00 00 d8 01 00 00 |................| 00000070 5f 5f 54 45 58 54 00 00 00 00 00 00 00 00 00 00 |__TEXT..........|$ wc -c hello.c a.out
60 hello.c
8432 a.out


For the learning dataset I assume I'll have to have thousands of source code files along with its binary representation, so algorithm can learn about moving parts on certain changes.

My concerns are:

• do my algorithm needs to be aware about the header file, or it's "smart" enough to figure it out,
• if it needs to know about the header, how do I tell my algorithm 'here is the header file',
• what should be input/output mapping (whether some section to section or file to file),
• do I need to divide my source code into some sections,
• do I need to know exactly how decompilers work or AI can figure it out for me,
• or should I've two networks, one for header, another for body it-self,
• or more separate networks, each one for each logical component (e.g. byte->C tag, etc.)

How would you tackle this?

• Imagine what would happen to those programs which are closed-source if this decompiler is created! – skrtbhtngr Nov 12 '16 at 19:10

## 1 Answer

In-between your input and desired output, there's obviously a huge space to search. The more relevant domain information you include as features, the higher chance that the Deep Learning (DL) algorithm can find the desired mapping.

At this early stage in DL research, there aren't so many rules of thumb to tell you what features to explicitly encode - not least because it depends on the size of your training corpus. My suggestion would be: obtain (or generate) a large corpus of C code, train on that with the most naive feature representation that you think might work, then repeatedly gather data and add more feature preprocessing as necessary.

This following paper describes a DL approach to what is almost the 'reverse problem' to yours - generating the source code for a program described in natural language.

I found the strength of the results reported in this paper surprising, but it does give me some hope that what you are asking might be possible.