# Boosting Neural Networks to Decompile Optimized Binaries

Ying Cao, Ruigang Liang<EMAIL_ADDRESS>SKLOIS, IIE,
CAS333Institute of Information Engineering, Chinese Academy of Sciences.School
of CyberSecurity, UCAS444University of Chinese Academy of SciencesBeijingChina
,  Kai Chen<EMAIL_ADDRESS>SKLOIS, IIE, CAS333Institute of Information
Engineering, Chinese Academy of Sciences.School of CyberSecurity,
UCAS444University of Chinese Academy of SciencesBAAI555Beijing Academy of
Artificial IntelligenceBeijingChina and  Peiwei Hu<EMAIL_ADDRESS>SKLOIS,
IIE, CAS333Institute of Information Engineering, Chinese Academy of
Sciences.School of CyberSecurity, UCAS444University of Chinese Academy of
SciencesBeijingChina

(2022)

###### Abstract.

Decompilation aims to transform a low-level program language (LPL) (eg.,
binary file) into its functionally-equivalent high-level program language
(HPL) (e.g., C/C++). It is a core technology in software security, especially
in vulnerability discovery and malware analysis. In recent years, with the
successful application of neural machine translation (NMT) models in natural
language processing (NLP), researchers have tried to build neural decompilers
by borrowing the idea of NMT. They formulate the decompilation process as a
translation problem between LPL and HPL, aiming to reduce the human cost
required to develop decompilation tools and improve their generalizability.
However, state-of-the-art learning-based decompilers do not cope well with
compiler-optimized binaries. Since real-world binaries are mostly compiler-
optimized, decompilers that do not consider optimized binaries have limited
practical significance. In this paper, we propose a novel learning-based
approach named NeurDP, that targets compiler-optimized binaries. NeurDP uses a
graph neural network (GNN) model to convert LPL to an intermediate
representation (IR), which bridges the gap between source code and optimized
binary. We also design an Optimized Translation Unit (OTU) to split functions
into smaller code fragments for better translation performance. Evaluation
results on datasets containing various types of statements show that NeurDP
can decompile optimized binaries with 45.21% higher accuracy than state-of-
the-art neural decompilation frameworks.

††journalyear: 2022††copyright: rightsretained††conference: Annual Computer
Security Applications Conference; December 5–9, 2022; Austin, TX,
USA††booktitle: Annual Computer Security Applications Conference (ACSAC ’22),
December 5–9, 2022, Austin, TX, USA††doi: 10.1145/3564625.3567998††isbn:
978-1-4503-9759-9/22/12

##  1\. Introduction

In recent years, deep learning has made remarkable achievements in the fields
of code comprehension and reverse engineering. Some work is devoted to using
neural networks to learn representations of source code, such as GitHub
Copilot (copilot, ) and CodeBERT (feng2020codebert, ), which are widely used
in automatic code generation/completion and automatic comment generation.
Similarly, many previous studies leverage neural networks to learn binary or
assembly code representation. They perform well on binary-based downstream
analysis tasks, including code clone detection (ding2019asm2vec, ), malicious
code detection (downing_deepreflect_2021, ), and disassembly (pei2020xda, ).
The application of deep learning in software analysis and software reverse
engineering significantly reduces human resources and time costs, no matter
from the view of developers or analysts. In addition, compared to traditional
tools, the faster speed of deep neural-based disassembly approaches
(pei2020xda, ) makes them a powerful engine for downstream models like malware
classification. It is meaningful to study how to make neural network (NN)
models work well in software reverse engineering and software analysis.

Decompilation is a core technology in software reverse engineering and
software analysis (e.g., vulnerability discovery (elsabagh2020firmscope, ;
tian2018attention, ) and malware analysis (hernandez2020bigmac, ;
yakdan2016helping, )), especially adopted in the analysis of commercial
software whose source code is not available. The decompilation process can be
defined as translating a low-level PL (LPL) (e.g., binary file) into its
functionally-equivalent high-level PL (HPL) (e.g., C/C++). Developing a
traditional decompiler requires much work to manually reverse multiple
binaries to analyze and summarize the heuristic rules used in the decompiler.
The well-known open-source decompiler RetDec (kvroustek2017retdec, ) has
hundreds of developers who contributed code to it. However, since they
released the prototype in 2017, the decompilation performance is still
unsatisfactory (liu2020far, ). Due to the limited number of binaries analyzed
by PL experts, the decompilation rules are often incomplete. Moreover, the
rules might change with instruction set architecture, compilers, and HPL. It
is hard to construct a complete decompilation rule set. Therefore, decompilers
built on human-defined rules need to iterate continuously by summarizing the
rules and collecting feedback on the errors encountered by users. With the
help of neural-based approaches, expert efforts to generalize and revise rules
could be largely reduced.

Several neural-based approaches (katz2018using, ; katz2019towards, ;
fu2019coda, ) are explored to decompile LPL to HPL, hoping that the learning
algorithms can automatically learn the mapping rules between LPL and HPL. They
all used assembly code (ASM) as LPL and source code or abstract syntax tree
(AST) as HPL to train an end-to-end model. These schemes perform various
preprocessing on the input and output and design various model architectures
according to code characteristics. However, they still suffer a severe
drawback: none of these works can appropriately handle the decompilation of
optimized code. As compiler optimization is ubiquitously used, the ability to
decompile optimized code is essential for the practical application of neural-
based approaches.

Through extensive analysis and experimentation, we found that it is not easy
to train an end-to-end decompilation model that can handle optimized LPL.
Since deep learning models are data-driven, a high-quality training set is
critical to the model’s performance. Most models used in the source code or
reverse engineering domains rely on large, high-quality supervised or
unsupervised datasets. In contrast, there are very few mature datasets in the
field of decompilation, and datasets used in previous neural-based
decompilation studies are not built for the decompilation of optimized LPL.
Without a well-labeled dataset, it is difficult for the model to learn the
mapping rules between HPL and LPL. Although many open-source projects exist in
the real world, the source code and binary code cannot be completely matched
at the statement level due to code optimization (e.g., dead code elimination),
making it inaccurate to directly use source code as the labels for the
optimized binaries. We summarize the challenges as follows.

Challenges. C1: It is well known that statements of HPL are often
significantly refactored during compiler optimization, which makes it
challenging to make an exact match between the semantics of LPL and HPL. For
example, dead code elimination causes certain statements in HPL not to appear
in LPL. Loop unwinding can cause some code to appear multiple times in the
binary and only once in the source code. These optimization strategies all
lead to the code structure and semantic information in the text level of LPL
being quite different from HPL. In some cases, textually similar HPL codes
(only some variable names differ) can correspond to completely different LPL
codes, and vice versa. Therefore, it is not feasible to directly train end-to-
end models using HPL as the label of LPL, which makes it challenging to
capture the decompilation rules.

C2: Splitting LPL and HPL into code fragments with correct correspondence is a
nontrivial task. Previous work typically utilizes functions or basic blocks
(BBs) as input units for training neural models. However, the number of
instructions in a function or a BB can be infinite (up to 1,000 instructions),
which is hard to handle appropriately by neural network models. Therefore, it
is essential to split the BB into finer-grained units, which can effectively
reduce the model’s difficulty in learning the decompiled rules. One
straightforward method is to split the LPL or HPL based on debug information.
However, the LPL and HPL mapped by the debug information are inaccurate,
especially for optimized binaries. For example, the dead code in the HPL will
also be mapped onto the LPL along with the live code. Another straightforward
way is to set a maximum fragment length and split the basic block into
fragments. However, several statements in a fragment may have over one
independent feature. For example, there are three independent features (data
flows) in the code segment “$a=0;b=c+d;call(c);$”. Thus it is difficult for
the model to properly encode it into a single vector representing its function
or semantics. Splitting data dependency graphs (DDG) may solve this problem,
but it is also a difficult task. Worse still, the DDGs of LPL and HPL are
quite different because of compiler optimization.

Our approach. In this paper, we propose an NN-based decompilation framework
called NeurDP111NeurDP (Neural Decompilation). NeurDP uses a neural network
model to translate LPL into an optimized IR (IR decompiler) to address C1
instead of directly translating LPL into HPL. As we know, the compiler first
generates the intermediate representation (IR) code during the compilation
process and performs most of the optimization strategies on the IR. Therefore,
the structural differences between the optimized IR and LPL are much more
minor than those between HPL and LPL. Compared to previous end-to-end neural
decompilers, NeurDP can cope with the decompilation problem of compiler-
optimized LPL. Finally, NeurDP converts IR statement to HPL statement
directly.

Specifically, to train a well-performing IR decompiler model, we design a
splitting technique called Optimal Translation Unit (OTU) to address C2. OTU
splits BBs into smaller pairs of LPL and HIR fragments. The statements in each
fragment have data dependencies and can be synthesized into one feature. OTU
helps build a high-quality training set for our NN model.

To evaluate the accuracy of NeurDP, we use several programs randomly generated
using our tool which is developed by cfile (cfile, ) and regular expressions,
including 500 lines of code. Since our goal is to boost the neural network’s
ability for decompilation, we compare NeurDP with related studies using neural
networks (e.g., Coda (fu2019coda, ) and Neutron (liang2021neutron, )).
Experimental results show that NeurDP is 5.8%-27.8% more accurate than Coda on
unoptimized code. Moreover, NeurDP can handle compiler-optimized code well,
while Coda is incapable of action. NeurDP can decompile optimized binaries
with 45.21% higher accuracy than another neural decompilation Neutron
(liang2021neutron, ). According to our evaluation, the introduction of OTU and
IR mechanisms in our model improves the accuracy by 4.1%-71.23% compared to
using the model directly in the optimized code.

Contributions. Our main contributions are outlined below:

$\bullet$ We design a novel neural machine decompilation technique. It is the
first neural-based decompiler that can handle compiler-optimized code.

$\bullet$ We design an optimal translation unit (OTU) scheme, which can help
other researchers form a sound dataset for training the IR decompilation model
or other applications.

$\bullet$ We implement our techniques and conduct extensive evaluations. The
results show that NeurDP is much better than the state-of-the-art neural-based
decompilers, especially for optimized code. We release our dataset and the NN
parameters on GitHub222https://github.com/zijiancogito/neur-dp-data.git.

Figure 1. An example showing different compiler optimization levels

##  2\. Background

###  2.1. Compilation and Optimization

Compilation translates HPL (e.g., C/C++) into LPL (e.g., machine code) that
can be run on the target CPU (e.g., X86, ARM). Due to the differences between
the two PLs, unnecessary information (e.g., symbols) for the CPU is usually
removed. Also, in this process, optimization technologies are designed to
minimize or maximize some attributes of the executable program, e.g., to
reduce the program’s memory usage. Note that the execution results of the
optimized target program should be the same as the original program without
optimization. Optimization usually has several levels (e.g., from O0 to O3 for
the compiler gcc333https://gcc.gnu.org/). The higher the optimization level,
the greater the difference between the compiled binary code and the source
code. Optimization makes it more difficult to generate decompiled code using
deep learning models. For example, the optimization could look for redundant
operations among lines of code and combine them, or calculate some operations
in the compiling time rather than the running time. This would change the
structure of HPL. The optimization process is usually irreversible. Also, the
optimization strategies are very diverse, even for the same type of operation.
For example, in Figure 1, the target program languages after optimization for
the division operations can have different forms when they have different
types of operands. Specifically, if the operand is variable, the translated
code is sdiv. Moreover, when the operand is changed to immediate, the target
code is mov, movk, smull, lsr, asr, add, which does not even contain the
division operation.

###  2.2. Decompilation

Decompilation is a technique that transforms a compiled executable program or
ASM (LPL) into a functionally equivalent HPL (van2007static, ). As mentioned
previously, to decompile code, analysts would make many heuristic rules to
help lift binary code to source code (Hex-Rays, ; brumley2013native, ;
kvroustek2017retdec, ; Ghidra, ). However, generalizing the rules is
challenging since complex instruction set architectures (ISA), code structure,
and optimization strategies. Experts need to summarize the code changes
brought by many optimization strategies and handcraft the corresponding
decompilation rules. For example, in Figure 1, using different optimization
levels, the operation var1=var1/-123; could be compiled into different types
of instructions, e.g., mov, movk, smull, lsr, asr, add. In this case, the
developer needs to handcraft the rules to analyze the data dependencies of
these instructions, and determine whether these instructions represent a
division statement. The situation worsens when new operations are added, or
new optimization strategies are developed, introducing new rules and impacting
the old ones. What is more, this may mislead a neural-based decompiler to
translate the similar code smull, lsr, asr, add, which does not mean division
operation to sdiv. Obtaining a good model requires training on a large-scale
dataset with high-quality labels. However, directly using the source code as
the label for optimized binary decompilation is inaccurate due to the gap
between the source code and the optimized code.

Existing decompilation tools typically design an intermediate representation
(IR) as a bridge between the LPL and the HPL. While converting IR to HPL is a
relatively easy task (idawhitepaper, ), the rules for translating LPL to IR
rely on expert analysis and definitions. Moreover, as each tool proposes its
own IR and has different definitions of micro-operations, rule-based
decompilers suffer from poor generalizability and scalability. To solve these
issues, researchers proposed neural-based decompilation (katz2018using, ;
katz2019towards, ; fu2019coda, ; liang2021neutron, ). Katz et al.
(katz2018using, ) adopted methods from NMT and formulated decompilation as a
language translation task, aiming to overcome the bottleneck of rule-based
approaches. Coda (katz2019towards, ) and Neutron (liang2021neutron, ) are
designed to learn the mapping rules automatically. The neural-based approaches
bring a new idea to program decompilation. However, previous neural-based
methods all learn a direct mapping from LPL to HPL or the abstract syntax
trees (ASTs) of HPL. In addition, none of the current neural-based approaches
can handle optimized code, mainly due to the unavailability of a high-quality
dataset of optimized code.

Figure 2. Overview of NeurDP

##  3\. Approach

We propose a novel neural decompilation approach NeurDP that can handle
compiler-optimized code. NeurDP first translates LPL to HIR using GNN based IR
decompiler model, and then recovers HIR code to HPL. Below we elaborate on the
design of NeurDP.

Figure 3. Example of relationship between HPL, HIR, LIR, and LPL

###  3.1. Overview

The overview of NeurDP is shown in Figure 2, which aims to decompile the LPL
into functionality-equal C-like HPL. And the detail of NeurDP is shown in
Figure 6. Considering the large gap between the LPL and HPL, we introduce an
IR named HIR as a bridge. IR is optimized by the compiler front end. Using the
optimized IR as the model’s target can reduce the difficulty of model learning
since the model no longer needs to learn to reverse the optimization
strategies in the compiler’s front end.

In the data construction phase, we first disassemble the binary file, identify
the code sections from the binary and retrieve the assembly code of all
functions. Then, NeurDP gets the control flow graph (CFG) for each function
and the assembly code of each basic block following previous work
(shoshitaishvili2016state, ). Next, NeurDP performs static single assignment
(SSA) and data dependency analysis on the LPL in each basic block. We do not
use LPL directly as the model’s input. Instead, we prefer to use the
representation of the SSA form, which is a low-level intermediate
representation (LIR) (see Section 3.2). After generating LIR, we further
analyze the data dependency between LIR code to obtain the data dependency
graph (DDG) of LIR within the basic block.

Table 1. Part of the rules from HIR to HPL HIR |  HPL
---|---
%result = sub %1, %2 |  result = v1 - v2;
%result = add %1, %2 |  result = v1 + v2;
%result = call f_printf, %1, %2 |  result = f_printf(v1, v2);
void = call f_printf, %1, %2 |  f_printf(v1, v2);
ret %1 |  return v1;
Table 2. Some instruction templates of LIR

|  LPL |  LIR
---|---|---
Return |  ret |  ret x0
Unconditional Branch |  bl label |  bl x0, label[, SRC [, SRC...]]
Conditional Branch |  cmp SRC, SRC b.COND label1 |  b COND, label1, label2, SRC, SRC
Store Register |  str SRC, DST |  str DST, SRC
Arithmetic (shifted register) |  add DST, SRC, SRC, [lsl] IMM |  add DST, SRC, SRC lsl DST, IMM
Move(wide immediate) |  add DST, SRC, SRC mov DST, IMM1 |  movk DST, IMM2, [lsl] 16|32) +IMM1
WZR|XZR Register |  mov DST, WZR|XZR IMM |  mov DST, 0
Conditional Comparison |  ccmn SRC, SRC, IMM, cond |  ccmn nzcv, cond, SRC, SRC, IMM

label: jump address. label1: address of the next instruction. IMM: immediate.
nzcv: condition flags.

In the model processing phase, we design a neural model to translate LIR into
HIR (Section 3.3), including the following two steps. Step 1: Model Training.
Firstly, NeurDP prepares a suitable dataset for model training, which contains
pairs of LIR and HIR. NeurDP splits the basic block into smaller snippets
using Optimal Translation Unit (OTU). The LIR and HIR pair in the
corresponding units are functionally equivalent, which makes it easier for the
model to learn the transform rules. Secondly, we design and train a neural
model based on graph neural network (2015arXiv151105493L, ) model to generate
HIR code. We describe the detailed design of LIR, HIR and OTU in Section 3.2
and the construction of training datasets and the model architecture in
Section 3.3. Step 2: Model Translation. This step includes the recovery and
reorganization of basic blocks in CFG. (i) Recovery: NeurDP recovers
statements in basic blocks in this step. Firstly, NeurDP uses OTU to divide
the basic block into units and get the DDG of each unit. Then, NeurDP uses the
trained model to translate LIR DDG units to HIR code templates. After that,
NeurDP fills the analyzed local variables from LIR into the HIR templates
based on data flow analysis. We detail the method of operands recovery in
Section 3.4. (ii) Reorgnization: In this step, we sort these HIR snippets
based on the position of its corresponding LIR in the basic block to recover
the complete HIR basic block. At last, we recover the CFG of HIR (HIR-CFG)
based on the CFG of LPL.

In the HPL generation phase, NeurDP lifts the HIR to HPL. A complete function
includes control structures, statements, and function signatures. Translating
statements from HIR to HPL is not a difficult task, so we make some rules.
Table 1 shows some of the rules. For the recovery of control flow and function
signatures, many other researchers are focusing on these problems, and we use
existing studies (yakdan2015no, ; 203650, ) for these two parts. With the
function signatures, the statements within each basic block, and the control
structures between the basic blocks, we can construct a complete HPL function.

###  3.2. Dataset Construction

As mentioned previously, we cannot directly use a function’s HPL and LPL as
input-output pairs for the model. The main obstacles lie in that (i) the
instructions in HPL and LPL have poor correspondence (e.g., redundant or
missing operations), and (ii) each function has many instructions, making it
difficult for the neural network models to learn. In order to solve the
problems and facilitate effective learning, we introduce an intermediate
representation (HIR) that has better instruction correspondence with the LPL
and use OTU to split the basic blocks into smaller units.

Table 3. HIR Syntax Templates LLVM IR |  NeurDP HIR
---|---
<result> = mul <ty> <op1>, <op2> |  <result> = mul <op1>, <op2>
<result> = add nuw nsw <ty> <op1>, <op2> |  <result> = add <op1>, <op2>
<result> = fsub [fast-math flags]* <ty> <op1>, <op2> |  <result> = fsub <op1>, <op2>
<result> = icmp <cond> <ty> <op1>, <op2> |  <result> = icmp <cond> <op1>, <op2>
switch <intty> <value>, label <defaultdest> [ <intty> <val>, label <dest> … ] |  switch <value>, <defaultdest> [<val>, <dest> … ]

Intermediate Representation. LIR is lifted from LPL by removing machine-
related features from LPL, such as registers, designed as the model’s input.
To get LIR, we first change LPL to SSA form, then use optimization strategies
similar to constant (register) propagation to eliminate as many registers as
possible. LIR maintains almost the same syntax as LPL
($<opcode>~{}<op_{des}>,<op_{src1}>,...$). Table 2 shows some of the syntax
templates of LIR. For HIR, we extract the operands and opcodes from LLVM IR
and rewrite them automatically according to the syntax
($<op_{des}>=<opcode>~{}<op_{src1}>,...$), which is a simplified scheme of
LLVM IR. It is feasible to directly use LLVM IR instead of HPL as the model’s
output. However, a model that converts LIR to LLVM IR instead of HIR needs to
learn too much additional information (like data types), which could
complicate the model structure and make training such a model extremely
difficult. Therefore, we choose to construct the model that converts LIR to
HIR, which is relatively simple (though training this model is still not
straightforward). Table 3 lists parts of the instruction templates we use for
HIR and corresponding LLVM IR. Figure 3 (c) shows the HIR generated by NeurDP.

Figure 4. Black box of basic block

Optimal Translation Unit. NeurDP splits the basic block into smaller units
that could let the model learn the mapping rules between LIR and HIR
instructions easily. An unit in LIR should be functionally equivalent to the
corresponding unit in HIR. One may use a fixed-length translation unit (TU) to
spill a function into units. However, the units generated in this way may not
be functionally equivalent. For example, in Figure 3, the madd instruction in
(b) corresponds to the computation of %mul and %add in (c). Nevertheless, the
two instructions are located far away and hard to include in a fixed-length
TU. Also, a large size of the TU would include unrelated instructions that
cannot be paired.

Figure 5. An example of pair matching of OTU

We assume that a basic block is a black box, as shown in Figure 4. We find
that most optimization strategies do not change the output of a basic block.
We observe that the output of a basic block usually contains multiple
variables whose data dependency graphs within the basic block often overlap.
In Figure 4, regions with different colors corresponding to the variables a,
b, and n represent their data dependency graphs. To ensure that the
optimization to the data dependencies of one variable does not affect the
result of other variables, the compiler usually considers optimizing the
overlapped and independent parts of the DDG, respectively. Therefore, we
consider that the corresponding parts in DDG of HIR and LIR has the same
semantic. Based on this observation, we design an Optimal Translation Unit
(OTU) to divide the overlapping and independent parts of each dependency path
of the basic block, which consists of two steps.

Step 1: OTU divides a basic block into multiple non-overlapping units.
Starting from the input variables of the basic block, OTU traverses the entire
DDG of the basic block and marks all instructions with two or more out edges
as unit boundaries. The OTU obtains independent non-overlapping units based on
the boundaries. After that, a DDG between units (UDG) can be constructed
according to the data dependencies between statements. As shown in Figure 5
(a), the OTU first divides the DDG of LIR into five non-overlapping units.
Each unit is regarded as a node of UDG, and the dotted lines are dependency
edges. In the same way, Figure 5 (c) generates a UDG of HIR.

Step 2: OTU partially merges the units divided in Step 1, because there are
units whose out edges all point to one unit. For example, there are 2 out
edges between TU1a and TU1b in Figure 5 (a). This is due to compiler
optimizations, such as the division optimization in Figure 5 that causes
operations on a variable to be divided into 3 units TU1a, TU1b, and TU1c. We
iteratively combine such units until no unit in UDG has all the out edges
pointing to the same unit. For example, in Figure 5, (b) is the result of the
merging of (a).

Figure 6. Neural translation process Figure 7. Model architecture

Training Dataset. Since the neural model requires labeled data in the training
phase, we use OTU to partition both the basic blocks of LIR and HIR when
obtaining the training set. Due to the optimization strategies of the
compiler, the CFG of HIR often does not match precisely with the CFG of LPL or
LIR. Inaccurate matching between the basic blocks will lead to inaccurate
labeling of the training set. To avoid this problem, we choose functions that
contain only one basic block and then segment them to form the training set of
NeurDP (see Section 4). Based on our observation, optimization across basic
blocks only changes the segmentation and their orders, which does not
introduce new types of instructions and mappings. Therefore, the model trained
on our dataset can accurately translate the LIR instructions in each basic
block of a complex function to the corresponding HIR instructions. Existing
rule-based decompilers (Ghidra, ; Hex-Rays, ; kvroustek2017retdec, ) are also
implemented based on this principle.

After applying OTU in both LIR and HIR, we try to map units of them to label
dataset. We observe that their UDGs are usually isomorphic, although the DDGs
of LIR and HIR may be different. Therefore, we match UDGs of LIR and HIR to
pair their units and get labeled. If two nodes in UDG cannot be distinguished,
we first examine their internal instructions and distinguish them by some
special features, including their constants, const strings, and the address of
a procedure call. For nodes that are still indistinguishable according to
these features, we throw them away. We use this labeling method to ensure the
accuracy of labels.

###  3.3. Neural Translation

In the field of neural translation, sequence-to-sequence (seq2seq) neural
networks (cho2014learning, ; LSTM, ; vaswani2017attention, ) have achieved
excellent results and have been applied in commercial products such as Google
Translate (45610, ). Therefore, previously studies (e.g., TraFix
(katz2019towards, ), Coda (fu2019coda, ), and Neutron (liang2021neutron, ))
utilize such models for translation. However, these existing neural machine
decompilers do not work well, especially for the optimized LPL, indicating
that the seq2seq models cannot effectively cope with the decompilation tasks
of LPL. The low accuracy is mainly because seq2seq neural networks do not
consider the data dependencies between instructions, which is vital for the
compiler to generate LPL. For example, in Figure 6 (c), the seq2seq neural
networks view the LIR as the sequence <smull, lsr, add3, asr, add5, lsl>, but
ignore the data dependencies (e.g., <smull$\rightarrow$lsr> and
lsr$\rightarrow$add3>). So the model wrongly decompiles the result as shifting
and arithmetic operations. However, the correct result is the division
operation div.

Based on the above observation, the neural network model should capture the
instructions and the data dependencies between instructions. So we choose to
use Graph Neural Networks (GNN). It can capture the features of nodes (i.e.,
instructions) and edges (i.e., data dependencies) in DDG. Thus, the model’s
decompilation problem can be defined as follows: Given the LIR’s DDG subgraph
$G$ as input, the model outputs the corresponding HIR sequence, expressed as
$P(Y)=P(Y|G)$.

We adopt the graph-based neural network gated graph sequence neural network
(GGS-NN) (2015arXiv151105493L, ). We do not show the details of the model
here. Figure 7 shows the model’s architecture (i.e., an encoder-decoder
architecture). The encoder uses the gated graph neural network (GG-NN)
(2015arXiv151105493L, ). The node initialization module aims to define the
initial state of the node and perform initialization operations on the DDG.
The decoder uses a long short-term memory (LSTM) network with the bridge
mechanism. Considering the inputs are LIR/HIR units which are not complicated,
we use a 2-layer LSTM network. The global attention (luong2015effective, ) is
introduced to improve the model’s performance. The token embedding
(mikolov2013distributed, ) module is used to generate the word vector of the
output sequence, and we use the learnable multi-dimensional embedding vector.
Regarding the loss function, we use the Kullback-Leibler divergence
(kullback1951information, ) as follows.

(1)
$\displaystyle\vspace{-20pt}D_{KL}(p||q)=\sum_{i=1}^{n}p(x)log\frac{p(x)}{q(x)}$

Based on our evaluation, our model is much more accurate (29.58% higher on
average) than seq2seq neural networks. We further look into the code and find
that GNN correctly captures the features of data dependencies. For the example
in Figure 6, our model can correctly decompile the LIR to div, which means our
model is effective even for optimized code.

###  3.4. Operands Recovery

Recall that the output of our model does not contain real operands. To
accurately recover the HIR operands, we further split the LIR unit, pair
LIR/HIR instructions, and recover operands in each unit. In this step, we use
operands in LIR to fill into the HIR. We first pair the instructions with the
same semantic meanings, which can be obtained by analyzing the instructions
manually. For example, in Figure 6, the LIR instruction bl has the same
semantic meaning as the HIR instruction call. So we pair them together. Note
that identifying the semantic meaning of instructions is only a one-time
effort. Then, for the unpaired instructions, we pair them in the order of
their addresses. For example, in Figure 6, the LIR instructions between Line 1
and Line 6 are paired to the HIR instruction div.

After obtaining the instruction pairs, we design a data-flow-based approach to
recover the HIR operands. For each pair, we identify the destination operand
in LIR (from the node that has no output link in DDG) and use it as the
destination operand in the HIR instruction. Then we identify the source
operands in LIR (from the node that has no parents in DDG) and put them as the
source operands in the corresponding HIR instruction. For some special
instructions in HIR and LIR (e.g., div and madd), we make rules to find the
source operands and the destination operands. For example, in Figure 6, we map
instructions 1-6 (18 operands) in the LIR to instruction 1 (3 operands) in the
HIR. By analyzing the DDG of LIR, we get the output variable $x23\\_2$, input
variable $x0\\_5$, and 4 immediate $\\#0x84210843$, $32$, $8$, and $31$, which
are not defined inside the DDG. Operands $x23\\_2$ and $x0\\_5$ can be
assigned to HIR to the corresponding position. Besides, we manually make the
division optimization rules to get another operand $\\#496$.

##  4\. Evaluation

In this section, we describe our experiments to evaluate NeurDP’s performance.
Firstly, we evaluate the accuracy of decompilation tools at different
optimization levels, which can reflect the ability of each decompiler to
respond to the optimization strategies related to the expression and data flow
in the compiler optimization. We compare NeurDP with two state-of-the-art
neural-based decompilers (fu2019coda, ; liang2021neutron, ). To evaluate the
efficiency of our model and OTU, we compare NeurDP with other baseline models
and other methods of splitting basic blocks. We also analyze the decompiling
results of one famous open-source decompilation tool RetDec
(kvroustek2017retdec, ).

###  4.1. Experiment Setup

Dataset. To build the dataset, we randomly generated 20,000 functions,
consisting of arithmetic and calling statements, compiled them using clang10.0
with optimization levels O0 to O3. By capturing the intermediate results and
reversing the binaries, we got 80,000 LIR/HIR pairs. Then, we use OTU to split
the function into smaller units for training. After removing the duplicated
units and batches that were not full, we got 242,000 pairs. We randomly
selected 220,000 pairs for training, and the rest 22,000 pairs were used for
validation. We evaluate NeurDP from the following aspects: accuracy and
generalizability.

Platform. All our experiments are conducted on a 64-bit server running Ubuntu
18.04 with 16 cores (Intel(R) Xeon(R) CPU E5-2620 v4 @ 2.10GHz), 128GB memory,
2TB hard drive and 2 GTX Titan-V GPU.

###  4.2. Accuracy

Metrics. As mentioned above, the compiler’s optimization changes the
statements in the source code. So the decompiled code may not be the same as
the original source code at the statements level, even if both codes have the
same functionality. We propose a method to evaluate the compiler’s accuracy in
solving this problem. We consider the decompiled basic block correct if the
semantics of this HPL’s basic block is the same as the semantics of the
corresponding LPL’s basic block. Below, we will introduce our comparison
method for the semantics of two basic blocks.

Basic block can be abstracted to a function $F$, mapping the input set $IN(B)$
to the output set $OUT(B)$. We define them as follows:
$IN(B)=\\{in_{0},in_{1},...,in_{n}\\}$, where $in_{i}$ is the $i$-th input of
a basic block. $OUT(B)=\\{out_{0},out_{1},...,out_{n}\\}$, where $out_{i}$ is
the $i$-th output of a basic block. $F=\\{f_{0},f_{1},...,f_{n}\\}$, where
$f_{i}$ is the $i$-th function of a basic block, $out_{i}=f_{i}(IN(B))$,
$OUT(B)=F(IN(B))$. We define the accuracy of a basic block as
$Acc_{B}=Count_{correct}(f^{HPL}_{i})/Count(F^{LPL})$, where $f^{HPL}_{i}$ is
the $i$-th function of HPL. To find the correct $f_{i}$, we first locate the
corresponding $out_{i}^{HPL}$ in the decompiled HPL for each
$out_{i}{\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}^{LPL}}$
in LPL (e.g., pointer to the same variable). For NeurDP, it is easy to
determine whether the two outputs correspond or not since we map the variables
in LIR directly to HIR when recovering the variables in Section 3. For other
decompilers, we pair outputs by manual analysis. Then we can get corresponding
$<out_{i}^{HPL},out_{i}^{LPL}>$ pairs. Given $IN(B)$, we consider the
$f_{i}^{HPL}$ obtained by decompiling to be correct if the results of the
function $f_{i}^{HPL}$ and $f_{i}^{LPL}$ are equal for each paired
$out_{i}^{HPL}$ and $out_{i}^{LPL}$. At last, we define the program accuracy
as $Acc=\sum_{k=1}^{N}Acc_{B}(B_{i})/N$, where $N$ is the number of basic
blocks in the program, $B_{i}$ is the $i$-th basic block in the program. In
the evaluation, NeurDP automatically generates functions from the basic
blocks, and we manually check if $f_{i}^{HPL}$ is correct by comparing the
functions from HPL and LPL. For example, in Figure 1, HPL and LPL codes of
func1 all contain one basic block. We can get the accuracy of func1
$Acc=Acc_{B}(B)/1$. The output set and input set of $B$ in HPL are
$\\{ret_{HPL}\\}$ and $\\{p0\\}$. The output set and input set of $B$ in LPL
are $\\{ret_{LPL}\\}$ and $\\{w19\\}$. Then, we can get output pairs in HPL
and LPL $\\{<ret_{HPL},ret_{LPL}>\\}$. The corresponding function of
$ret_{HPL}$ is $f=(f\\_scanf\\_nop()+p0\times
f\\_rand())/f\\_scanf\\_nop()/(-123)$. And the corresponding function of
$ret_{LPL}$ is $f=(f\\_scanf\\_nop()+w19\times
f\\_rand())/f\\_scanf_{\\_}nop()/(-123)$. Note that here we should make rules
to handle the division optimization for LPL. We can manually compare these two
functions. At last, we can get the accuracy of func1
$Acc=Acc_{B}(B)/1=(1/1)/1=1$, where $Count_{correct}(f^{HPL})=1$ and
$Count(F^{LPL})=1$.

Settings. To evaluate the accuracy of NeurDP, We develop a tool using cfile
(cfile, ) to randomly generate 1,000 pieces of code as DS1, and then use Clang
to compile them at optimization level O0-O3 to get 4,000 executable and
linkable format files (ELF), where each ELF contains 5 functions. Our dataset
includes arithmetic expressions, procedure calls, etc. We evaluate the
robustness of the decompilation tools through their performance in decompiling
binary files with (or without) symbolic information, and different
optimization levels. Further, we perform strip (strip, ) operations on the
binary code in the above dataset, where strip debug refers to removing the
debugging information from the binary, strip all means removing all symbolic
information from the binary code.

Accuracy of NeurDP. Table 4 shows the accuracy of NeurDP for four optimization
levels from O0-O3. NeurDP can achieve 92.42% accuracy on average at O0-O3
optimization level. It can be seen that the accuracy of NeurDP is higher under
levels O0 and O1, while it is lower at levels O2 and O3. At O2 and O3, there
are more optimizations of the compiler’s backend, and the model is more
difficult to learn the rules. When the optimization level is increased, the
accuracy of the disassembly will reduce, which affects the accuracy of
decompilation. Under the same optimization level, there are a few differences
in the model’s performance with and without symbolic information, which
indicates that the model has good robustness to the stripped binaries. Under
level O1, the accuracy rates of binaries without debug information and any
symbol tables are slightly lower than with symbolic information. After the
analysis, we found that the disassembly accuracy without symbolic information
reduces, and some function boundary recognition errors occurred, leading to
unsatisfactory decompilation results.

Table 4. Results on different compiler-optimization level

Strip option | Compiler optimization level
---|---
|  O0 |  O1 |  O2 |  O3
no |  0.95 |  1 |  0.9 |  0.9
debug |  0.95 |  0.92 |  0.9 |  0.9
all |  0.95 |  0.92 |  0.9 |  0.9

no: remain all symbolic information.
debug: strip debug information.
all: strip all symbolic information.

Table 5. Comparison with state-of-the-arts

| Compiler optimization level
---|---
|  O0 |  O1 |  O2 |  O3
Neutron |  87.78% |  35.45% |  32.79% |  32.81%
Coda |  67.2%-89.2%* |  - |  - |  -
RetDec |  29% |  25% |  4% |  -
NeurDP |  95% |  94.67% |  90% |  90%

*Program accuracy 67.2%-89.2% of Coda is from Table 2 in (fu2019coda, ) .

Comparison with State-of-the-arts. We compare NeurDP with the state-of-the-art
neural-based decompilers (i.e., Coda (fu2019coda, ) and Neutron
(liang2021neutron, )). From the results, we see that NeurDP outperforms both
of them. We do not have access to the source code and dataset of Coda
(fu2019coda, ). We also find that the details needed to reproduce Coda are not
described in their paper. So we could neither test Coda on our dataset nor
test our NeurDP on their dataset. Considering that the benchmark $(Math+NE)$
(fu2019coda, ) in Coda is generated similarly to our dataset, we directly
compare the effect with that described in their paper. Coda splits the long
and short sentences in the dataset into two groups for testing $(Math+NE)_{S}$
and $(Math+NE)_{L}$. Therefore, the range of Coda’s accuracy on these two
datasets is listed in Table 5. In addition, since Coda cannot handle the
compiler-optimized LPL, this part of the data is replaced with blanks. For
Neutron, we get the code and test it on our dataset. The result in Table 5
shows that Neutron does not perform as well as NeurDP on our dataset,
especially for compiler-optimized code. We further analyze the experimental
results, where NeurDP adopts HIR as the model’s target to cope with compiler
optimization and uses the OTU mechanism to divide the basic blocks into finer-
grained partitions. In contrast, the previous neural-based work utilizes HPL
or AST as the model’s target. Source code and AST are not optimized by the
compiler front-end and cannot correspond well with the optimized LPL,
increasing the difficulty of model learning. Therefore, Coda and Neutron
cannot cope with the optimized code very well.

Table 6. Token accuracy of different neural networks | Compiler optimization level
---|---
|  O0 |  O1 |  O2 |  O3
Transformer-SRC |  52.93% |  38.22% |  39.84% |  33.37%
Transformer-AST |  75.79% |  45.62% |  44.60% |  32.98%
Transformer-IR |  77.18% |  75.66% |  74.49% |  73.94%
LSTM-IR |  85.40% |  86.61% |  85.63% |  85.95%
GRU-IR |  26.56% |  21.93% |  25.85% |  24.19%
NeurDP |  89.50% |  93.16% |  93.40% |  90.08%

Compare with Different Neural Networks. To understand the effect of the GGS-NN
model, we compare NeurDP with other models. We select three wildly used
seq2seq models (Transformer (vaswani2017attention, ), LSTM (LSTM, ), and GRU
(cho2014learning, )) to make a comparison with our NeurDP. Note that, instead
of using a tree decoder, we serialize (traverse) the AST of the source code as
the output of the transformer for model Transformer (AST) in Table 6. We use
the same data set as NeurDP to train these models separately. Note that we use
Clang to extract <assembly, source code/AST/IR> as ground truth for these
models. In this experiment, we use the accuracy of tokens to evaluate these
models. This is because outputs of other models often have so many syntax
errors that it is hard to evaluate their functionality. The experimental
result proves that the GGS-NN can make decompilation results more accurate
(see Section 3.3).

We further evaluate the effectiveness of the NMT model using HIR as a
translation target. We choose the Transformer model as the baseline and use
source code, AST, and HIR as the model’s translation targets for evaluation on
DS1. From the first three lines of Table 6, we can find that when the NMT
model uses source code (SRC) or AST as the translation target (output), its
effect on O1-O3 is far worse than that at O0. In contrast, the model that uses
HIR as the output has no significant difference in translation effects at the
O0-O3, and the complete accuracy is better than the other two models. The
experimental results show that using HIR as the translation target of the
model is highly generalizable for optimized code, which are not affected by
compiler optimizations. What’s more, using our HIR and LIR pairs splitting by
OTU performs better than other models.

Impact under Different Translation Unit. We evaluate the token accuracy of
using different methods of splitting basic blocks, including code sequence-
oriented TU (STU) and DDG-oriented TU (DTU). We select DS1 to evaluate the
performance of different forms of TU. To verify the effect of TU, we choose
the statement size of the STU as 5, 10, and 15 on the assembly sequence. To
further verify the performance between fixed-length and variable-length DTU,
we select a fixed-length DTU with a size of 5 and our OTU. Figure 8 shows the
performance of NeurDP under different forms of TU. The result indicates that
NeurDP becomes less effective in code sequences as the STU increases, mainly
because the longer the code the model needs to handle, the more difficult it
is to translate accurately. If we do not split the basic block, the results
will worsen. In addition, we find that the fixed length of TU, either
sequence-oriented or DDG-oriented, makes the correspondence between LIR and
HIR in the training set more ambiguous, which leads to the model’s failure to
learn the mapping rules. Compared with the above methods, our OTU can maximize
the automation of obtaining LIR and HIR pairs with the correct correspondence
for training, thus enabling the model to learn the mapping relationship
between them quickly and accurately. What is more worth mentioning is that our
approach can deal with compiler optimization problems well.

Figure 8. Token accuracy under different forms of TU

Analysis of Rule-based Decompilers. We also evaluate the performance of one
famous open-source rule-based decompiler RetDec (kvroustek2017retdec, ), which
contains over 100,000 lines of code and is a representative decompilation
work. In the evaluation, RetDec does not perform as well as those three
neural-based decompilers (only achieving 29%) on unoptimized binaries. When
evaluated on O1, RetDec achieves 29% accuracy without debug information and
17% accuracy without any symbolic information. When evaluated on O2 and O3,
RetDec achieves only 4% accuracy because mostly binaries are failed to
decompile. We manually analyzed these samples of decompilation failures and
found that many errors occurred in the disassembly step due to the lack of
symbolic information. The code sections could not be accurately located. In
some cases, although the function entry point was found, the decompilation is
broken due to some small disassembly errors. Moreover, we studied the
mechanism of rule-based decompilers (idawhitepaper, ; Ghidra, ;
kvroustek2017retdec, ). Rule-based decompilation tools have more rules and
constraints and are more sensitive to disassembly errors. A memory or stack
error in the assembly will often cause the following code or the entire
function to fail to decompile. In contrast, NeurDP has no constraints (e.g.,
stack balance), so it has a certain degree of fault tolerance for some
disassembly errors, such as sp stack unbalanced caused by inline assembly
code. It will not cause the entire decompilation process to fail. Even if the
disassembly error leads to the wrong decompilation result, NeurDP can still
finish decompiling without triggering an error and stopping like other tools.

##  5\. Discussion

Limitations. In this work, we propose and implement a novel neural
decompilation approach, named NeurDP, to demonstrate that the neural-based
approach copes with the decompilation problem of compiler-optimized LPL.
However, NeurDP still has some limitations. Firstly, the HPL statements
generated by NeurDP are mapped directly from HIR and are mostly monadic or
binary statements. For example, for an expression a = b + c * d, NeurDP’s
outputs are two statements tmp = c * d, a = b + tmp. Such problems could be
solved through data dependency analysis. Besides, the quality of HPL
decompiled by NeurDP is closely related to the accuracy of the LPL (assemble
code). We find that for stripped binaries, the disassembly tools (e.g.,
RetDec) may cause errors in assembly code due to incorrect function boundary
identification, especially for decompiled code, which affects the quality of
our NeurDP’s performance. Secondly, NeurDP is not completely end-to-end from
LPL to HPL. The lifting from IR to HPL depends on the rules, so it is not easy
to support multi-machine and multi-language. Thirdly, NeurDP is a prototype
system, and the dataset contains only the statements consisting of arithmetic
and calling operations to integer variables. We plan to include more types of
statements in future work. Finally, NeurDP directly uses the existing
techniques, including disassembly, reconstruction of control structures, etc.
NeurDP does not consider the errors introduced by these modules so these
components will affect the final accuracy.

Future Work. We will continue to explore techniques for improving the
decompilation quality of NeurDP and resolve the above limitations. For
example, we will eliminate some binary statements by merging expressions and
reducing the redundant variables for HPL generated by NeurDP. The elimination
of sentences will be achieved through data-flow analysis. At the same time, we
will use neural-based methods to learn some patterns of statements that match
developers’ habits through historical experience and guide the process of
merging to generate HPL that is more in line with programming habits.
Furthermore, we will combine the collective capability of the-state-of-art
commercial and open-source disassembly tools (darki2021disco, ;
flores2020datalog, ), to generate high-quality assembly code. The goal is to
ensure the NeurDP’s input is correct, which is a sufficient condition to
ensure the performance of the decompiled code.

##  6\. Related Work

Rule-based Decompilation. Rule-based decompilation techniques rely on PL
experts to customize and design specific heuristic rules lifting low-level PL
to high-level PL and achieving software decompilation. The current popular
rule-based decompilation tools are Hex-Rays (Hex-Rays, ), RetDec
(kvroustek2017retdec, ) and Ghidra (Ghidra, ). Hex-Rays is a decompiler engine
integrated into the commercial reverse tool IDA Pro, which is the de-facto
industry standard in the software security industry. However, Hex-Rays is not
open-source, and the inside technology is hard to understand. RetDec is an
LLVM-based redirectable open-source decompiler developed by Avast in 2017,
aiming to be the first “universal” decompiler that can support multiple
architectures and languages. RetDec can be used alone or as a plug-in to
assist IDA Pro. Ghidra is an SRE framework developed by the National Security
Agency (NSA) for cybersecurity missions. Ghidra supports running on Windows,
macOS, and Linux, supporting multiple processor instruction sets and
executable formats. Although these studies have made significant improvements,
they are far from perfect. Rule-based approaches are needed to manually detect
known control flow structures based on written rules and patterns. These rules
are difficult to develop, error-prone, usually only capture part of the known
CFG, and require long development cycles. Worse still, these methods do not
work well when decompiling optimized code. However, optimization is now the
default option when commercial software is compiled. Unlike rule-based
decompilers, the goal of NeurDP is based on deep neural networks to learn and
extract rules from code data automatically. Trying to break through the
problem of compiler-optimized code is challenging to decompile accurately.

Learning-based Decompilation. Most of the existing learn-based decompilation
methods (katz2018using, ; katz2019towards, ; fu2019coda, ; liang2021neutron, )
draw on the idea of NMT to transform the decompilation into the problem of
mutual translation of two different PL. Katz et al. (katz2018using, ) first
proposed an RNN–based method for decompiling binary code snippets,
demonstrating the feasibility of using NMT for decompilation tasks. Katz et
al. (katz2019towards, ) proposed a decompilation architecture based on LSTM
called TraFix, and they realized that the primary task of building a
decompilation tool based on NMT is to make up for the information asymmetry
between high-level PL and low-level PL. TraFix takes the preprocessed assembly
language as input and the subsequent traversed form of C as output, which
reduces the structural asymmetry between the two PLs. Fu et al. (fu2019coda, )
proposed an end-to-end neural decompilation framework, named Coda, based on
several neural networks and different models used for different statement
types. Coda (fu2019coda, ) can accurately decompile some simple operations,
such as binary operations, which is far from actual application. Unlike the
above existing studies, our neural decompilation framework NeurDP can
decompile the real-world low-level PL code, especially the compiler-optimized
PL code, into a C-like high-level PL code with corresponding functionality.

##  7\. Conclusions

In this paper, we propose and implement a neural decompilation framework named
NeurDP, which accurately decompiles LPL code to a C-like HPL with similar
functionality. We also design an optimal translation unit (OTU) suitable to
form a dataset for learning algorithms better capturing the relationship
between HPL and LPL. The evaluation results show that NeurDP achieves better
accuracy for optimized code, even compared with the state-of-the-art.

###### Acknowledgements.

This work was supported by NSFC U1836211, Beijing Natural Science Foundation
(No.M22004), Youth Innovation Promotion Association CAS, Beijing Academy of
Artificial Intelligence (BAAI).

## References

  * (1) “Github copilot,” 2021, https://copilot.github.com/.
  * (2) E. Downing, Y. Mirsky, K. Park, and W. Lee, “$\\{$DeepReflect$\\}$: Discovering malicious functionality through binary reconstruction,” in _30th USENIX Security Symposium (USENIX Security 21)_ , 2021, pp. 3469–3486.
  * (3) “Decompiler and beyond,” 2022, https://infocon.org/cons/.
  * (4) Z. Feng, D. Guo, D. Tang, N. Duan, X. Feng, M. Gong, L. Shou, B. Qin, T. Liu, D. Jiang _et al._ , “Codebert: A pre-trained model for programming and natural languages,” _arXiv preprint arXiv:2002.08155_ , 2020.
  * (5) C. Cifuentes and K. J. Gough, “Decompilation of binary programs,” _Software: Practice and Experience_ , vol. 25, no. 7, pp. 811–829, 1995.
  * (6) R. Liang, Y. Cao, P. Hu, and K. Chen, “Neutron: an attention-based neural decompiler,” _Cybersecurity_ , vol. 4, no. 1, pp. 1–13, 2021.
  * (7) K. Cho, B. Van Merriënboer, C. Gulcehre, D. Bahdanau, F. Bougares, H. Schwenk, and Y. Bengio, “Learning phrase representations using rnn encoder-decoder for statistical machine translation,” _arXiv preprint arXiv:1406.1078_ , 2014.
  * (8) O. Katz, Y. Olshaker, Y. Goldberg, and E. Yahav, “Towards neural decompilation,” _CoRR_ , vol. abs/1905.08325, 2019. [Online]. Available: http://arxiv.org/abs/1905.08325
  * (9) C. Fu, H. Chen, H. Liu, X. Chen, Y. Tian, F. Koushanfar, and J. Zhao, “Coda: An end-to-end neural program decompiler,” in _Advances in Neural Information Processing Systems_ , 2019, pp. 3703–3714.
  * (10) “Capstone engine,” 2019, https://github.com/aquynh/capstone.
  * (11) Y. Shoshitaishvili, R. Wang, C. Salls, N. Stephens, M. Polino, A. Dutcher, J. Grosen, S. Feng, C. Hauser, C. Kruegel, and G. Vigna, “SoK: (State of) The Art of War: Offensive Techniques in Binary Analysis,” in _IEEE Symposium on Security and Privacy_ , 2016.
  * (12) J. K. Donnelly, “A decompiler for the countess computer,” _Navy Electronics Laboratory Technical Memorandum 427_ , 1960.
  * (13) M. H. Halstead, _Machine-Independent Computer Programming_. Spartan Books, 1962.
  * (14) D. Brumley, J. Lee, E. J. Schwartz, and M. Woo, “Native x86 decompilation using semantics-preserving structural analysis and iterative control-flow structuring,” in _Presented as part of the 22nd $\\{$USENIX$\\}$ Security Symposium ($\\{$USENIX$\\}$ Security 13)_, 2013, pp. 353–368.
  * (15) “Hex-rays,” 2021, https://www.hex-rays.com/products/decompiler/.
  * (16) J. Křoustek, P. Matula, and P. Zemek, “Retdec: An open-source machine-code decompiler,” 2017.
  * (17) “Ghidra,” 2022, https://ghidra-sre.org/.
  * (18) J. Lee, T. Avgerinos, and D. Brumley, “Tie: Principled reverse engineering of types in binary programs,” 2011.
  * (19) J. Lacomis, P. Yin, E. Schwartz, M. Allamanis, C. Le Goues, G. Neubig, and B. Vasilescu, “Dire: A neural approach to decompiled identifier naming,” in _2019 34th IEEE/ACM International Conference on Automated Software Engineering (ASE)_. IEEE, 2019, pp. 628–639.
  * (20) “Avast retargetable decompiler ida plugin,” https://blog.fpmurphy.com/2017/12/avast-retargetable-decompiler-ida-plugin.html, 2017\.
  * (21) N. E. Rosenblum, X. Zhu, B. P. Miller, and K. Hunt, “Learning to analyze binary computer code.” in _AAAI_ , 2008, pp. 798–804.
  * (22) N. Karampatziakis, “Static analysis of binary executables using structural svms,” in _Advances in Neural Information Processing Systems_ , 2010, pp. 1063–1071.
  * (23) T. Bao, J. Burket, M. Woo, R. Turner, and D. Brumley, “$\\{$BYTEWEIGHT$\\}$: Learning to recognize functions in binary code,” in _23rd $\\{$USENIX$\\}$ Security Symposium ($\\{$USENIX$\\}$ Security 14)_, 2014, pp. 845–860.
  * (24) E. C. R. Shin, D. Song, and R. Moazzezi, “Recognizing functions in binaries with neural networks,” in _24th $\\{$USENIX$\\}$ Security Symposium ($\\{$USENIX$\\}$ Security 15)_, 2015, pp. 611–626.
  * (25) Z. L. Chua, S. Shen, P. Saxena, and Z. Liang, “Neural nets can learn function type signatures from binaries,” in _26th USENIX Security Symposium (USENIX Security 17)_. Vancouver, BC: USENIX Association, Aug. 2017, pp. 99–116. [Online]. Available: https://www.usenix.org/conference/usenixsecurity17/technical-sessions/presentation/chua
  * (26) ——, “Neural nets can learn function type signatures from binaries,” in _26th $\\{$USENIX$\\}$ Security Symposium ($\\{$USENIX$\\}$ Security 17)_, 2017, pp. 99–116.
  * (27) A. Jaffe, J. Lacomis, E. J. Schwartz, C. L. Goues, and B. Vasilescu, “Meaningful variable names for decompiled code: A machine translation approach,” in _Proceedings of the 26th Conference on Program Comprehension_ , 2018, pp. 20–30.
  * (28) J. He, P. Ivanov, P. Tsankov, V. Raychev, and M. Vechev, “Debin: Predicting debug information in stripped binaries,” in _Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security_ , 2018, pp. 1667–1680.
  * (29) A. Hindle, E. T. Barr, Z. Su, M. Gabel, and P. Devanbu, “On the naturalness of software,” in _2012 34th International Conference on Software Engineering (ICSE)_. IEEE, 2012, pp. 837–847.
  * (30) D. S. Katz, J. Ruchti, and E. Schulte, “Using recurrent neural networks for decompilation,” in _2018 IEEE 25th International Conference on Software Analysis, Evolution and Reengineering (SANER)_. IEEE, 2018, pp. 346–356.
  * (31) S. Kommrusch, T. Barollet, and L.-N. Pouchet, “Equivalence of dataflow graphs via rewrite rules using a graph-to-sequence neural model,” _arXiv preprint arXiv:2002.06799_ , 2020.
  * (32) M. J. Van Emmerik, _Static single assignment for decompilation_. University of Queensland, 2007.
  * (33) I. Sutskever, O. Vinyals, and Q. V. Le, “Sequence to sequence learning with neural networks,” in _Advances in neural information processing systems_ , 2014, pp. 3104–3112.
  * (34) Y. Wu, M. Schuster, Z. Chen, Q. V. Le, M. Norouzi, W. Macherey, M. Krikun, Y. Cao, Q. Gao, K. Macherey _et al._ , “Google’s neural machine translation system: Bridging the gap between human and machine translation,” _arXiv preprint arXiv:1609.08144_ , 2016.
  * (35) P. Shaw, J. Uszkoreit, and A. Vaswani, “Self-attention with relative position representations,” _arXiv preprint arXiv:1803.02155_ , 2018.
  * (36) D. Bahdanau, K. Cho, and Y. Bengio, “Neural machine translation by jointly learning to align and translate,” _arXiv preprint arXiv:1409.0473_ , 2014\.
  * (37) “Google c++ style guide,” 2022, https://google.github.io/styleguide/cppguide.html.
  * (38) “Debin,” 2021, https://debin.ai/.
  * (39) S. H. Ding, B. C. Fung, and P. Charland, “Asm2vec: Boosting static representation robustness for binary clone search against code obfuscation and compiler optimization,” in _2019 IEEE Symposium on Security and Privacy (SP)_. IEEE, 2019, pp. 472–489.
  * (40) O. Vinyals, A. Toshev, S. Bengio, and D. Erhan, “Show and tell: A neural image caption generator,” in _Proceedings of the IEEE conference on computer vision and pattern recognition_ , 2015, pp. 3156–3164.
  * (41) E. J. Schwartz, C. F. Cohen, M. Duggan, J. Gennari, J. S. Havrilla, and C. Hines, “Using logic programming to recover c++ classes and methods from compiled executables,” in _Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security_ , 2018, pp. 426–441.
  * (42) W. Jin, C. Cohen, J. Gennari, C. Hines, S. Chaki, A. Gurfinkel, J. Havrilla, and P. Narasimhan, “Recovering c++ objects from binaries using inter-procedural data-flow analysis,” in _Proceedings of ACM SIGPLAN on Program Protection and Reverse Engineering Workshop 2014_ , 2014, pp. 1–11.
  * (43) E. Schkufza, R. Sharma, and A. Aiken, “Stochastic superoptimization,” _ACM SIGARCH Computer Architecture News_ , vol. 41, no. 1, pp. 305–316, 2013\.
  * (44) G. Klein, Y. Kim, Y. Deng, J. Senellart, and A. M. Rush, “Opennmt: Open-source toolkit for neural machine translation,” _arXiv preprint arXiv:1701.02810_ , 2017.
  * (45) H. S. Warren, _Hacker’s delight_. Pearson Education, 2013.
  * (46) “Algorithms/c,” 2019, https://github.com/Thuva4/Algorithms/tree/ma
ster/C.

  * (47) “Libpcap,” 2019, https://www.tcpdump.org/.
  * (48) “strip,” 2009, https://linux.die.net/man/1/strip.
  * (49) “Gmp,” 2019, https://gmplib.org/.
  * (50) “Levenshtein,” https://en.wikipedia.org/wiki/Levenshtein_distance, 2021\.
  * (51) Z. Liu and S. Wang, “How far we have come: Testing decompilation correctness of c decompilers,” in _Proceedings of the 29th ACM SIGSOFT International Symposium on Software Testing and Analysis_ , 2020, pp. 475–487.
  * (52) D. J. Tian, G. Hernandez, J. I. Choi, V. Frost, C. Raules, P. Traynor, H. Vijayakumar, L. Harrison, A. Rahmati, M. Grace _et al._ , “Attention spanned: Comprehensive vulnerability analysis of $\\{$AT$\\}$ commands within the android ecosystem,” in _27th $\\{$USENIX$\\}$ Security Symposium ($\\{$USENIX$\\}$ Security 18)_, 2018, pp. 273–290.
  * (53) G. Hernandez, D. J. Tian, A. S. Yadav, B. J. Williams, and K. R. Butler, “Bigmac: Fine-grained policy analysis of android firmware,” in _29th $\\{$USENIX$\\}$ Security Symposium ($\\{$USENIX$\\}$ Security 20)_, 2020, pp. 271–287.
  * (54) A. W. Appel, _Modern compiler implementation in C_. Cambridge university press, 2004.
  * (55) S. Hochreiter and J. Schmidhuber, “Long short-term memory,” _Neural Comput._ , vol. 9, no. 8, p. 1735–1780, Nov. 1997. [Online]. Available: https://doi.org/10.1162/neco.1997.9.8.1735
  * (56) Y. Wu, M. Schuster, Z. Chen, Q. V. Le, M. Norouzi, W. Macherey, M. Krikun, Y. Cao, Q. Gao, K. Macherey, J. Klingner, A. Shah, M. Johnson, X. Liu, Łukasz Kaiser, S. Gouws, Y. Kato, T. Kudo, H. Kazawa, K. Stevens, G. Kurian, N. Patil, W. Wang, C. Young, J. Smith, J. Riesa, A. Rudnick, O. Vinyals, G. Corrado, M. Hughes, and J. Dean, “Google’s neural machine translation system: Bridging the gap between human and machine translation,” _CoRR_ , vol. abs/1609.08144, 2016. [Online]. Available: http://arxiv.org/abs/1609.08144
  * (57) M. Elsabagh, R. Johnson, A. Stavrou, C. Zuo, Q. Zhao, and Z. Lin, “$\\{$FIRMSCOPE$\\}$: Automatic uncovering of privilege-escalation vulnerabilities in pre-installed apps in android firmware,” in _29th $\\{$USENIX$\\}$ Security Symposium ($\\{$USENIX$\\}$ Security 20)_, 2020, pp. 2379–2396.
  * (58) K. Yakdan, S. Dechand, E. Gerhards-Padilla, and M. Smith, “Helping johnny to analyze malware: A usability-optimized decompiler and malware analysis user study,” in _2016 IEEE Symposium on Security and Privacy (SP)_. IEEE, 2016, pp. 158–177.
  * (59) “Leetcode in pure c,” 2021, https://github.com/begeekmyfriend/leetcode.
  * (60) “cfile,” 2021, https://github.com/cogu/cfile.
  * (61) “Clang,” 2021, https://clang.llvm.org.
  * (62) “Nbref,” 2021, https://github.com/facebookresearch/nbref.git.
  * (63) “llvmir,” 2021, https://llvm.org/docs/LangRef.html.
  * (64) M.-T. Luong, H. Pham, and C. D. Manning, “Effective approaches to attention-based neural machine translation,” _arXiv preprint arXiv:1508.04025_ , 2015.
  * (65) T. Mikolov, I. Sutskever, K. Chen, G. S. Corrado, and J. Dean, “Distributed representations of words and phrases and their compositionality,” in _Advances in neural information processing systems_ , 2013, pp. 3111–3119.
  * (66) K. Yakdan, S. Eschweiler, E. Gerhards-Padilla, and M. Smith, “No more gotos: Decompilation using pattern-independent control-flow structuring and semantic-preserving transformations.” in _NDSS_. Citeseer, 2015.
  * (67) P. S. Abril and R. Plant, “The patent holder’s dilemma: Buy, sell, or troll?” _Communications of the ACM_ , vol. 50, no. 1, pp. 36–44, Jan. 2007. [Online]. Available: http://doi.acm.org/10.1145/1219092.1219093
  * (68) S. Cohen, W. Nutt, and Y. Sagic, “Deciding equivalances among conjunctive aggregate queries,” _J. ACM_ , vol. 54, no. 2, Apr. 2007. [Online]. Available: http://doi.acm.org/10.1145/1219092.1219093
  * (69) J. Cohen, Ed., _Special issue: Digital Libraries_ , vol. 39, no. 11, Nov. 1996\.
  * (70) D. Kosiur, _Understanding Policy-Based Networking_ , 2nd ed. New York, NY: Wiley, 2001.
  * (71) D. Harel, _First-Order Dynamic Logic_ , ser. Lecture Notes in Computer Science. New York, NY: Springer-Verlag, 1979, vol. 68. [Online]. Available: http://dx.doi.org/10.1007/3-540-09237-4
  * (72) I. Editor, Ed., _The title of book one_ , 1st ed., ser. The name of the series one. Chicago: University of Chicago Press, 2007, vol. 9. [Online]. Available: http://dx.doi.org/10.1007/3-540-09456-9
  * (73) ——, _The title of book two_ , 2nd ed., ser. The name of the series two. Chicago: University of Chicago Press, 2008, ch. 100. [Online]. Available: http://dx.doi.org/10.1007/3-540-09456-9
  * (74) A. Z. Spector, “Achieving application requirements,” in _Distributed Systems_ , 2nd ed., S. Mullender, Ed. New York, NY: ACM Press, 1990, pp. 19–33. [Online]. Available: http://doi.acm.org/10.1145/90417.90738
  * (75) B. P. Douglass, D. Harel, and M. B. Trakhtenbrot, “Statecarts in use: structured analysis and object-orientation,” in _Lectures on Embedded Systems_ , ser. Lecture Notes in Computer Science, G. Rozenberg and F. W. Vaandrager, Eds. London: Springer-Verlag, 1998, vol. 1494, pp. 368–394. [Online]. Available: http://dx.doi.org/10.1007/3-540-65193-4_29
  * (76) D. E. Knuth, _The Art of Computer Programming, Vol. 1: Fundamental Algorithms (3rd. ed.)_. Addison Wesley Longman Publishing Co., Inc., 1997.
  * (77) ——, _The Art of Computer Programming_ , 3rd ed., ser. Fundamental Algorithms. Addison Wesley Longman Publishing Co., Inc., 1998, vol. 1, (book).
  * (78) D. Geiger and C. Meek, “Structured variational inference procedures and their realizations (as incol),” in _Proceedings of Tenth International Workshop on Artificial Intelligence and Statistics, The Barbados_. The Society for Artificial Intelligence and Statistics, Jan. 2005.
  * (79) A. Flores-Montoya and E. Schulte, “Datalog disassembly,” in _29th USENIX Security Symposium (USENIX Security 20)_ , 2020, pp. 1075–1092.
  * (80) S. W. Smith, “An experiment in bibliographic mark-up: Parsing metadata for xml export,” in _Proceedings of the 3rd. annual workshop on Librarians and Computers_ , ser. LAC ’10, R. N. Smythe and A. Noble, Eds., vol. 3. Milan Italy: Paparazzi Press, 2010, pp. 422–431. [Online]. Available: http://dx.doi.org/99.0000/woot07-S422
  * (81) M. V. Gundy, D. Balzarotti, and G. Vigna, “Catch me, if you can: Evading network signatures with web-based polymorphic worms,” in _Proceedings of the first USENIX workshop on Offensive Technologies_ , ser. WOOT ’07. Berkley, CA: USENIX Association, 2007.
  * (82) ——, “Catch me, if you can: Evading network signatures with web-based polymorphic worms,” in _Proceedings of the first USENIX workshop on Offensive Technologies_ , ser. WOOT ’08. Berkley, CA: USENIX Association, 2008, pp. 99–100.
  * (83) ——, “Catch me, if you can: Evading network signatures with web-based polymorphic worms,” in _Proceedings of the first USENIX workshop on Offensive Technologies_ , ser. WOOT ’09. Berkley, CA: USENIX Association, 2009, pp. 90–100.
  * (84) S. Andler, “Predicate path expressions,” in _Proceedings of the 6th. ACM SIGACT-SIGPLAN symposium on Principles of Programming Languages_ , ser. POPL ’79. New York, NY: ACM Press, 1979, pp. 226–236. [Online]. Available: http://doi.acm.org/10.1145/567752.567774
  * (85) D. Harel, “Logics of programs: Axiomatics and descriptive power,” Massachusetts Institute of Technology, Cambridge, MA, MIT Research Lab Technical Report TR-200, 1978.
  * (86) D. A. Anisi, “Optimal motion control of a ground vehicle,” Master’s thesis, Royal Institute of Technology (KTH), Stockholm, Sweden, 2003.
  * (87) K. L. Clarkson, “Algorithms for closest-point problems (computational geometry),” Ph.D. dissertation, Stanford University, Palo Alto, CA, 1985, uMI Order Number: AAT 8506171.
  * (88) H. Thornburg. (2001, Mar.) Introduction to bayesian statistics. [Online]. Available: http://ccrma.stanford.edu/~jos/bayes/bayes.html
  * (89) R. Ablamowicz and B. Fauser. (2007) Clifford: a maple 11 package for clifford algebra computations, version 11. [Online]. Available: http://math.tntech.edu/rafal/cliff11/index.html
  * (90) Poker-Edge.Com, “Stats and analysis,” Mar. 2006. [Online]. Available: http://www.poker-edge.com/stats.php
  * (91) B. Obama, “A more perfect union,” Video, Mar. 2008. [Online]. Available: http://video.google.com/videoplay?docid=6528042696351994555
  * (92) J. Scientist, “The fountain of youth,” Aug. 2009, patent No. 12345, Filed July 1st., 2008, Issued Aug. 9th., 2009.
  * (93) D. Novak, “Solder man,” in _ACM SIGGRAPH 2003 Video Review on Animation theater Program: Part I - Vol. 145 (July 27–27, 2003)_. New York, NY: ACM Press, March 21, 2008 2003, p. 4. [Online]. Available: http://video.google.com/videoplay?docid=6528042696351994555
  * (94) N. Lee, “Interview with bill kinder: January 13, 2005,” _Comput. Entertain._ , vol. 3, no. 1, Jan.-March 2005. [Online]. Available: http://doi.acm.org/10.1145/1057270.1057278
  * (95) B. Rous, “The enabling of digital libraries,” _Digital Libraries_ , vol. 12, no. 3, Jul. 2008, to appear.
  * (96) R. Werneck, J. a. Setubal, and A. da Conceicão, “(old) finding minimum congestion spanning trees,” _J. Exp. Algorithmics_ , vol. 5, p. 11, 2000\.
  * (97) ——, “(new) finding minimum congestion spanning trees,” _J. Exp. Algorithmics_ , vol. 5, Dec. 2000. [Online]. Available: http://portal.acm.org/citation.cfm?id=351827.384253
  * (98) M. Conti, R. Di Pietro, L. V. Mancini, and A. Mei, “(old) distributed data source verification in wireless sensor networks,” _Inf. Fusion_ , vol. 10, no. 4, pp. 342–353, 2009.
  * (99) ——, “(new) distributed data source verification in wireless sensor networks,” _Inf. Fusion_ , vol. 10, no. 4, pp. 342–353, Oct. 2009. [Online]. Available: http://portal.acm.org/citation.cfm?id=1555009.1555162
  * (100) C.-L. Li, A. G. Buyuktur, D. K. Hutchful, N. B. Sant, and S. K. Nainwal, “Portalis: using competitive online interactions to support aid initiatives for the homeless,” in _CHI ’08 extended abstracts on Human factors in computing systems_. New York, NY, USA: ACM, 2008, pp. 3873–3878. [Online]. Available: http://portal.acm.org/citation.cfm?id=1358628.1358946
  * (101) B. S. Hollis, _Visual Basic 6: Design, Specification, and Objects with Other_ , 1st ed. Upper Saddle River, NJ, USA: Prentice Hall PTR, 1999.
  * (102) M. Goossens, S. P. Rahtz, R. Moore, and R. S. Sutor, _The Latex Web Companion: Integrating TEX, HTML, and XML_ , 1st ed. Boston, MA, USA: Addison-Wesley Longman Publishing Co., Inc., 1999.
  * (103) J. F. Buss, A. L. Rosenberg, and J. D. Knott, “Vertex types in book-embeddings,” Amherst, MA, USA, Tech. Rep., 1987.
  * (104) ——, “Vertex types in book-embeddings,” Amherst, MA, USA, Tech. Rep., 1987\.
  * (105) _CHI ’08: CHI ’08 extended abstracts on Human factors in computing systems_. New York, NY, USA: ACM, 2008, general Chair-Czerwinski, Mary and General Chair-Lund, Arnie and Program Chair-Tan, Desney.
  * (106) K. L. Clarkson, “Algorithms for closest-point problems (computational geometry),” Ph.D. dissertation, Stanford University, Stanford, CA, USA, 1985, aAT 8506171.
  * (107) _SIGCOMM Comput. Commun. Rev._ , vol. 13-14, no. 5-1, 1984.
  * (108) “Ieee tcsc executive committee,” in _Proceedings of the IEEE International Conference on Web Services_ , ser. ICWS ’04. Washington, DC, USA: IEEE Computer Society, 2004, pp. 21–22. [Online]. Available: http://dx.doi.org/10.1109/ICWS.2004.64
  * (109) S. Mullender, Ed., _Distributed systems (2nd Ed.)_. New York, NY, USA: ACM Press/Addison-Wesley Publishing Co., 1993\.
  * (110) C. J. Petrie, “New algorithms for dependency-directed backtracking (master’s thesis),” Austin, TX, USA, Tech. Rep., 1986.
  * (111) ——, “New algorithms for dependency-directed backtracking (master’s thesis),” Master’s thesis, University of Texas at Austin, Austin, TX, USA, 1986\.
  * (112) D. E. Knuth, _Seminumerical Algorithms_. Addison-Wesley, 1981.
  * (113) W.-C. Kong, “The implementation of electronic commerce in smes in singapore (as incoll),” in _E-commerce and cultural values_. Hershey, PA, USA: IGI Publishing, 2001, pp. 51–74. [Online]. Available: http://portal.acm.org/citation.cfm?id=887006.887010
  * (114) ——, _E-commerce and cultural values_. Hershey, PA, USA: IGI Publishing, 2001, name of chapter: The implementation of electronic commerce in SMEs in Singapore (Inbook-w-chap-w-type), pp. 51–74. [Online]. Available: http://portal.acm.org/citation.cfm?id=887006.887010
  * (115) ——, “Chapter 9,” in _E-commerce and cultural values (Incoll-w-text (chap 9) ’title’)_ , T. Thanasankit, Ed. Hershey, PA, USA: IGI Publishing, 2002, pp. 51–74. [Online]. Available: http://portal.acm.org/citation.cfm?id=887006.887010
  * (116) ——, “The implementation of electronic commerce in smes in singapore (incoll),” in _E-commerce and cultural values_ , T. Thanasankit, Ed. Hershey, PA, USA: IGI Publishing, 2003, pp. 51–74. [Online]. Available: http://portal.acm.org/citation.cfm?id=887006.887010
  * (117) ——, _E-commerce and cultural values - (InBook-num-in-chap)_. Hershey, PA, USA: IGI Publishing, 2004, ch. 9, pp. 51–74. [Online]. Available: http://portal.acm.org/citation.cfm?id=887006.887010
  * (118) ——, _E-commerce and cultural values (Inbook-text-in-chap)_. Hershey, PA, USA: IGI Publishing, 2005, chapter: The implementation of electronic commerce in SMEs in Singapore, pp. 51–74. [Online]. Available: http://portal.acm.org/citation.cfm?id=887006.887010
  * (119) ——, _E-commerce and cultural values (Inbook-num chap)_. Hershey, PA, USA: IGI Publishing, 2006, chapter (in type field) 22, pp. 51–74. [Online]. Available: http://portal.acm.org/citation.cfm?id=887006.887010
  * (120) M. Saeedi, M. S. Zamani, and M. Sedighi, “A library-based synthesis methodology for reversible logic,” _Microelectron. J._ , vol. 41, no. 4, pp. 185–194, Apr. 2010.
  * (121) M. Saeedi, M. S. Zamani, M. Sedighi, and Z. Sasanian, “Synthesis of reversible circuit using cycle-based approach,” _J. Emerg. Technol. Comput. Syst._ , vol. 6, no. 4, Dec. 2010.
  * (122) M. Kirschmer and J. Voight, “Algorithmic enumeration of ideal classes for quaternion orders,” _SIAM J. Comput._ , vol. 39, no. 5, pp. 1714–1747, Jan. 2010. [Online]. Available: http://dx.doi.org/10.1137/080734467
  * (123) C. A. R. Hoare, “Chapter ii: Notes on data structuring,” in _Structured programming (incoll)_ , O. J. Dahl, E. W. Dijkstra, and C. A. R. Hoare, Eds. London, UK, UK: Academic Press Ltd., 1972, pp. 83–174. [Online]. Available: http://portal.acm.org/citation.cfm?id=1243380.1243382
  * (124) J. Lee, “Transcript of question and answer session,” in _History of programming languages I (incoll)_ , R. L. Wexelblat, Ed. New York, NY, USA: ACM, 1981, pp. 68–71. [Online]. Available: http://doi.acm.org/10.1145/800025.1198348
  * (125) E. Dijkstra, “Go to statement considered harmful,” in _Classics in software engineering (incoll)_. Upper Saddle River, NJ, USA: Yourdon Press, 1979, pp. 27–33. [Online]. Available: http://portal.acm.org/citation.cfm?id=1241515.1241518
  * (126) E. M. Wenzel, “Three-dimensional virtual acoustic displays,” in _Multimedia interface design (incoll)_. New York, NY, USA: ACM, 1992, pp. 257–288. [Online]. Available: http://portal.acm.org/citation.cfm?id=146022.146089
  * (127) E. Mumford, “Managerial expert systems and organizational change: some critical research issues,” in _Critical issues in information systems research (incoll)_. New York, NY, USA: John Wiley & Sons, Inc., 1987, pp. 135–155. [Online]. Available: http://portal.acm.org/citation.cfm?id=54905.54911
  * (128) D. D. McCracken and D. G. Golden, _Simplified Structured COBOL with Microsoft/MicroFocus COBOL_. New York, NY, USA: John Wiley & Sons, Inc., 1990.
  * (129) L. Hörmander, _The analysis of linear partial differential operators. III_ , ser. Grundlehren der Mathematischen Wissenschaften [Fundamental Principles of Mathematical Sciences]. Berlin, Germany: Springer-Verlag, 1985, vol. 275, pseudodifferential operators.
  * (130) ——, _The analysis of linear partial differential operators. IV_ , ser. Grundlehren der Mathematischen Wissenschaften [Fundamental Principles of Mathematical Sciences]. Berlin, Germany: Springer-Verlag, 1985, vol. 275, fourier integral operators.
  * (131) A. Adya, P. Bahl, J. Padhye, A.Wolman, and L. Zhou, “A multi-radio unification protocol for IEEE 802.11 wireless networks,” in _Proceedings of the IEEE 1st International Conference on Broadnets Networks (BroadNets’04)_. Los Alamitos, CA: IEEE, 2004, pp. 210–217.
  * (132) I. F. Akyildiz, W. Su, Y. Sankarasubramaniam, and E. Cayirci, “Wireless sensor networks: A survey,” _Comm. ACM_ , vol. 38, no. 4, pp. 393–422, 2002.
  * (133) I. F. Akyildiz, T. Melodia, and K. R. Chowdhury, “A survey on wireless multimedia sensor networks,” _Computer Netw._ , vol. 51, no. 4, pp. 921–960, 2007.
  * (134) P. Bahl, R. Chancre, and J. Dungeon, “SSCH: Slotted seeded channel hopping for capacity improvement in IEEE 802.11 ad-hoc wireless networks,” in _Proceeding of the 10th International Conference on Mobile Computing and Networking (MobiCom’04)_. New York, NY: ACM, 2004, pp. 112–117.
  * (135) “XBOW sensor motes specifications,” 2008, http://www.xbow.com.
  * (136) D. Culler, D. Estrin, and M. Srivastava, “Overview of sensor networks,” _IEEE Comput._ , vol. 37, no. 8 (Special Issue on Sensor Networks), pp. 41–49, 2004.
  * (137) “CodeBlue: Sensor networks for medical care,” 2008, http://www.eecs.harvard.edu/mdw/ proj/codeblue/.
  * (138) A. Natarajan, M. Motani, B. de Silva, K. Yap, and K. C. Chua, “Investigating network architectures for body sensor networks,” in _Network Architectures_ , G. Whitcomb and P. Neece, Eds. Dayton, OH: Keleuven Press, 2007, pp. 322–328.
  * (139) A. Tzamaloukas and J. J. Garcia-Luna-Aceves, “Channel-hopping multiple access,” Department of Computer Science, University of California, Berkeley, CA, Tech. Rep. I-CA2301, 2000.
  * (140) G. Zhou, J. Lu, C.-Y. Wan, M. D. Yarvis, and J. A. Stankovic, _Body Sensor Networks_. Cambridge, MA: MIT Press, 2008\.
  * (141) J. Kornerup, “Mapping powerlists onto hypercubes,” Master’s thesis, The University of Texas at Austin, 1994, (In preparation).
  * (142) M. Gerndt, “Automatic parallelization for distributed-memory multiprocessing systems,” Ph.D. dissertation, University of Bonn, Bonn, Germany, Dec. 1989.
  * (143) J. E. Archer, Jr., R. Conway, and F. B. Schneider, “User recovery and reversal in interactive systems,” _ACM Trans. Program. Lang. Syst._ , vol. 6, no. 1, pp. 1–19, Jan. 1984.
  * (144) D. D. Dunlop and V. R. Basili, “Generalizing specifications for uniformly implemented loops,” _ACM Trans. Program. Lang. Syst._ , vol. 7, no. 1, pp. 137–158, Jan. 1985.
  * (145) J. Heering and P. Klint, “Towards monolingual programming environments,” _ACM Trans. Program. Lang. Syst._ , vol. 7, no. 2, pp. 183–213, Apr. 1985\.
  * (146) D. E. Knuth, _The TeXbook_. Reading, MA.: Addison-Wesley, 1984.
  * (147) E. Korach, D. Rotem, and N. Santoro, “Distributed algorithms for finding centers and medians in networks,” _ACM Trans. Program. Lang. Syst._ , vol. 6, no. 3, pp. 380–401, Jul. 1984.
  * (148) L. Lamport, _L aTeX: A Document Preparation System_. Reading, MA.: Addison-Wesley, 1986.
  * (149) F. Nielson, “Program transformations in a denotational setting,” _ACM Trans. Program. Lang. Syst._ , vol. 7, no. 3, pp. 359–379, Jul. 1985.
  * (150) D. E. Knuth, _Seminumerical Algorithms_ , 2nd ed., ser. The Art of Computer Programming. Reading, MA: Addison-Wesley, 10 Jan. 1981, vol. 2.
  * (151) B. K. Reid, “A high-level approach to computer document formatting,” in _Proceedings of the 7th Annual Symposium on Principles of Programming Languages_. New York: ACM, Jan. 1980, pp. 24–31.
  * (152) G. Zhou, Y. Wu, T. Yan, T. He, C. Huang, J. A. Stankovic, and T. F. Abdelzaher, “A multifrequency mac specially designed for wireless sensor network applications,” _ACM Trans. Embed. Comput. Syst._ , vol. 9, no. 4, pp. 39:1–39:41, April 2010. [Online]. Available: http://doi.acm.org/10.1145/1721695.1721705
  * (153) (2017) Institutional members of the TeX users group. [Online]. Available: http://wwtug.org/instmem.html
  * (154) B. Veytsman. acmart—Class for typesetting publications of ACM. [Online]. Available: http://www.ctan.org/pkg/acmart
  * (155) M. Bowman, S. K. Debray, and L. L. Peterson, “Reasoning about naming systems,” _ACM Trans. Program. Lang. Syst._ , vol. 15, no. 5, pp. 795–825, November 1993.
  * (156) J. Braams, “Babel, a multilingual style-option system for use with latex’s standard document styles,” _TUGboat_ , vol. 12, no. 2, pp. 291–301, June 1991.
  * (157) M. Clark, “Post congress tristesse,” in _TeX90 Conference Proceedings_. TeX Users Group, March 1991, pp. 84–89.
  * (158) M. Herlihy, “A methodology for implementing highly concurrent data objects,” _ACM Trans. Program. Lang. Syst._ , vol. 15, no. 5, pp. 745–770, November 1993.
  * (159) S. Salas and E. Hille, _Calculus: One and Several Variable_. New York: John Wiley and Sons, 1978.
  * (160) S. Fear, _Publication quality tables in LaTeX_, April 2005, http://www.ctan.org/pkg/booktabs.
  * (161) _Using the amsthm Package_ , American Mathematical Society, April 2015, http://www.ctan.org/pkg/amsthm.
  * (162) R Core Team, “R: A language and environment for statistical computing,” R Foundation for Statistical Computing, Vienna, Austria, 2019. [Online]. Available: https://www.R-project.org/
  * (163) S. Anzaroot and A. McCallum, “UMass citation field extraction dataset,” 2013\. [Online]. Available: http://www.iesl.cs.umass.edu/data/data-umasscitationfield
  * (164) A. Vaswani, N. Shazeer, N. Parmar, J. Uszkoreit, L. Jones, A. N. Gomez, L. u. Kaiser, and I. Polosukhin, “Attention is all you need,” in _Advances in Neural Information Processing Systems 30_ , I. Guyon, U. V. Luxburg, S. Bengio, H. Wallach, R. Fergus, S. Vishwanathan, and R. Garnett, Eds. Curran Associates, Inc., 2017, pp. 5998–6008. [Online]. Available: http://papers.nips.cc/paper/7181-attention-is-all-you-need.pdf
  * (165) J. Hu, S. Ruder, A. Siddhant, G. Neubig, O. Firat, and M. Johnson, “XTREME: A massively multilingual multi-task benchmark for evaluating cross-lingual generalization,” _CoRR_ , vol. abs/2003.11080, 2020. [Online]. Available: https://arxiv.org/abs/2003.11080
  * (166) A. V. Aho, M. S. Lam, R. Sethi, and J. D. Ullman, _Compilers: Principles, Techniques, and Tools (2nd Edition)_. USA: Addison-Wesley Longman Publishing Co., Inc., 2006.
  * (167) J. Devlin, M.-W. Chang, K. Lee, and K. Toutanova, “BERT: Pre-training of deep bidirectional transformers for language understanding,” in _Proceedings of the 2019 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, Volume 1 (Long and Short Papers)_. Minneapolis, Minnesota: Association for Computational Linguistics, Jun. 2019, pp. 4171–4186. [Online]. Available: https://www.aclweb.org/anthology/N19-1423
  * (168) A. V. Aho, R. Sethi, and J. D. Ullman, “Compilers, principles, techniques,” _Addison wesley_ , vol. 7, no. 8, p. 9, 1986.
  * (169) A. Darki, M. Faloutsos, N. Abu-Ghazaleh, and M. Sridharan, “Disco: Combining disassemblers for improved performance,” 2021.
  * (170) K. Pei, J. Guan, D. Williams-King, J. Yang, and S. Jana, “Xda: Accurate, robust disassembly with transfer learning,” _arXiv preprint arXiv:2010.00770_ , 2020.
  * (171) Y. Li, D. Tarlow, M. Brockschmidt, and R. Zemel, “Gated Graph Sequence Neural Networks,” _arXiv e-prints_ , p. arXiv:1511.05493, Nov. 2015\.
  * (172) M. Abadi, A. Agarwal, P. Barham, E. Brevdo, Z. Chen, C. Citro, G. S. Corrado, A. Davis, J. Dean, M. Devin, S. Ghemawat, I. Goodfellow, A. Harp, G. Irving, M. Isard, Y. Jia, R. Jozefowicz, L. Kaiser, M. Kudlur, J. Levenberg, D. Mané, R. Monga, S. Moore, D. Murray, C. Olah, M. Schuster, J. Shlens, B. Steiner, I. Sutskever, K. Talwar, P. Tucker, V. Vanhoucke, V. Vasudevan, F. Viégas, O. Vinyals, P. Warden, M. Wattenberg, M. Wicke, Y. Yu, and X. Zheng, “TensorFlow: Large-scale machine learning on heterogeneous systems,” 2015, software available from tensorflow.org. [Online]. Available: http://tensorflow.org/
  * (173) K. He, X. Zhang, S. Ren, and J. Sun, “Deep residual learning for image recognition,” _CoRR_ , vol. abs/1512.03385, 2015. [Online]. Available: http://arxiv.org/abs/1512.03385
  * (174) S. Kullback and R. A. Leibler, “On information and sufficiency,” _The annals of mathematical statistics_ , vol. 22, no. 1, pp. 79–86, 1951.
  * (175) Y. Li, D. Tarlow, M. Brockschmidt, and R. Zemel, “Gated graph sequence neural networks,” _arXiv preprint arXiv:1511.05493_ , 2015.
  * (176) W. Li, X. Zhang, Y. Wang, Z. Yan, and R. Peng, “Graph2seq: Fusion embedding learning for knowledge graph completion,” _IEEE Access_ , vol. 7, pp. 157 960–157 971, 2019.