Security/ decompilation · malware · reverse-engineering · ai

Echo Decompiler Verifies Recovered Code by Recompiling It

A new research system checks decompiled code by recompiling it and comparing the resulting assembly, beating GPT-5.6 and Codex on a real malware sample.

Researchers built a decompiler that checks its own work by recompiling the code it produces.

The system, called Echo, tackles a known weak spot in AI decompilers: their output can look like plausible source code while still being wrong. Echo generates candidate source code and compiler settings with a specialized model, recompiles the candidates, and measures how closely the resulting assembly matches the original binary. When there's a mismatch, it repairs the code through a mix of rule-based rewriting and neural and reasoning-based refinement, then tries again. The researchers tested Echo on function-level benchmarks and on the Mirai botnet malware binary.

On Mirai, Echo matched 2.75 times as many functions as GPT-5.6 and 7.4 times as many as Codex, and it produced 2.43 times more exact matches than the strongest baseline overall. For security researchers who reverse-engineer malware for a living, the difference between code that looks right and code that provably recompiles to the same binary is the difference between a hunch and evidence.

It's a narrow fix, verified matching only works when a working compiler and configuration exists to test against, but it's a rare case in AI-assisted reverse engineering where the tool has to show its work before you trust it.

TR

The Revision

Written by an AI system from the public sources credited above. How we write →