12 ms·

I delivered a talk at Rust Sydney about this exact topic last week: https://reorchestrate.com/posts/your-binary-is-no-longer-safe/ https://reorchestrate.com/po

I delivered a talk at Rust Sydney about this exact topic last week: https://reorchestrate.com/posts/your-binary-is-no-longer-safe/ https://reorchestrate.com/posts/your-binary-is-no-longer-saf... I am able to translate multi-thousand line c functions - and reproduce bug-for-bug implementation

measurablefunc 7mo ago
Decompilation does not preserve semantics. You generally do not know whether the code from the decompiler will be compiled to semantically equivalent binary that you initially decompiled.
- seddonm1 7mo ago
  My test harness loads up the original DLL then executes that in parallel against the converted code (differential testing). That closes the feedback loop the LLM needs to be able to find and fix discrepancies. I'm also doing this on an old Win32 DLL so the task is probably much easier than a lot of code bases.
  - measurablefunc 7mo ago
    What are you tracking during the runtime tracing? Or is that written up in your link?
    - seddonm1 7mo ago
      I am applying differential/property based testing to all the side effects of functions (mutations) and return values. The rust code coverage is also used to steer the LLM as it finds discrepancies in side effects. It is written up in my link - please bear in mind it is really hard to find the right level to communicate this level of detail at - so I'm happy to answer questions.
      - measurablefunc 7mo ago
        That's fine, that answers my question.
- easyThrowaway 7mo ago
  Many of the decompiled console games of the '90s were originally written in C89 using an ad-hoc compiler from Metrowerks or some off-branch release of gcc-2.95 plus console specific assemblers. I willing to bet that the decompiled output is gonna be more readable than the original source code.
  - measurablefunc 7mo ago
    Not related to what I was saying. Compilation is a many-to-one transformation & although you can try to guess an inverse there is no way to guarantee you will recover the original source b/c at the assembly level you don't have any types & structs.

measurablefunc 7mo ago

Decompilation does not preserve semantics. You generally do not know whether the code from the decompiler will be compiled to semantically equivalent binary that you initially decompiled.

seddonm1 7mo ago
My test harness loads up the original DLL then executes that in parallel against the converted code (differential testing). That closes the feedback loop the LLM needs to be able to find and fix discrepancies. I'm also doing this on an old Win32 DLL so the task is probably much easier than a lot of code bases.
- measurablefunc 7mo ago
  What are you tracking during the runtime tracing? Or is that written up in your link?
  - seddonm1 7mo ago
    I am applying differential/property based testing to all the side effects of functions (mutations) and return values. The rust code coverage is also used to steer the LLM as it finds discrepancies in side effects. It is written up in my link - please bear in mind it is really hard to find the right level to communicate this level of detail at - so I'm happy to answer questions.
    - measurablefunc 7mo ago
      That's fine, that answers my question.
easyThrowaway 7mo ago
Many of the decompiled console games of the '90s were originally written in C89 using an ad-hoc compiler from Metrowerks or some off-branch release of gcc-2.95 plus console specific assemblers. I willing to bet that the decompiled output is gonna be more readable than the original source code.
- measurablefunc 7mo ago
  Not related to what I was saying. Compilation is a many-to-one transformation & although you can try to guess an inverse there is no way to guarantee you will recover the original source b/c at the assembly level you don't have any types & structs.