Neural C Decompiler

Upload a binary executable file, get readable, compilable and functional equivalent C code. No setup, just results.

Compilable Output0.74 compilation rate on HumanEval

Functional Equivalence0.57 pass rate on HumanEval

Semantic ClarityHigh readability achieved by high similarity metrics

Workflow FriendlyChat with an reverse engineer AI specialist

Recovered from x86_64 ELF

// Decompiled with DecompilerAI
#include <stdio.h>

int findMSBPosition(int a) {
    int i, k = 0;
    if (a == 0)
        return -1;
    for (i = 0; i < 32; i++) {
        if ((a >> i) & 1) { k = i; }
    }
    return k;
}

int main() {
    int a = 37;
    printf("MSB position of %d: %d\n", a, findMSBPosition(a));
    return 0;
}

// Target
#include <stdio.h>

int findMSBPosition(int num) {
    if (num == 0) return -1;
    int position = -1;
    for (int i = 0; i < sizeof(int) * 8; i++) {
        if (num & (1 << i))
            position = i;
    }
    return position;
}

int main() {
    int num = 37;
    printf("MSB position of %d: %d\n", num, findMSBPosition(num));
    return 0;
}

Why DecompilerAI

Accuracy, Explainability, Speed

Neural Decompilation

We leverage costum trained AI-models to yield explainable high-level C code currently for any non-obfuscated x86 binary program compiled via clang or gcc.

LLM-Assisted Decompilation

We leverage various tools like traditional decompilers and LLMs (DeepSeek, OpenAI, ...) to yield explainable clean code.

Readability

We target to deliver readable source code. Appropiate function/variable names, types, and comments help users understand the high-level source code in a faster fashion.

Compilability

Unlike traditional decompilers (e.g. Ghidra, IDA Pro HexRays Decompiler, ...) that yield pseudocode, we target to deliver compilable source code. We deliver the source code along instructions to build the program from scratch.

Functional Correctness

We target to deliver source code that is functionally correct. The input and output behaviour of the target and decompiled program should be identical.

Seamless Upload

Drag-and-drop binary executable files and request decompilation right away. ELF today; PE & Mach-O on the roadmap.

How it works

Bytes In. Readable Code Out. Just 3 Steps.

1

Upload

Submit a binary (ELF, x86/x86_64). We fingerprint compiler/flags and extract metadata.

2

Wait

We analyze the uploaded file, run the file trough the pipeline, and respond with a possible decompilation as source code attachment.

3

Validate

Validate the quality of the decompilation.

Demo

BENCHMARKS

Repository Complexity

Benchmark	.c/.h	SLOC/fn	CC	CG depth	FI/FO	LC
HumanEval	164	39.93	3.44	1.00	0.88	0.73
ExeBench	222	25.39	1.72	0.25	0.20	0.86
Random GitHub	1776	2312.29	37.85	2.06	1.29	-
Coreutils	1680	132.47	8.34	9.93	2.04	0.75
OpenSSL	1795	251.17	6.06	31.49	2.79	0.66
FFmpeg	4336	284.98	7.29	18.39	2.54	0.09

SLOC/fn = source lines of code per function, CC = cyclomatic complexity, CG depth = average call-graph depth, FI/FO = average fan-in/fan-out, LC = GCOV line coverage.

Compilation, Pass Rate, and GCOV Coverage

Decompiler	Benchmark	Metric	Baseline Test Suite					DecEvalSe
			O0	O1	O2	O3	AVG	O0	O1	O2	O3	AVG
Ghidra+ LLM4Decompile	HumanEval	Compilation Rate	0.87	0.80	0.85	0.81	0.83	0.87	0.81	0.84	0.81	0.84
		Pass Rate	0.69	0.46	0.47	0.46	0.52	0.67	0.41	0.42	0.40	0.48
		GCOV	0.73	0.68	0.66	0.55	0.66	0.86	0.81	0.80	0.82	0.82
	ExeBench	Compilation Rate	0.63	0.42	0.42	0.42	0.47	0.63	0.42	0.42	0.42	0.47
		Pass Rate	0.44	0.29	0.29	0.28	0.33	0.41	0.28	0.28	0.27	0.31
		GCOV	0.86	0.87	0.85	0.88	0.87	0.90	0.89	0.89	0.89	0.89

HumanEval ratios are computed over 116 functions. ExeBench ratios are computed over 500 functions. The baseline consists of handwritten tests for HumanEval and randomized DecEvalRand tests for ExeBench.

Complex Repositories at O0

Decompiler	Repository	Comp. Rate	Pass Rate	KLEE-IC	GCOV-LC	Time [h]
Ghidra+ LLM4Decompile	HumanEval	0.87	0.67	0.33	0.86	0.3
	Coreutils	0.71	0.67	0.27	0.75	2.7
	OpenSSL	0.48	0.25	0.36	0.86	2.5
	FFmpeg	0.61	0.45	0.29	0.90	6.4
Ghidra+ SK2Decompile	HumanEval	0.88	0.76	0.33	0.85	1.1
	Coreutils	0.50	0.46	0.28	0.72	3.2
	OpenSSL	0.40	0.21	0.33	0.78	3.0
	FFmpeg	0.55	0.42	0.29	0.89	9.8
Ghidra+ Idioms	HumanEval	0.76	0.65	0.33	0.86	1.2
	Coreutils	0.46	0.45	0.32	0.91	3.6
	OpenSSL	0.38	0.19	0.28	0.75	3.4
	FFmpeg	0.44	0.35	0.27	0.93	10.0

For the complex-repository setup, the paper evaluates Coreutils 9.7, OpenSSL 3.0.15, and FFmpeg 7.1.3, with up to 500 functions per executable.

Evaluation Details

Exact decompiler configurations used for the evaluation: LLM4Decompile with the Ghidra-refined approach and the LLM4Decompile-Ref-6.7B checkpoint; SK2Decompile with the sk2decompile-struct-6.7b and sk2decompile-ident-6.7b checkpoints; Idioms with the opt-O0-codegemma-7b-neighbors checkpoint. The setup also uses Ghidra 11.0.3 PUBLIC, clang-format 21.0.0git, and angr 9.2.102.

Evaluation sample sizes: 116 functions from HumanEval, 500 functions from ExeBench test_real, and for the complex repository study, 500 functions per executable.

Supported function coverage includes pointer-based inputs, pointer-based return values, functions without return values via observable side effects, and functions reading from standard input. More complex cases such as nested pointers, multidimensional arrays, and deeply nested structs can exceed the default model, so some functions may be excluded or only partially analyzed.

For benchmark descriptions, it is most accurate to refer to these counts as evaluated functions or an evaluation subset, rather than implying a complete denominator over all theoretically supported signatures.

Supported Platforms & Features

Category	Supported
Compilers	GCC Clang
Architectures	x86 x86_64
Binary Formats	ELF

FAQ

Is my uploaded program & retrieved code private?

Within our pipeline your program, retrieved decompilation, and any other interaction is processed securely. Nevertheless, for the final step we do forward it to OpenAI's LLM models for code cleaning purposes.

Will we add support for other architectures, file formats and languages in the future?

If there is demand, then for sure!

How did we develop this neural decompiler?

We plan to be more transparent on this matter in near future by explaining in a blog what someone needs to develop one. In the end, we trained a seq2seq model to translate machine code back to high-level source code.

Get started!