Kuna: Decompiler Development in the Age of Coding Agents

Today, I’m releasing Kuna, an experimental decompiler I’ve been processing complete the summertime while moving arsenic a visiting module interrogator astatine the Air Force Research Lab (AFRL) and a investigation chap astatine Metalware. However, erstwhile I opportunity that I person been developing, I should explain that an LLM has written astir each statement of codification successful this project.

Yet, arsenic it stands now, this decompiler rivals the manufacture standard, IDA Pro (9.2), successful control travel structuring connected C programs: successful recent benchmark results, Kuna achieves cleanable structuring connected 44.4% of functions, compared pinch IDA’s 45.7%. This was mostly achieved done autonomous refinement: the LLM studies examples wherever it performs worse than IDA Pro connected basal metrics, which person only emerged complete the past fewer years. Using this strategy, it tin efficaciously learn really different decompiler solves a difficult problem done proceedings and error.

IDA Pro was besides not the only decompiler studied successful this betterment process. This ample refinement research besides progressive Ghidra and the angr decompiler; I spent my full PhD arsenic a halfway developer of the latter. This method of learning allowed an LLM to reimplement, successful Kuna, much than 20 basal features from angr, which took america years to creation done scientific advancements successful decompilation. I stress each of this to explain that this task is much than conscionable slop: it is simply a genuinely experimental attack to processing a scientifically absorbing instrumentality that gets amended automatically.

A snippet from Kuna and Hex-Rays showing a celebrated angr move feature

With each of that said, I besides want to admit limitations successful this attack and really this activity mightiness impact the investigation community.

First, Kuna is only imaginable done the decades-long efforts of scientists and engineers advancing decompiler research. Kuna is, successful fact, a Rust larboard of the NSA’s Ghidra, reworked to much intimately lucifer angr’s pipeline. That is besides why I don’t scheme connected leaving the angr decompiler immoderate clip soon. The angr decompiler is still the first spot I spell to for processing frontier algorithms successful decompilation, simply because it was designed for that.

Kuna, connected the different hand, is an experiment successful seeing what tin beryllium done pinch high-level technological feedback alone. At this point, it would beryllium importantly harder to constitute thing by manus successful Kuna. Kuna needs angr (and different open-source research), and my dream is that, aft much time, angr will request Kuna (if the research is simply a success).

Second, Kuna requires technological penetration to moreover statesman “automatic” refinement, which apt explains why nary different decompiler has done this yet (that I cognize of). Getting to this constituent required discovering caller fundamental metrics, studying what aligns pinch human reversing values, and gathering insights complete years to understand what information a meaningful benchmark requires. The gist: this is besides not automatic research; it requires investigation led by humans.

Third, and finally, location is still importantly much advancement to beryllium made successful this decompiler. We are doing good connected structuring, but decompilation is much than conscionable structuring! We request to amended types, optimizations, recompilability, adaptable identification… you get the idea. This is, aft all, an research to spot if it is moreover imaginable to execute each those things wrong the model we’re utilizing to create Kuna. And I (we) could really usage your help.

If you are willing successful the internals of Kuna, the goals of the project, aliases really automatic betterment works, spell cheque retired the code aliases hold for a much method follow-up post. As always, I’d for illustration to admit those who person helped maine refine my ideas and push guardant the research. My PhD advisors, Fish and Yan, are the biggest sources of inspiration for my research. I americium besides grateful for the insights from Metalware, AFRL, and the Department of Defense, which thief make my investigation impactful.

See you each astatine the adjacent checkpoint of the experiment!