REVIEW 4 cited by
Disassembling Obfuscated Executables with LLM
Not yet reviewed by Pith; the record is open.
This paper has not been read by Pith yet. Machine review is queued; the pith claim, tier, and objections will appear here once it completes.
SPECIMEN: schema-true, not a live event
T0 review · schema-true
One-sentence machine reading of the paper's core claim.
pith:XXXXXXXX · record.json · timestamp
Signed reviews
read the original abstract
Disassembly is a challenging task, particularly for obfuscated executables containing junk bytes, which is designed to induce disassembly errors. Existing solutions rely on heuristics or leverage machine learning techniques, but only achieve limited successes. Fundamentally, such obfuscation cannot be defeated without in-depth understanding of the binary executable's semantics, which is made possible by the emergence of large language models (LLMs). In this paper, we present DisasLLM, a novel LLM-driven dissembler to overcome the challenge in analyzing obfuscated executables. DisasLLM consists of two components: an LLM-based classifier that determines whether an instruction in an assembly code snippet is correctly decoded, and a disassembly strategy that leverages this model to disassemble obfuscated executables end-to-end. We evaluated DisasLLM on a set of heavily obfuscated executables, which is shown to significantly outperform other state-of-the-art disassembly solutions.
Forward citations
Cited by 4 Pith papers
-
Disa: Accurate Learning-based Static Disassembly with Attentions
Disa uses self-attention over superset instructions to identify function entries, true instructions, and memory block boundaries, improving disassembly robustness and CFG recovery on obfuscated binaries.
-
TraceRAG: A LLM-Based Framework for Explainable Android Malware Detection and Behavior Analysis
An LLM-based RAG framework that retrieves method-level Java code snippets to explain and detect malicious behavior in Android apps.
-
Large Language Models in Cybersecurity: Applications, Vulnerabilities, and Defense Techniques
A survey that maps LLM applications, vulnerabilities, and defenses across eight cybersecurity domains, but with significant citation and rigor problems.
-
A Contemporary Survey of Large Language Model Assisted Program Analysis
A review that catalogs how large language models are used in static, dynamic, and hybrid program analysis, and outlines open challenges.
Discussion (0). Continue with ORCID to comment.