LLM decompilation research
decomp-synth — search-based decompilation
A project-agnostic engine that searches for byte-exact source reconstructions of retail binaries, grown in seven weeks into a distributed compute farm and a pre-registered ML research program.
program synthesis · applied ML · distributed compute
Matching decompilation means rewriting C/C++ until a specific vintage compiler reproduces a shipped binary byte for byte. The last stretch of any function is a search problem: the code is already correct, but the compiler chose a different register order or instruction schedule, so the bytes differ. decomp-synth automates that search. It maintains a library of 140 self-registering, behavior-preserving source rewrites, recompiles every candidate through the target project’s real build system, and scores it against the retail object with objdiff — hill-climbing, beam search, or evolutionary search over a ground-truth oracle rather than a model of one.
The engine was extracted from a single game-preservation project into a clean, pip-installable core with zero game-specific logic, and now serves three heterogeneous toolchains (MSVC/Xbox 360 and MetroWerks/Wii) through a small per-project shape config. On its primary target it has strictly matched 11,292 of 65,619 functions (17.2%).
The hardest problem was the fitness function itself. Early on, the metric-guided loop shipped two subtly wrong rewrites that its own score rewarded — one flipped a multiply into an addition for +3.25 points; another swapped the arguments of a non-commutative call for pure rounding noise. Both were hand-diagnosed and turned into a formal correctness model: fuzzy scores are treated as an adversary that can be gamed, classifiers are advisory only, and byte-exact recompilation is the sole terminal judge. It is a fully documented case study of reward hacking in a program-synthesis loop, and the fix generalizes to any system driven by an imperfect metric.
From there the tool kept promoting itself. A distributed farm of rented spot CPU instances now runs whole-translation-unit joint search, streaming every mutation to durable storage as append-only logs that double as training data — a search-as-data-mining flywheel feeding a fine-tuned LLM proposer. The research side is pre-registered and honest: experiments run against a frozen 342-function benchmark with McNemar-tested readouts, and levers that fail their own kill-criteria get retired, negative results committed with the same care as wins. Roughly 1,790 commits in seven weeks, including a parity-tested Rust port of the hot core, a fleet-management toolchain for interruptible cloud instances, and an observability dashboard that grew its own interactive ML teaching course.