Deobfuscation techniques play a crucial role in enhancing the readability and analyzability of obfuscated code, thereby facilitating more effective reverse engineering and security analysis. However, the majority of existing deobfuscation research has primarily focused on the source code level, with limited effectiveness in deobfuscating binary code. Despite the emergence of Large Language Models (LLMs) and their effective application in the deobfuscation domain, there remains a lack of research leveraging LLMs for deobfuscating ARM binary code. In this paper, we construct a high-quality dataset of obfuscated ARM assembly code, comprising seven types of single obfuscations and seven types of multiple obfuscations. Based on this, we propose LLM-DAS, the first deobfuscation system specifically designed for ARM binary code and grounded in large language models. LLM-DAS consists of two finetuned large models tailored for obfuscation detection and deobfuscation, respectively, and we evaluate its performance. The experimental results demonstrate that the obfuscation detection component achieves an average accuracy and precision of 91.96
原文链接
分享
引用
