LLM-DAS: An LLM-Powered Deobfuscation System for ARM Binary Code
摘要
Deobfuscation techniques play a crucial role in enhancing the readability and analyzability of obfuscated code, thereby facilitating more effective reverse engineering and security analysis. However, the majority of existing deobfuscation research has primarily focused on the source code level, with limited effectiveness in deobfuscating binary code. Despite the emergence of Large Language Models (LLMs) and their effective application in the deobfuscation domain, there remains a lack of research leveraging LLMs for deobfuscating ARM binary code. In this paper, we construct a high-quality dataset of obfuscated ARM assembly code, comprising seven types of single obfuscations and seven types of multiple obfuscations. Based on this, we propose LLM-DAS, the first deobfuscation system specifically designed for ARM binary code and grounded in large language models. LLM-DAS consists of two finetuned large models tailored for obfuscation detection and deobfuscation, respectively, and we evaluate its performance. The experimental results demonstrate that the obfuscation detection component achieves an average accuracy and precision of 91.96% and 94.94%, respectively. In terms of deobfuscation performance, it attains a maximum average SacreBLEU score of 26.21, representing improvements of 20.09 and 17.11 compared to Llama3 and Qwen2.5, which have the same parameter scale. Furthermore, when evaluated against three metrics within the Obfuscation Quality Quantification Framework, LLM-DAS also outperforms the aforementioned two models.