Decompilation and LLM reverse engineering

Spark already ships a deep research page — this card does not replace it. It orients the knowledge hive and stresses one lesson: recompile success is not semantic fidelity.

Read first (canonical)

• LLM decompile research (keep intact): research/LLM_DECOMPILE.md → /docs/llm-decompile.html
• Deterministic dump / inspect: Decompile → /docs/decompile.html
• Diagrams: Diagrams

Core lesson

When LLM Decompilers Recompile More and Preserve Less (arXiv:2609.05370) shows candidates that pass shipped tests can still diverge under fuzz / broader inputs; vulnerabilities can vanish from “clean” recompiled code.

Traditional tools leave unknowns visible. LLMs may invent types, fields, and guards that look professional.

Spark stance

flowchart LR
         bin[Binary] --> dump[Deterministic dump]
         bin --> llm[LLM assist]
         dump --> soT[SPARK_BC truth]
         llm --> human[Human review]
         human --> soT

Not an OpenBin UX clone. Continue on the research page for Quarkslab, LLM4Decompile, DecompileBench, HELIOS, AutoDecompiler, and friends.

Hive: Knowledge · Factory: Factory hub.