LLM Agent-Assisted Reverse Engineering with Quantitative Readability Metrics

Automatic decompilers produce functionally correct but often unreadable C code. This paper addresses one stage of the reverse engineering workflow: improving the readability of decompiled code using LLM agents guided by quantitative metrics. We present a three-phase research evolution. Phase 1 (tool-driven steering via Ghidra MCP) suffered from incomplete coverage and inconsistent improvements due to lack of quantitative guidance. Phase 2 (structural similarity validation alone) revealed that agents optimize for metrics in unintended ways, producing structurally equivalent but less readable code. Our contribution is the Quantitative Readability Score (QRS) framework, a composite metric combining a structural similarity gate with three independent readability sub-metrics (Lexical Surprisal, Structural Simplicity, and Idiomatic Quality). We demonstrate that QRS-guided refinement enables LLM agents to make targeted readability improvements without sacrificing correctness. We provide a discussion of the broader reverse engineering workflow (binary lifting, decompilation cleanup, and achieving functional equivalence) as context, however, it remains out of scope.

Paper

References (17)

01Un-guided Tool-Driven Steering Insufficient : Providing agents with tools (Ghidra) without quantitative guidance leads to incomplete work and inconsistent quality.Agents need explicit
02Determine the structural similarity score using the ‘function-level similarity analysis using radare2’s control-flow graph (CFG) comparison functionality’ strategy
03Calculate each individual QRS sub-metric (Lexical Sur-prise, Structural Simplicity, and Idiomatic Quality) and the overall QRS score
04cppcoreguidelines-avoid-goto : Goto statements
05Multidimensional Metrics Enable Principled Re-finement : Combining three independent readability sub-metrics with a structural similarity gate creates a “quality Pareto frontier” thatconstrains agents from
06cppcoreguidelines-pro-bounds-pointer-arithmetic : Alerts on pointer arithmetic
07Actionable : Sub-metrics must have a clear scope and provide actionable feedback to an agent on how to improve
08Generate improvement guidance based on the lowest scoring sub-metric(s)
09Validate correctness by measuring structural similarity of the recompiled binary
10readability-identifier-length : Checks for very short names (1-2 chars)
11readability-magic-numbers : Raw hex/decimal literals
12readability-isolate-declaration : Identifies when multiple vars appear on one lineint x, y, z

Scroll for more · 5 remaining

Similar papers

© 2026 NYSGPT2525 LLC