$ show monkbai/DNN-decompiler
This repository implements BTD, a deep neural network (DNN) executable decompiler for x86 binaries. It recovers model specifications (operator types, topology, dimensions, parameters) from DNN executables compiled by TVM, Glow, and NNFusion frameworks. The system uses dynamic binary instrumentation via Intel Pin to collect execution traces, applies symbolic execution and taint analysis to recover tensor shapes, extracts parameters from memory dumps, and rebuilds models in PyTorch for correctness verification. The architecture consists of interconnected Python scripts and Pin tools organized around a three-phase decompilation pipeline: trace collection and filtering, shape recovery via symbolic execution, and parameter extraction. Key entry points include evaluation shell scripts (decompile_eval.sh, op_infer_eval.sh) and model-specific decompile/rebuild scripts in the evaluation/ directory. The system relies on external dependencies including Intel Pin 3.14, IDA Pro 7.5 (optional), and specific compiler versions (TVM v0.7-v0.9, Glow 2020-2022, NNFusion).
The LLM identified 3 files worth highlighting for reuse:
Defines an LSTM-based model with attention mechanism for classifying assembly instruction sequences into operator types (e.g., conv, add, relu). The component is self-contained, depending only on PyTorch and standard libraries, and demonstrates reusable sequence classification architecture applicable to other binary analysis tasks.
Implements a symbolic execution engine for recovering tensor shapes from execution traces. It handles memory and register states, supports linear arithmetic constraints, and is decoupled from the specific decompilation workflow. This engine demonstrates non-obvious skill in constraint solving and state management, making it reusable for other binary analysis tasks requiring symbolic reasoning.
Provides dynamic taint analysis for filtering instruction traces to identify instructions affecting specific memory regions. It implements forward and backward taint propagation with custom handling for x86-64 instructions (mov, arithmetic, logical, xmm-specific). The component demonstrates reusable taint analysis patterns with global state management and can be adapted for other dynamic binary instrumentation scenarios.