Table of contents
15
By Salman Khan, OSCP+, Founder of XHack, SRT (Synack Red Team member)
Read this in 30 seconds: An AI decompiler is any tool that uses a language model to turn compiled machine code back into readable source, and the name covers three different things. Today the dependable approach is to run a conventional decompiler such as Ghidra first and use AI to clean up and explain the output, then verify the result against the binary.
- Three kinds exist, and they behave differently. Models that rewrite a conventional decompiler’s output, models trained to decompile directly, and agents that drive decompilers through tools.
- The best published numbers are author-reported. The LLM4Decompile paper (EMNLP 2024) says its models beat GPT-4o and Ghidra by over 100% on re-executability across two benchmarks, but those are function-level tests.
- Benchmarks may flatter the models. The same research group later wrote that earlier benchmarks relied on contest-style or synthetic mappings that diverge significantly from real-world ones.
- Verification is the whole job. AI output can look clean and still change what the code does, so recompile, test and compare against the disassembly before you trust a name or a type.
- XHack is not a standalone decompiler. Its agent runs decompilation pipelines for Android and iOS apps, such as jadx, as part of authorised testing.
If you searched for an AI decompiler, you probably want to paste a binary somewhere and get C back. A few web tools offer that, and I cover what to expect. But the honest answer is more useful than the short one: AI decompilation helps most as a second pass on top of a conventional decompiler, and it fails in ways you can check.
This guide explains the three kinds of AI decompiler, what the research shows, where they fail, how to verify the output, and how to use them legally. I run XHack, so I have a financial interest in what you choose, and I say where XHack does not fit.
A decompiler turns machine code into something a person can read, and an AI decompiler builds on that. Traditional tools such as Ghidra, IDA Pro and Binary Ninja do this with fixed rules, and the output is usually correct in structure but ugly: names like local_28, generic types and tangled control flow.
An AI decompiler adds a language model. The label covers three distinct designs.
| Kind | How it works | Example | Main risk |
|---|---|---|---|
| 1. AI cleanup of decompiler output | A conventional tool decompiles first. A model renames variables, adds types, adds comments and explains functions | Community plugins and bridges for Ghidra and IDA | The model can rename something wrongly with full confidence |
| 2. A model trained to decompile | A model reads assembly or bytes and writes source directly | LLM4Decompile (open-source, 1.3B to 33B parameters) | Output can be readable but not equivalent to the original |
| 3. An agent that drives decompilers | A model calls tools: runs a decompiler, reads the result, asks follow-up questions and writes notes | MCP bridges to Ghidra or IDA, or a security agent | It can wander, and its notes need checking |
The most useful way to think about any AI decompiler is a division of labour. The rule-based tool is good at structure. The model is good at meaning: guessing what a function is for, what a variable holds, and how to name it.
For the wider picture of AI and reverse engineering, see AI reverse engineering. This article stays on the AI decompiler itself. If your goal is turning a bug into a proof of concept, AI exploit development covers that side, and unrestricted AI for penetration testing explains how verified access works.
Match the AI decompiler to the job, not the hype.
| You want to | Use | Notes |
|---|---|---|
| Understand a function quickly in a tool you already know | Ghidra or IDA plus a model for cleanup | Lowest risk, because the structure comes from a rule-based decompiler |
| Drive Ghidra or IDA from an AI assistant | A community MCP bridge | Projects such as GhidraMCP and ReVa (Ghidra) and ida-pro-mcp (IDA) exist and are actively maintained. Secure any MCP server you connect, as covered in our MCP server security guide |
| Experiment with a trained decompiler | Open-source LLM4Decompile models | Research-grade, function-level, best treated as a second opinion |
| Get a rough look at a small binary fast | A hosted web tool | Check where the file goes before you upload anything sensitive |
| Analyse an Android or iOS app as part of a test | An agent with mobile pipelines such as jadx | Narrower than a general decompiler, but built for this job |
| Reverse a sensitive sample offline | A local setup | Samples never leave your machine |
Ghidra, released by the US National Security Agency as an open-source reverse engineering framework, is free to use under the Apache 2.0 licence. The community bridges are large: on GitHub, GhidraMCP has more than 11,000 stars and ida-pro-mcp more than 13,000, though stars only measure interest, not quality.
One roadmap note. Hex-Rays, the company behind IDA, said in its 2026 priorities post (3 March 2026) that reverse engineers “and their agentic servants” will get a new set of tools called Engines, including a Knowledge Engine and a Semantic Engine. That post describes plans, so treat them as planned, not shipped.
The strongest published evidence comes from the LLM4Decompile paper by Tan, Luo, Li and Zhang, presented at EMNLP 2024. The authors released the first and largest open-source series of models trained to decompile binaries, from 1.3 billion to 33 billion parameters.
The measure they use matters. It is re-executability: whether the decompiled code, when recompiled and run, passes the original tests. That is a stricter and more honest measure than “does it look right.”
According to the authors, their end-to-end models significantly outperform GPT-4o and Ghidra on the HumanEval and ExeBench benchmarks by over 100% in re-executability rate. They also report that a second approach, refining Ghidra’s output with a fine-tuned model, adds a further 16.2% over their end-to-end models. The paper’s own framing is that LLM decompilers complement conventional tools.
Now the caveats, which are just as important.
So the fair summary is that trained decompilers are a real research advance, but a single percentage from a paper is not a promise about your binary.
A general chat model is a weaker AI decompiler. The same abstract reports the purpose-trained models beating GPT-4o on re-executability, which suggests a general assistant is better at explaining a snippet than at producing a faithful decompilation.
Failures are the reason verification matters for any AI decompiler. Here are the common ones.
Confident wrong names. A model can name a function validate_license because the surrounding strings suggest it, even if the code does something else. Names feel like facts, which is why they are dangerous.
Readable but not equivalent. Recompilable and readable code can still differ from the original in small ways, such as an off-by-one bound or a changed integer width. Re-executability scores exist because looks are not enough.
Optimisation and stripping. Inlined functions, removed symbols and compiler tricks blur the link between binary and source. The Decompile-Bench authors say widespread function inlining makes mapping binaries to source hard.
Invented behaviour. Models can describe code that is not there. A broader 2026 study of AI-assisted malware analysis, cited in our AI reverse engineering guide, found the AI inventing a botnet command that did not exist in the binary.
Lost autonomy on hard problems. Bishop Fox described a case where Claude Code with a Binary Ninja MCP bridge decrypted a SonicWall firmware image from a one-line instruction, and titled the post “senior-level skill, junior-level autonomy”. It was one case, and the model needed a human to redirect it once.
The pattern across all five is the same: the output looks authoritative while the checks are still yours to do.
Treat every AI decompiler result as a draft. This workflow catches most problems with an AI decompiler, and it is at the analysis level, not a recipe for anything harmful.
This is slower than accepting the first answer from an AI decompiler, and that is the point.
Using an AI decompiler can be lawful or not depending on what you analyse and why. Rules vary by country, by licence terms and by contract, so this is not legal advice.
Some principles hold almost everywhere.
If you are unsure, ask a lawyer about your specific situation before you start.
XHack is not a standalone AI decompiler, and I would rather say that plainly than have you find out later. It is not a general desktop workbench for taking apart an arbitrary Windows binary the way you would in Ghidra or IDA Pro.
What it does offer next to an AI decompiler is reverse engineering as part of authorised testing. The XHack agent page lists a mobile pentest stack: native APK and IPA static analysis, jadx and androguard decompilation pipelines, exported-component testing over ADB, and Frida hooks for runtime work. You can drop an Android APK into the chat for manifest, permission and component analysis, hardcoded-secret hunting and decompilation, with one-click setup for jadx. The mobile app testing feature goes into the detail.
Three more points matter for this audience.
Verification and accountability. Unrestricted capability is gated behind identity verification, and every operation is logged. Researcher accounts are approved on a government ID plus a professional credential.
Privacy. XHack does not store your agent chats, which matters when you analyse something sensitive.
Honest limits. The self-serve agent is agent-driven, so you confirm what it finds. XHack’s Terms say AI output can be incomplete, inaccurate or wrong, and XHack AI mistakes explains where our own agent gets things wrong.
Individual plans run $20, $49 and $150 a month, with a 7-day free trial limited to one per person. See XHack pricing for what each plan lists, and the AI malware analysis guide for the lab workflow. If you want the full capability set, every XHack AI agent feature lists it.
An AI decompiler is a tool that uses a language model to turn compiled machine code back into readable source. It covers three designs: a model that cleans up a conventional decompiler’s output, a model trained to decompile directly, and an agent that drives decompilers through tools.
Yes, in parts. Ghidra is free and open-source, and LLM4Decompile is an open-source series of decompilation models. Some hosted web tools are free to try, but check where your file goes before you upload anything sensitive, and check each tool’s terms.
A general chat model can explain and tidy small snippets, but it is not a faithful decompiler. The LLM4Decompile abstract reports purpose-trained models beating GPT-4o on re-executability, so use a chat model as an explainer on top of a conventional decompiler.
It depends on the binary and the benchmark. LLM4Decompile’s authors report large gains over Ghidra and GPT-4o on function-level tests, but a later paper from the same group says earlier benchmarks diverge from real-world ones. Verify any result before you rely on it.
It depends on the software, your licence and your country. Analysing your own code, authorised targets or lawfully held samples is common practice, while breaking a licence term or testing without permission may not be. This is not legal advice, so ask a lawyer about your own situation.
Not as a standalone tool. XHack’s agent runs decompilation pipelines for Android and iOS apps, such as jadx and androguard, as part of authorised testing. For arbitrary desktop binaries, use Ghidra or IDA and treat the AI decompiler as a second pass.
An AI decompiler is a useful second pass, not a replacement for a conventional decompiler or for your own checking. The research is real and improving, the numbers are author-reported and function-level, and the failure modes are easy to miss because the output reads well.
Pick the AI decompiler approach that fits the job, keep the rule-based output next to the AI version, verify names and behaviour before you trust them, and stay inside the licence and scope. If your work is mobile apps in an authorised test, try the agent on the XHack pricing page with the 7-day trial and read the verification terms first.
Categories
Related articles
