Toward Reliable Code De-obfuscation with Large Language Models
Large language models have recently improved in code generation and comprehension, but they remain brittle when handling obfuscated code with degraded structural and semantic cues. Code obfuscation, widely used to resist reverse engineering, hampers malware analysis, vulnerability detection, and software maintenance. Recovering the original semantics of obfuscated programs is therefore an important yet understudied problem. This work analyzes how and why model performance degrades on obfuscated code, and further proposes a prototype prompt guard mechanism to validate ideas for improving the reliability of semantic restoration. Using a Java based ProGuard dataset that we constructed from 857 valid samples, we first found that functional or structural degradation occurred in about 32% of baseline outputs. We then applied three progressively constrained prompts (V1–V3) designed to preserve API signatures, control flow, and semantic integrity. When evaluated on 43 low performing baseline samples (< 80), the proportion of low quality outputs decreased from 100% to 34.9%, representing a relative reduction of approximately 65%. This targeted improvement also translated to the full dataset: the global proportion of low performing samples decreased from 30% to 18%, yielding an overall relative reduction of about 40%. Furthermore, the number of high quality outputs (≥ 90) increased from 0 to 18, indicating substantial gains in both stability and readability. Our findings quantitatively reveal the reliability limits of LLM based code de-obfuscation and demonstrate that prompt level structural constraints alone can markedly enhance restoration accuracy and coherence. This work provides empirical evidence and methodological foundations for advancing automated code recovery, reverse engineering, and security analysis using LLMs.