{"id":"https://openalex.org/W7155001717","doi":"https://doi.org/10.48550/arxiv.2604.15390","title":"Analyzing Chain of Thought (CoT) Approaches in Control Flow Code Deobfuscation Tasks","display_name":"Analyzing Chain of Thought (CoT) Approaches in Control Flow Code Deobfuscation Tasks","publication_year":2026,"publication_date":"2026-04-16","ids":{"openalex":"https://openalex.org/W7155001717","doi":"https://doi.org/10.48550/arxiv.2604.15390"},"language":"en","primary_location":{"id":"pmh:doi:10.13016/m24bze-4erq","is_oa":false,"landing_page_url":"http://hdl.handle.net/11603/42789","pdf_url":null,"source":{"id":"https://openalex.org/S4406922384","display_name":"Open MIND","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Text"},"type":"preprint","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.48550/arxiv.2604.15390","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5134013076","display_name":"Seyedreza Mohseni","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Mohseni, Seyedreza","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5015130109","display_name":"Sarvesh Baskar","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Baskar, Sarvesh","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5068036546","display_name":"Edward Raff","orcid":"https://orcid.org/0000-0002-9900-1972"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Raff, Edward","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5023667301","display_name":"Manas Gaur","orcid":"https://orcid.org/0000-0002-5411-2230"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Gaur, Manas","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":4,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":true,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10260","display_name":"Software Engineering Research","score":0.7670999765396118,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10260","display_name":"Software Engineering Research","score":0.7670999765396118,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10743","display_name":"Software Testing and Debugging Techniques","score":0.12559999525547028,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.04769999906420708,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/control-flow","display_name":"Control flow","score":0.7735000252723694},{"id":"https://openalex.org/keywords/control-flow-graph","display_name":"Control flow graph","score":0.6388999819755554},{"id":"https://openalex.org/keywords/code","display_name":"Code (set theory)","score":0.5185999870300293},{"id":"https://openalex.org/keywords/graph","display_name":"Graph","score":0.4726000130176544},{"id":"https://openalex.org/keywords/obfuscation","display_name":"Obfuscation","score":0.4575999975204468},{"id":"https://openalex.org/keywords/task","display_name":"Task (project management)","score":0.4553999900817871},{"id":"https://openalex.org/keywords/set","display_name":"Set (abstract data type)","score":0.4426000118255615},{"id":"https://openalex.org/keywords/source-code","display_name":"Source code","score":0.43130001425743103},{"id":"https://openalex.org/keywords/structured-prediction","display_name":"Structured prediction","score":0.3743000030517578},{"id":"https://openalex.org/keywords/control","display_name":"Control (management)","score":0.3716999888420105}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8357999920845032},{"id":"https://openalex.org/C160191386","wikidata":"https://www.wikidata.org/wiki/Q868299","display_name":"Control flow","level":2,"score":0.7735000252723694},{"id":"https://openalex.org/C27458966","wikidata":"https://www.wikidata.org/wiki/Q1187693","display_name":"Control flow graph","level":2,"score":0.6388999819755554},{"id":"https://openalex.org/C2776760102","wikidata":"https://www.wikidata.org/wiki/Q5139990","display_name":"Code (set theory)","level":3,"score":0.5185999870300293},{"id":"https://openalex.org/C132525143","wikidata":"https://www.wikidata.org/wiki/Q141488","display_name":"Graph","level":2,"score":0.4726000130176544},{"id":"https://openalex.org/C40305131","wikidata":"https://www.wikidata.org/wiki/Q2616305","display_name":"Obfuscation","level":2,"score":0.4575999975204468},{"id":"https://openalex.org/C2780451532","wikidata":"https://www.wikidata.org/wiki/Q759676","display_name":"Task (project management)","level":2,"score":0.4553999900817871},{"id":"https://openalex.org/C177264268","wikidata":"https://www.wikidata.org/wiki/Q1514741","display_name":"Set (abstract data type)","level":2,"score":0.4426000118255615},{"id":"https://openalex.org/C43126263","wikidata":"https://www.wikidata.org/wiki/Q128751","display_name":"Source code","level":2,"score":0.43130001425743103},{"id":"https://openalex.org/C80444323","wikidata":"https://www.wikidata.org/wiki/Q2878974","display_name":"Theoretical computer science","level":1,"score":0.3882000148296356},{"id":"https://openalex.org/C22367795","wikidata":"https://www.wikidata.org/wiki/Q7625208","display_name":"Structured prediction","level":2,"score":0.3743000030517578},{"id":"https://openalex.org/C2775924081","wikidata":"https://www.wikidata.org/wiki/Q55608371","display_name":"Control (management)","level":2,"score":0.3716999888420105},{"id":"https://openalex.org/C207850805","wikidata":"https://www.wikidata.org/wiki/Q269608","display_name":"Reverse engineering","level":2,"score":0.35679998993873596},{"id":"https://openalex.org/C88468194","wikidata":"https://www.wikidata.org/wiki/Q1172416","display_name":"Data-flow analysis","level":3,"score":0.3549000024795532},{"id":"https://openalex.org/C199360897","wikidata":"https://www.wikidata.org/wiki/Q9143","display_name":"Programming language","level":1,"score":0.35409998893737793},{"id":"https://openalex.org/C98183937","wikidata":"https://www.wikidata.org/wiki/Q2112188","display_name":"Program analysis","level":2,"score":0.35010001063346863},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.3343999981880188},{"id":"https://openalex.org/C192209626","wikidata":"https://www.wikidata.org/wiki/Q190909","display_name":"Focus (optics)","level":2,"score":0.3249000012874603},{"id":"https://openalex.org/C137293760","wikidata":"https://www.wikidata.org/wiki/Q3621696","display_name":"Language model","level":2,"score":0.3212999999523163},{"id":"https://openalex.org/C102379954","wikidata":"https://www.wikidata.org/wiki/Q2589940","display_name":"Call graph","level":2,"score":0.3190999925136566},{"id":"https://openalex.org/C2780009758","wikidata":"https://www.wikidata.org/wiki/Q6804172","display_name":"Measure (data warehouse)","level":2,"score":0.3093000054359436},{"id":"https://openalex.org/C133162039","wikidata":"https://www.wikidata.org/wiki/Q1061077","display_name":"Code generation","level":3,"score":0.30630001425743103},{"id":"https://openalex.org/C2985179714","wikidata":"https://www.wikidata.org/wiki/Q627335","display_name":"Work flow","level":2,"score":0.30480000376701355},{"id":"https://openalex.org/C179603123","wikidata":"https://www.wikidata.org/wiki/Q1941921","display_name":"Modeling language","level":3,"score":0.30379998683929443},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.29919999837875366},{"id":"https://openalex.org/C2779530757","wikidata":"https://www.wikidata.org/wiki/Q1207505","display_name":"Quality (philosophy)","level":2,"score":0.2985999882221222},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.2939999997615814},{"id":"https://openalex.org/C16311509","wikidata":"https://www.wikidata.org/wiki/Q4148050","display_name":"Dependency graph","level":3,"score":0.28850001096725464},{"id":"https://openalex.org/C137287247","wikidata":"https://www.wikidata.org/wiki/Q1329550","display_name":"Static program analysis","level":4,"score":0.28200000524520874},{"id":"https://openalex.org/C38349280","wikidata":"https://www.wikidata.org/wiki/Q1434290","display_name":"Flow (mathematics)","level":2,"score":0.27799999713897705},{"id":"https://openalex.org/C175154964","wikidata":"https://www.wikidata.org/wiki/Q380077","display_name":"Task analysis","level":3,"score":0.2775000035762787},{"id":"https://openalex.org/C2780586882","wikidata":"https://www.wikidata.org/wiki/Q7520643","display_name":"Simple (philosophy)","level":2,"score":0.2750999927520752},{"id":"https://openalex.org/C489000","wikidata":"https://www.wikidata.org/wiki/Q747385","display_name":"Data flow diagram","level":2,"score":0.27410000562667847},{"id":"https://openalex.org/C2777561058","wikidata":"https://www.wikidata.org/wiki/Q2652119","display_name":"Program comprehension","level":4,"score":0.2614000141620636}],"mesh":[],"locations_count":2,"locations":[{"id":"pmh:doi:10.13016/m24bze-4erq","is_oa":false,"landing_page_url":"http://hdl.handle.net/11603/42789","pdf_url":null,"source":{"id":"https://openalex.org/S4406922384","display_name":"Open MIND","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Text"},{"id":"doi:10.48550/arxiv.2604.15390","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2604.15390","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"article"}],"best_oa_location":{"id":"doi:10.48550/arxiv.2604.15390","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2604.15390","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"article"},"sustainable_development_goals":[],"awards":[],"funders":[{"id":"https://openalex.org/F4320309204","display_name":"University of Maryland, Baltimore County","ror":"https://ror.org/02qskvh78"}],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Code":[0],"deobfuscation":[1,110],"is":[2,54],"the":[3,87,147,156,195,199,205,209,250],"task":[4],"of":[5,10,27,86,93,124,164,208,244],"recovering":[6],"a":[7,11,50,121],"readable":[8],"version":[9],"program":[12,94,245],"while":[13,247],"preserving":[14],"its":[15],"original":[16,210],"behavior.":[17],"In":[18,36],"practice,":[19],"this":[20,37],"often":[21],"requires":[22],"days":[23],"or":[24],"even":[25],"months":[26],"manual":[28,251],"work":[29],"with":[30,113,160],"complex":[31],"and":[32,77,80,91,103,128,139,150,171,198,241],"expensive":[33],"analysis":[34],"tools.":[35],"paper,":[38],"we":[39,81],"explore":[40],"an":[41,161],"alternative":[42],"approach":[43,119],"based":[44,142],"on":[45,66,120,143,194,204],"Chain-of-Thought":[46],"(CoT)":[47],"prompting,":[48],"where":[49],"large":[51,100,220],"language":[52,101,221],"model":[53,189],"guided":[55],"through":[56],"explicit,":[57],"step-by-step":[58],"reasoning":[59],"tailored":[60],"for":[61,135,228,254],"code":[62,229,233],"analysis.":[63],"We":[64,96,116],"focus":[65],"control":[67,88,136,211,237],"flow":[68,89,137,212,238],"obfuscation,":[69],"including":[70],"Control":[71],"Flow":[72],"Flattening":[73],"(CFF),":[74],"Opaque":[75],"Predicates,":[76],"their":[78],"combination,":[79],"measure":[82],"both":[83,132],"structural":[84,133],"recovery":[85],"graph":[90,169,239],"preservation":[92,176,243],"semantics.":[95],"evaluate":[97],"five":[98],"state-of-the-art":[99],"models":[102,149,222],"show":[104,187],"that":[105,188,218],"CoT":[106],"prompting":[107],"significantly":[108],"improves":[109],"quality":[111],"compared":[112,180],"simple":[114],"prompting.":[115,183],"validate":[117],"our":[118,178],"diverse":[122],"set":[123],"standard":[125],"C":[126],"benchmarks":[127,179],"report":[129],"results":[130,185],"using":[131],"metrics":[134,141],"graphs":[138],"semantic":[140,175],"output":[144],"similarity.":[145],"Among":[146],"tested":[148],"by":[151],"applying":[152],"CoT,":[153],"GPT5":[154],"achieves":[155],"strongest":[157],"overall":[158],"performance,":[159],"average":[162],"gain":[163],"about":[165,172],"16%":[166],"in":[167,174],"control-flow":[168],"reconstruction":[170],"20.5%":[173],"across":[177],"to":[181],"zero-shot":[182],"Our":[184],"also":[186,203],"performance":[190],"depends":[191],"not":[192],"only":[193],"obfuscation":[196],"level":[197],"chosen":[200],"obfuscator":[201],"but":[202],"intrinsic":[206],"complexity":[207],"graph.":[213],"Collectively,":[214],"these":[215],"findings":[216],"suggest":[217],"CoT-guided":[219],"can":[223],"serve":[224],"as":[225],"effective":[226],"assistants":[227],"deobfuscation,":[230],"providing":[231],"improved":[232],"explainability,":[234],"more":[235],"faithful":[236],"reconstruction,":[240],"better":[242],"behavior":[246],"potentially":[248],"reducing":[249],"effort":[252],"needed":[253],"reverse":[255],"engineering.":[256]},"counts_by_year":[],"updated_date":"2026-06-11T09:08:48.828518","created_date":"2026-04-21T00:00:00"}