fission-decompiler-quality

---

Fission

A Rust-native reverse-engineering workspace. It loads binaries, lifts instruction semantics through Ghidra-style Sleigh specifications, and owns everything after that — its own IR, structuring, type recovery, and rendering.

The long-term target is restoration rather than readability: taking a compiled binary back to a project that builds and runs again, not a listing to read. That target is not reached. Decompiling one binary's 68 functions and compiling them as a single unit currently stops on 20 errors, every one of them a missing or duplicated declaration rather than a wrong statement.

Because the goal is a tree that rebuilds, correctness is checked by execution rather than by eye: fission-dir evaluates the decompiled body, runs the same machine code under fission-emulator, and compares. What it cannot prove it reports as an assumption instead of hiding.

Quick start

Requires Rust 1.85+ and cargo-nextest.

git clone https://github.com/fission-systems/Fission.git
cd Fission
cargo build -p fission-cli --release
./target/release/fission_cli --help

Sleigh specifications and signature data live in utils/, which is committed — the clone already has them, nothing to download. (Only utils/source/, the inputs the packed .fpk tables are built from, stays out of git.)

fission_cli info    <binary>          # format, architecture, provenance
fission_cli list    <binary>          # discovered functions
fission_cli disasm  <binary> --addr 0x1400
fission_cli decomp  <binary> --addr 0x1400010a0
fission_cli decomp  <binary> --all --json
fission_cli xrefs   <binary> --to 0x140002000

For local iteration prefer --profile quick-release. [profile.release] uses fat LTO and codegen-units = 1, which serializes linking and dominates rebuild time; quick-release drops both but keeps opt-level = 3 — measured ~2.9x faster on a one-crate rebuild (44s → 15s) with byte-identical output on the regression set. Use plain --release for anything feeding a benchmark.

Full command reference: docs/CLI.md.

How it works

Binary bytes
  → fission-loader          format, sections, symbols, imports
  → fission-static          facts and provenance
  → fission-sleigh          decode and raw p-code lift
  → fission-pcode  NIR      canonical semantics
  → fission-pcode  HIR      human-readable derivation
  → structuring, cleanup, rendering
  → fission-decompiler      result contracts
  → CLI, TUI, GUI

Two output layers with different contracts:

Structuring

Fission implements all three published approaches against one substrate and lets them compete per function:

The substrate is CollapseGraph: a CFG that shrinks as regions fold, so each match sees the already-simplified shape. Every reference implementation folds a live graph; Fission used to analyse a static one with side tables, and that was the root architectural gap.

Drivers do not pre-empt each other. Each offers a candidate and structuring_quality decides, comparing raw, normalized, and full post-layout output — a candidate that looks worse before cleanup routinely wins after it.

That admission rule is known to be optimizing the wrong thing. Forcing all six drivers onto the near-miss functions yields zero additional exact matches, and goto count does not track the structural distance benchmarks score. Finding a signal that does — computable without the source CFG — is open work.

Evaluation

Fission is scored on DecBench, which measures structure (graph edit distance against the source CFG), types (against DWARF), and byte_match (recompile and diff). All three count only exact matches, so a near miss scores the same as a miss.

Two cautions about reading those numbers, both learned here:

• A benchmark that scores CFG shape and declared types cannot see whether the emitted C does what the binary does. Several real defect classes were found by diffing recompiled assembly or by execution differential, and none of them moved a score by more than a row — dropped writes to globals, return addresses passed as trailing arguments, argument registers read across an intervening call.
• goto density is not a quality metric. Earlier releases reported it as a headline number. The structure metric is purely topological and goto count is not part of it; optimizing structural accuracy instead raised the count.

Current numbers, how each was reached, and the approaches measured and rejected are in docs/changelog/ and docs/EVALUATION.md.

Where to look next

Ownership is strict: a semantic problem in the final pseudocode gets fixed where the behaviour is owned, never in the renderer. Vendor trees under vendor/ are references for reading only — no production path may depend on them at build or runtime.

Testing

cargo nextest run --workspace          # full suite
cargo nextest run -p fission-pcode     # one crate
cargo build --workspace --all-targets  # compile everything

fission-dir carries the execution differential; run it after any change that claims to preserve semantics. Aggregate metrics must not hide row-level regressions — a changed pseudocode file is not automatically an improvement, and a passing synthetic test is necessary but not sufficient for a quality claim. The reasoning is in AGENTS.md.

Security

Fission analyses untrusted binaries. Sample handling rules are in docs/MALWARE_SAMPLE_POLICY.md. Rep