marfrit
cf6ddf8e91
Tested candidate.c across GCC-15 and clang-19 optimization levels: gcc -Os → 116 B (+12) clang -O2/Os/Oz → 108 B (+4) ← best vendor → 104 B (0) Vendor output is SMALLER than GCC -Os, which rules out 'spa-appointment dumb compiler' (hypothesis b). Clang being only 4 bytes off suggests the vendor uses armclang or a similarly-tuned LLVM fork (hypothesis a). Immediate consequence: default compiler for matching-decomp on this blob is clang, not GCC. Our train_phy_block starting score jumps from 89.7% (GCC -Os) to 96% (clang -Oz) before any C tweaking. Pushing past 96% likely needs armclang or per-site inline asm. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
RE-tool benchmark — three functions from the RK3588 DDR blob
Three small, self-contained functions extracted from
rk3588_ddr_lp4_1848MHz_lp5_2112MHz_v1.19.bin, each with canonical
ground-truth semantics so you can judge decompiler output against a
known answer.
| dir | blob offset | size | ground truth |
|---|---|---|---|
01_memset/ |
0x0aac |
28 B / 7 insts | memset(void*, u8, size_t) byte-wise |
02_memcpy32/ |
0x1200 |
36 B / 9 insts | memcpy32(u32*, const u32*, size_t) word-aligned |
03_magic_memset/ |
0x0da4 |
40 B / 9 insts | if (*(u32*)0x1fe004 == 0x54410001) memset(0x1fe000, 0, 0x32c); |
Each subdir contains:
func.bin— raw little-endian AArch64 machine codefunc.s— objdump'd GNU asm, same absolute addresses as the blobreference.c— ground-truth C (our belief)ghidra.md— load-in-Ghidra recipe + expected outputdecompme.md— decomp.me scratch recipe (matching-decomp)retdec.md— retdec command lineretdec.c— retdec's actual output (captured 2026-04-15)
Summary of findings: see RESULTS.md. Short version:
- Ghidra got all three right with minor type-label cleanup needed.
- retdec failed on #1 and #2 (can't infer register-passed arguments on raw binary), did well on #3 (the one with absolute-address refs).
- decomp.me is a matching-decomp comparator, not a decompiler — judged on a different axis.
Load address matters
All three functions are extracted as raw bytes starting at offset 0 in
their func.bin. When loading into Ghidra / retdec, set the base
address to the function's original blob offset (first column above),
otherwise branch targets and absolute-address refs in function #3 will
be off.