A local model for machine code without source. What we measured.
What today's tools miss in a raw firmware image, and where our small model stands next to large cloud models. Every number comes from the same data, including the places where we lose.
On AI use. The write-ups on this site, and the site itself, were made with Claude (Anthropic). The measurements come from our own pipeline and data. Our posts elsewhere are written by hand; we use AI as an assistant when interpreting the analysis.
One firmware image, analysed two ways. Today's tools miss 52 of its 93 functions.
The missed ones are not minor: startup (Reset, main), the task scheduler and the interrupt handlers. The information that finds them sits in the vector table at the start of the image.
- 0x20020000 stack top · RAM
- 0x600024C4 Reset
- 0x60003E54 SVC
- 0x60003E9C PendSV
- 0x60003FF0 SysTick
The table tells the CPU where to start after reset and where to jump on each interrupt. The pointers are odd because of the Thumb bit: …c5 → Reset at …c4.
Correct base address, still not enough
rbasefind answered 0x60002000, backed by 2 pointers against 1 for the runner-up. Ghidra still missed 52 functions.
The misses are the core of the device
Reset, main, xTaskCreate, the scheduler, and the SVC, PendSV and SysTick handlers. Today an analyst finds these by hand.
85 / 93 with the vector table
Most of the remaining 8 are tasks and callbacks that the code only references by pointer.
Not a single example. The missing pieces are the base address and the vector table.
We built these images from open RTOS and library code with real MCU memory maps, so the true address of every function is known. We ran Ghidra under four conditions.
On a raw Cortex-M image today, 2% of startup and interrupt code is found automatically, and for 41 of the 239 images no base address is found at all. Given the correct base and vector table, that becomes 100%. The vector table alone adds 20 points [10–34]. We are building the module that recovers this information automatically with a confidence score; its own accuracy has not been measured yet.
Naming a stripped function: our 8B model next to large cloud models.
The model never sees the function's name. It gets the machine code, the call context and Ghidra pseudocode, and writes a name and a description in two languages. The score is token F1 on the name; "exact" counts functions where the name matched in full.
of the large cloud model's score with the same input. Ours is 8B and runs on your own machine.
from v1 to v6. Same base model and test set; only the data and the input changed.
of descriptions judged correct (automatic judge, 294 decisions). 20% for v5.
The same machine code, four guesses. Where we win and where we lose.
The model sees sub_0004 instead of the name. The evidence is in the lines: division by 10, ASCII digits, a growing buffer, a copy to the end.
append_int | json_get | srgb_to_linear | |
|---|---|---|---|
| asmsense v1 | itoa | lxlsx_reader_worksheet_find_cell | sigmoid |
| asmsense v6 | append_int | json_object_get | sRGB |
| DeepSeek | append_uint_to_string | lookup_symbol_by_name | saturate |
| MiMo | append_uint_to_buffer | lookup_key_by_name | srgb_to_linear |
We lose the third one: v6 recognised the sRGB curve but read the direction of the conversion backwards; MiMo got the name exactly.
What we do not claim.
- The firmware images in 01–02 are synthetic: built from open code with known source. How this carries over to real field firmware has not been measured.
- The "with base and vector table" numbers are an upper bound: Ghidra was given that information correctly. The accuracy of our module that recovers it automatically is the next measurement.
- Confidence intervals come from a bootstrap over applications; with 12 applications they are wide.
- In naming, v6 fell behind v5 on the small control set (eval_115: 0.135 vs 0.155). We missed our name targets (0.14 / 0.17) and the 25% description target.
- Description scores come from an automatic judge, not from people. The untrained Qwen3-8B has not been run on this set yet.