petal-RE

A small, fast model that translates disassembly → C (asm → C). It does one job — structural translation — with no reasoning trace. Function naming, type recovery and analysis are delegated to a separate downstream model that reads petal-RE's C output plus the asm as context.

binary ─▶ disassembler ─▶ petal-RE (asm→C, tiny+local) ─▶ clean C ─▶ reasoning model

Model

• Base: Qwen/Qwen3.5-4B-Base, re-tokenized to a compact 24,576-token asm/C BPE vocabulary (down from 248k — frees ~25-30% of params, no human-language tokens), embeddings warm-started via Fast Vocabulary Transfer.
• Training: LoRA continued-pretraining (settle transplanted embeddings) → merge → LoRA SFT (asm→C, loss masked to the C). embed_tokens fully trained throughout.
• Corpus: BlossomsAI/PetalRE-Corpus — Decompile-Bench (clean x86-64), repo-gen (clean multi-arch), obf-exebench + Tigress (obfuscated: control-flow flattening, MBA / encode-arithmetic).

Prompt format

petal-RE uses structured tags. The model is trained to emit C between <c> and </c>:

<src=asm><arch=x86_64><opt=O2><dec=raw>
<func>
<normalized AT&T assembly>
</func>
<c>

Generate until </c>. Calls are normalized to fn/fn0/fn1... and RIP-relative operands to REL(%rip) — symbol names are deliberately stripped, so the model recovers structure, not identifiers (that's the downstream model's job).

Usage

import torch
from transformers import AutoModelForCausalLM, AutoTokenizer

m = AutoModelForCausalLM.from_pretrained("BlossomsAI/petalRE-4B", torch_dtype=torch.bfloat16).cuda()
t = AutoTokenizer.from_pretrained("BlossomsAI/petalRE-4B")

asm = "push %rbp\nmov %rsp,%rbp\nmov %edi,%eax\nimul %edi,%eax\nadd %edi,%eax\npop %rbp\nret"
prompt = "<src=asm><arch=x86_64><opt=O2><dec=raw>\n<func>\n" + asm + "\n</func>\n<c>\n"

out = m.generate(**t(prompt, return_tensors="pt").to("cuda"),
                 max_new_tokens=512, do_sample=False,
                 stop_strings=["</c>"], tokenizer=t)
print(t.decode(out[0], skip_special_tokens=False))

Limitations

• No identifier recovery. Input is symbol-stripped; the model produces the correct control-flow / call skeleton with placeholder names. Pair with a reasoning model that has symbol/context access for production decompilation.
• Best on x86-64 and AArch64 (priority arches); other ISAs are lower-coverage.

Apache-2.0, same as the base model.