Qwen3.5-4B-SFT-decompiler-O0-full

Qwen3.5-4B-SFT-decompiler-O0-full

Rewrites decompiler output into readable C source with meaningful names and proper types. A Qwen3.5-4B fine-tune trained on unoptimized binaries, for security researchers and reverse engineers.

Made by Divij on Hugging Face. These notes are Mindket's, written from its model page and model card; the model's own files and license are on Hugging Face.

About

What it is: This is a fine-tune of Qwen3.5-4B for binary decompilation. You give it C code produced by a decompiler such as Ghidra, IDA Pro or angr, and it predicts the original human written source. The raw output tends to be hard to read, with placeholder names for variables, numbers written in hex and tangled branching. The model returns cleaner code with meaningful names and proper types. It was trained on the O0 split, which means code built without compiler optimization.

Who it suits: Security researchers and reverse engineers who read decompiled code and want a cleaner starting point.

Industry | Who uses it | How they use it | Example
Security research | Analysts who study binaries | Feed decompiler output in and read the recovered source | Cleaning up one function from a disassembled program
Reverse engineering | Engineers who analyze compiled code | Compare the model's output with the raw decompiler text | Checking that the recovered logic matches the control flow
Research | People who study decompilation | Evaluate it on structural measures such as control flow graphs | Reproducing the card's graph edit distance test

Skip it if your binaries were built with compiler optimization, since the card describes only the O0 split.

Where to use it: It runs with the transformers library or with vLLM. The files download on Windows, macOS or Linux.

• Python with transformers and torch
• vLLM, which the card recommends for batch inference
• Windows, macOS or Linux: where you can fetch the files with Python

Use case | Who | What they get back
Function recovery | Reverse engineers | Readable C for one decompiled function
Batch cleanup | Analysts | Recovered source for many functions through vLLM
Benchmarking | Researchers | Control flow comparisons against the baseline

How to set it up: You need Python and a GPU that holds a 4.7B model. The bf16 weights are about 9.3 GB.

• Python with pip
• transformers, or vLLM for batch work
• About 9.3 GB of space for bf16 weights, or about 2.3 GB at 4-bit as an estimate

1. Install the Hugging Face hub library.
2. Download the model files, or let your code fetch them by name.
3. Run the loading code with transformers or vLLM.

pip install -U huggingface_hub
hf download Divij/Qwen3.5-4B-SFT-decompiler-O0-full

How to use it: Put the decompiled code in a chat message, apply the chat template with thinking turned off, and generate. The vLLM version below is the one the card recommends for batches.

import vllm

llm = vllm.LLM(model="Divij/Qwen3.5-4B-SFT-decompiler-O0-full", trust_remote_code=True)
sampling_params = vllm.SamplingParams(temperature=0, max_tokens=2048, skip_special_tokens=True)

# Format prompt using chat template
from transformers import AutoTokenizer
tokenizer = AutoTokenizer.from_pretrained("Divij/Qwen3.5-4B-SFT-decompiler-O0-full", trust_remote_code=True)

decompiled_code = "..."  # your decompiled code here
messages = [{"role": "user", "content": decompiled_code}]
prompt = tokenizer.apply_chat_template(messages, tokenize=False, add_generation_prompt=True, enable_thinking=False)

outputs = llm.generate([prompt], sampling_params)
print(outputs[0].outputs[0].text)

Tool | What it does
vllm.LLM | Loads the model for fast batch generation
vllm.SamplingParams | Sets greedy decoding and a 2048 token limit
apply_chat_template | Turns your decompiled code into the model prompt

Example: You paste a decompiled function that compares two encryption policy structures, full of names like a0 and v1. The model returns C source for the same function with meaningful variable names and clear control flow.

For newcomers and experts: If you are new to this, a decompiler turns a program back into rough code, and this model tidies that code. Start with one short function and read the result against the original decompiler text.

If you know the field, the card says training used 29,698 O0 examples from several decompilers, with two epochs at a learning rate of 5e-6. Evaluation compares control flow graphs by graph edit distance, where zero means an identical graph.

Decompiled C goes into the prompt
Chat template builds the input
Model generates source code
You read the recovered C

Good to know: The card reports its own test on the O0 test split of 5,942 examples. Lower graph edit distance is better.

Title: Card test, control flow graph distance
Measure | This model | Raw decompiler output
Mean distance | 12.36 | 15.92
Median distance | 0.00 | 5.00
Perfect matches | 75.0 percent | 34.9 percent

The model produced code the checker could parse in 99.9 percent of cases.

• License: Apache 2.0
• Cost to run: none named, you supply the hardware
• Data it reaches: the decompiled code you pass in
• Not for: optimized binaries, since the card covers only the O0 split

On Hugging Face, 13 November 2026

• Task: text generation
• Parameters: 4.7B
• Weights: about 9.3 GB in BF16; about 2.3 GB at 4-bit (estimate)
• Formats: Safetensors
• Downloads in the last 30 days: 162
• Likes: 9
• License: apache-2.0
• Languages: en
• Based on: Qwen/Qwen3.5-4B
• Quantized versions: 1
• Tags: safetensors, qwen3_5, decompilation, code, security, reverse-engineering, text-generation, conversational

Links

• Model: https://huggingface.co/Divij/Qwen3.5-4B-SFT-decompiler-O0-full
• Files: https://huggingface.co/Divij/Qwen3.5-4B-SFT-decompiler-O0-full/tree/main

Get the model

Download its files with Hugging Face's command line:

pip install -U huggingface_hub
hf download Divij/Qwen3.5-4B-SFT-decompiler-O0-full

Then follow the usage in its model card. Nothing in this kit runs by itself.