Structure-Guided Semantic Deobfuscation of Android Identifiers

Abstract

Android developers frequently employ identifier renaming to obfuscate code and hinder reverse engineering. This practice effectively conceals program semantics. However, it severely impedes downstream security analysis tasks, particularly manual inspection of malicious and privacy-sensitive behaviors. Existing deobfuscation techniques rely on code similarity, learned naming priors, or local LLM reasoning. These methods often exhibit severe limitations when applied to proprietary, heavily obfuscated, or cross-file context-dependent code. In this paper, we present DeMask, a novel framework that integrates static program analysis with Large Language Models (LLMs) to recover meaningful identifiers from obfuscated Android apps. Guided by program structure, DeMask executes a bottom-up, context-aware inference process for whole-app semantic reconstruction. It incorporates tailored naming constraints and optimization strategies to mitigate LLM hallucinations and ensure scalability for real-world codebases. We implemented a prototype and evaluated it on diverse datasets of benign and malicious Android apps. The results demonstrate that DeMask significantly outperforms prior work in semantic accuracy and naming consistency. Specifically, it achieves an average effective semantic recovery of over 88.6% across all evaluation settings.