# Protocol Reverse Engineering

State-inferer recovers a protocol implementation's state machine by program slicing: from each state-variable assignment it runs depth-bounded forward and backward searches on the system dependence graph, hands the LLM one compact fragment per transition, then specializes RFC security properties into linear temporal logic formulas over that model and checks them with nuXmv. On seven open-source TLS, IKEv2 and SSH implementations it reaches a macro-average strict transition-level F-score of 95.2 against 78.9 for the strongest baseline, Codex, and uncovers four previously unknown vulnerabilities, all assigned CVE or CNVD identifiers.

State-inferer recovers a protocol implementation's state machine by program slicing: from each state-variable assignment it runs depth-bounded forward and backward searches on the system dependence graph, hands the LLM one compact fragment per transition, then specializes RFC security properties into linear temporal logic formulas over that model and checks them with nuXmv. On seven open-source TLS, IKEv2 and SSH implementations it reaches a macro-average strict transition-level F-score of 95.2 against 78.9 for the strongest baseline, Codex, and uncovers four previously unknown vulnerabilities, all assigned CVE or CNVD identifiers.