2018 · Conference paper
Debin: Predicting Debug Information in Stripped Binaries
Debin predicts debug information for stripped ELF binaries on x86, x64 and ARM. After lifting code to BAP-IR, an Extremely randomized Trees classifier decides which registers and memory offsets hold source-level variables. A conditional random field, solved with Nice2Predict, then jointly predicts names and types for variables and functions, and the result is written back as DWARF sections. On 300 held-out binaries per architecture, the authors report 68.8% precision and 68.3% recall for x64 names and types.
Scope and limitations
The dataset has 3,000 non-stripped executables and shared libraries per architecture from 830 Linux debug-symbol packages of C code built with default package settings, split 2,700/300 for training and testing. Accuracy evaluation assumes given function boundaries; for fully stripped inputs, BAP's ByteWeight infers them, which the paper cites as about 93% accurate. Debin predicts 17 types, and leaves struct and union contents, line numbers and formats such as PE outside the evaluation. A prediction counts only when it equals the original debug value. Models learned from compiler-generated, benign code may be less accurate on obfuscated binaries, hand-written assembly or malware. The 35-sample malware study is manual inspection of decompiled output with no accuracy figures, because the samples lack ground-truth debug information.
Why it fits this collection
Adds learned name and type prediction that works directly on stripped binaries and emits standard debug sections, complementing identifier-naming and symbol-recovery research that operates on decompiler output.
Publication and review details
- Venue
- ACM CCS 2018
- Status
- Conference paper
- Publication / posting date
- October 15, 2018
- Date source
- ACM-deposited Crossref metadata gives print and online publication on 2018-10-15. That is also the first day of the October 15–19 conference; the date comes from the publisher record, not from the conference schedule.
- DOI
- 10.1145/3243734.3243866
Crossref's title field holds only “Debin”; the full title follows the ETH-hosted author PDF, which carries the ACM reference format, DOI and CCS ’18 rights notice. Crossref and the PDF agree on the five-author order and pages 1667–1680. The paper names https://debin.ai as the public tool; that host did not respond on 2026-10-18. The reviewed 2022-05-20 snapshot of eth-sri/debin is Apache-2.0, links the paper and depends on Nice2Predict and BAP. Its README says the setup scripts were tested only on Ubuntu 16.04 with gcc 5.4.0; the Dockerfile pins Ubuntu 16.04, Bazel 0.19.2, OCaml 4.05.0 and BAP 1.4.0, and requirements.txt pins numpy 1.19 and scikit-learn 0.19.2. Pretrained models are a separate archive of about 923 MB from files.sri.inf.ethz.ch.
Sources reviewed
Reviewed against the paper and its primary sources. Cite the original authors using the linked paper or BibTeX.
Primary sources
- https://dl.acm.org/doi/10.1145/3243734.3243866
- https://api.crossref.org/works/10.1145/3243734.3243866
- https://files.sri.inf.ethz.ch/website/papers/ccs18-debin.pdf
- README.md GitHub · eth-sri/debin · Revision 715771c
- LICENSE GitHub · eth-sri/debin · Revision 715771c
- dockerfile GitHub · eth-sri/debin · Revision 715771c
- requirements.txt GitHub · eth-sri/debin · Revision 715771c
- install_dependencies.sh GitHub · eth-sri/debin · Revision 715771c