# Debin: Predicting Debug Information in Stripped Binaries > Debin predicts debug information for stripped ELF binaries on x86, x64 and ARM. After lifting code to BAP-IR, an Extremely randomized Trees classifier decides which registers and memory offsets hold source-level variables. A conditional random field, solved with Nice2Predict, then jointly predicts names and types for variables and functions, and the result is written back as DWARF sections. On 300 held-out binaries per architecture, the authors report 68.8% precision and 68.3% recall for x64 names and types. - Authors: Jingxuan He; Pesho Ivanov; Petar Tsankov; Veselin Raychev; Martin Vechev - Venue: ACM CCS 2018 - Status: Conference paper - Publication / posting date: October 15, 2018 - Date source: ACM-deposited Crossref metadata gives print and online publication on 2018-10-15. That is also the first day of the October 15–19 conference; the date comes from the publisher record, not from the conference schedule. - DOI: 10.1145/3243734.3243866 - Sources reviewed: 2026-10-18 - Added to the catalog: 2026-10-18 - Original paper: - PDF: - Code: - BibTeX: - Catalog page: - Record JSON: - Chinese version: [简体中文](https://awesomerea.org/zh/papers/paper-debin/index.md) ## Scope and limitations The dataset has 3,000 non-stripped executables and shared libraries per architecture from 830 Linux debug-symbol packages of C code built with default package settings, split 2,700/300 for training and testing. Accuracy evaluation assumes given function boundaries; for fully stripped inputs, BAP's ByteWeight infers them, which the paper cites as about 93% accurate. Debin predicts 17 types, and leaves struct and union contents, line numbers and formats such as PE outside the evaluation. A prediction counts only when it equals the original debug value. Models learned from compiler-generated, benign code may be less accurate on obfuscated binaries, hand-written assembly or malware. The 35-sample malware study is manual inspection of decompiled output with no accuracy figures, because the samples lack ground-truth debug information. ## Why it fits this collection Adds learned name and type prediction that works directly on stripped binaries and emits standard debug sections, complementing identifier-naming and symbol-recovery research that operates on decompiler output. ## Publication and review notes Crossref's title field holds only “Debin”; the full title follows the ETH-hosted author PDF, which carries the ACM reference format, DOI and CCS ’18 rights notice. Crossref and the PDF agree on the five-author order and pages 1667–1680. The paper names https://debin.ai as the public tool; that host did not respond on 2026-10-18. The reviewed 2022-05-20 snapshot of eth-sri/debin is Apache-2.0, links the paper and depends on Nice2Predict and BAP. Its README says the setup scripts were tested only on Ubuntu 16.04 with gcc 5.4.0; the Dockerfile pins Ubuntu 16.04, Bazel 0.19.2, OCaml 4.05.0 and BAP 1.4.0, and requirements.txt pins numpy 1.19 and scikit-learn 0.19.2. Pretrained models are a separate archive of about 923 MB from files.sri.inf.ethz.ch. ## Primary sources 1. 2. 3. 4. 5. 6. 7. 8. ## About this entry Reviewed against the paper and its primary sources. Cite the original authors using the linked paper or BibTeX. Original editorial content: MIT. Linked projects, papers and assets retain their own rights and licenses.