2024 · Conference paper
TYGR: Type Inference on Stripped Binaries using Graph Neural Networks
TYGR infers the types of stack and heap variables in stripped binaries by running an architecture-agnostic, intra-procedural data-flow analysis on angr's VEX IR and classifying each variable's data-flow graph with a graph neural network. It predicts base types, pointers and struct member layouts, covering 97.1% of the types observed in its data. The authors also build TyDa, 163,643 binaries compiled with debug information from Gentoo and Debian C packages for x86, x64, AArch64, Arm32 and MIPS at O0–O3, and deduplicate functions in the evaluated subset before splitting it. On x64 across O0–O3 they report 76.6% overall and 45.2% struct accuracy, and say TYGR beats prior work by at least 26.1% overall and 10.2% on structs.
Scope and limitations
Ground truth comes from DWARF information in binaries compiled by the authors, and training and testing use TyDa-min, about 8% of TyDa's binaries, so the results do not cover wild, obfuscated or C++ code. The analysis is intra-procedural and covers stack and heap variables only, not globals; unresolved indirect jumps can leave code unexplored, and adjacent stack structs are predicted as one struct, though the authors find this rare in TyDa. Accuracy plateaus near 80% as training data grows, which the authors attribute to rare types and types that usage alone cannot distinguish. Comparisons follow each baseline's original setting: DIRTY and OSPREY on x64 only, and OSPREY through results its authors supplied for Coreutils x64-O0. Accuracy is not compared directly with Ghidra or IDA Pro. Predictions choose from a fixed set of base, pointer and struct-member types; they do not recover type names or full struct declarations.
Why it fits this collection
Adds graph-neural-network type inference over data-flow graphs and a multi-architecture type-recovery dataset, complementing decompiler-output, LLM-based and synthesis-based type recovery research.
Publication and review details
- Venue
- USENIX Security 2024
- Status
- Conference paper
- Publication / posting date
- August 2024
- Date source
- Publication month in the official USENIX proceedings BibTeX; the August 14–16, 2024 symposium dates are not used to assert a publication day.
The USENIX page, its BibTeX entry and the final PDF agree on the 14-author order, pages 4283–4300 and ISBN 978-1-939133-44-1. USENIX assigns no paper DOI and no arXiv version was found. The paper releases its artifacts at github.com/sefcom/TYGR. At the reviewed 2024-08-22 commit the repository has no license file; it ships trained MODEL_base and MODEL_struct models, and its environment pins Python 3.8, PyTorch 1.8.1 with CUDA 10.2 and angr 9.0.7491. TyDa is not in the repository: the README links two Dropbox folders, one described as Gentoo C and C++ x86-64 binaries with per-optimization JSON metadata and one with the remaining C binaries, and notes that the dataset still contains duplicate functions.
Sources reviewed
Reviewed against the paper and its primary sources. Cite the original authors using the linked paper or BibTeX.
Primary sources
- https://www.usenix.org/conference/usenixsecurity24/presentation/zhu-chang
- https://www.usenix.org/system/files/usenixsecurity24-zhu-chang.pdf
- https://github.com/sefcom/TYGR/tree/280320129a7f8bbfb9ee61b9a2155d2ddeac44c6
- readme.md GitHub · sefcom/TYGR · Revision 2803201
- environment.yml GitHub · sefcom/TYGR · Revision 2803201
- model GitHub · sefcom/TYGR · Revision 2803201