# TYGR: Type Inference on Stripped Binaries using Graph Neural Networks > TYGR infers the types of stack and heap variables in stripped binaries by running an architecture-agnostic, intra-procedural data-flow analysis on angr's VEX IR and classifying each variable's data-flow graph with a graph neural network. It predicts base types, pointers and struct member layouts, covering 97.1% of the types observed in its data. The authors also build TyDa, 163,643 binaries compiled with debug information from Gentoo and Debian C packages for x86, x64, AArch64, Arm32 and MIPS at O0–O3, and deduplicate functions in the evaluated subset before splitting it. On x64 across O0–O3 they report 76.6% overall and 45.2% struct accuracy, and say TYGR beats prior work by at least 26.1% overall and 10.2% on structs. - Authors: Chang Zhu; Ziyang Li; Anton Xue; Ati Priya Bajaj; Wil Gibbs; Yibo Liu; Rajeev Alur; Tiffany Bao; Hanjun Dai; Adam Doupé; Mayur Naik; Yan Shoshitaishvili; Ruoyu Wang; Aravind Machiry - Venue: USENIX Security 2024 - Status: Conference paper - Publication / posting date: August 2024 - Date source: Publication month in the official USENIX proceedings BibTeX; the August 14–16, 2024 symposium dates are not used to assert a publication day. - Sources reviewed: 2026-10-19 - Added to the catalog: 2026-10-27 - Original paper: - PDF: - Code: - BibTeX: - Catalog page: - Record JSON: - Chinese version: [简体中文](https://awesomerea.org/zh/papers/paper-tygr/index.md) ## Scope and limitations Ground truth comes from DWARF information in binaries compiled by the authors, and training and testing use TyDa-min, about 8% of TyDa's binaries, so the results do not cover wild, obfuscated or C++ code. The analysis is intra-procedural and covers stack and heap variables only, not globals; unresolved indirect jumps can leave code unexplored, and adjacent stack structs are predicted as one struct, though the authors find this rare in TyDa. Accuracy plateaus near 80% as training data grows, which the authors attribute to rare types and types that usage alone cannot distinguish. Comparisons follow each baseline's original setting: DIRTY and OSPREY on x64 only, and OSPREY through results its authors supplied for Coreutils x64-O0. Accuracy is not compared directly with Ghidra or IDA Pro. Predictions choose from a fixed set of base, pointer and struct-member types; they do not recover type names or full struct declarations. ## Why it fits this collection Adds graph-neural-network type inference over data-flow graphs and a multi-architecture type-recovery dataset, complementing decompiler-output, LLM-based and synthesis-based type recovery research. ## Publication and review notes The USENIX page, its BibTeX entry and the final PDF agree on the 14-author order, pages 4283–4300 and ISBN 978-1-939133-44-1. USENIX assigns no paper DOI and no arXiv version was found. The paper releases its artifacts at github.com/sefcom/TYGR. At the reviewed 2024-08-22 commit the repository has no license file; it ships trained MODEL_base and MODEL_struct models, and its environment pins Python 3.8, PyTorch 1.8.1 with CUDA 10.2 and angr 9.0.7491. TyDa is not in the repository: the README links two Dropbox folders, one described as Gentoo C and C++ x86-64 binaries with per-optimization JSON metadata and one with the remaining C binaries, and notes that the dataset still contains duplicate functions. ## Primary sources 1. 2. 3. 4. 5. 6. ## About this entry Reviewed against the paper and its primary sources. Cite the original authors using the linked paper or BibTeX. Original editorial content: MIT. Linked projects, papers and assets retain their own rights and licenses.