{ "added_at": "2026-10-27", "arxiv_id": null, "arxiv_version_reviewed": null, "authors": [ "Chang Zhu", "Ziyang Li", "Anton Xue", "Ati Priya Bajaj", "Wil Gibbs", "Yibo Liu", "Rajeev Alur", "Tiffany Bao", "Hanjun Dai", "Adam Doupé", "Mayur Naik", "Yan Shoshitaishvili", "Ruoyu Wang", "Aravind Machiry" ], "bibtex_url": "https://awesomerea.org/papers/citations/paper-tygr.bib", "code_url": "https://github.com/sefcom/TYGR", "date_basis": "Publication month in the official USENIX proceedings BibTeX; the August 14–16, 2024 symposium dates are not used to assert a publication day.", "date_basis_zh": "采用 USENIX 官方论文集 BibTeX 中的出版月份；不以 2024 年 8 月 14–16 日的会议日期推定具体出版日。", "date_precision": "month", "description_en": "TYGR infers the types of stack and heap variables in stripped binaries by running an architecture-agnostic, intra-procedural data-flow analysis on angr's VEX IR and classifying each variable's data-flow graph with a graph neural network. It predicts base types, pointers and struct member layouts, covering 97.1% of the types observed in its data. The authors also build TyDa, 163,643 binaries compiled with debug information from Gentoo and Debian C packages for x86, x64, AArch64, Arm32 and MIPS at O0–O3, and deduplicate functions in the evaluated subset before splitting it. On x64 across O0–O3 they report 76.6% overall and 45.2% struct accuracy, and say TYGR beats prior work by at least 26.1% overall and 10.2% on structs.", "description_zh": "TYGR 在 angr 的 VEX 中间表示上执行与架构无关的过程内数据流分析，并用图神经网络对每个变量的数据流图进行分类，从而推断剥离符号二进制中栈变量与堆变量的类型。它可预测基本类型、指针及结构体成员布局，覆盖其数据中观察到的 97.1% 的类型。作者还构建了 TyDa：由 Gentoo 与 Debian 的 C 软件包以 O0–O3 编译、保留调试信息的 163,643 个二进制，涵盖 x86、x64、AArch64、Arm32 与 MIPS，并在划分评测子集前对其中函数去重。作者报告在 x64 的 O0–O3 上整体准确率为 76.6%、结构体准确率为 45.2%，并称整体准确率与结构体准确率分别至少超出已有工作 26.1% 和 10.2%。", "doi": null, "entry_url": "https://awesomerea.org/papers/paper-tygr/", "entry_url_zh": "https://awesomerea.org/zh/papers/paper-tygr/", "evidence_urls": [ "https://www.usenix.org/conference/usenixsecurity24/presentation/zhu-chang", "https://www.usenix.org/system/files/usenixsecurity24-zhu-chang.pdf", "https://github.com/sefcom/TYGR/tree/280320129a7f8bbfb9ee61b9a2155d2ddeac44c6", "https://github.com/sefcom/TYGR/blob/280320129a7f8bbfb9ee61b9a2155d2ddeac44c6/readme.md", "https://github.com/sefcom/TYGR/blob/280320129a7f8bbfb9ee61b9a2155d2ddeac44c6/environment.yml", "https://github.com/sefcom/TYGR/tree/280320129a7f8bbfb9ee61b9a2155d2ddeac44c6/model" ], "first_arxiv_date": null, "id": "paper-tygr", "json_url": "https://awesomerea.org/papers/paper-tygr/record.json", "kind": "research", "markdown_url": "https://awesomerea.org/papers/paper-tygr/index.md", "markdown_url_zh": "https://awesomerea.org/zh/papers/paper-tygr/index.md", "metadata_notes": "The USENIX page, its BibTeX entry and the final PDF agree on the 14-author order, pages 4283–4300 and ISBN 978-1-939133-44-1. USENIX assigns no paper DOI and no arXiv version was found. The paper releases its artifacts at github.com/sefcom/TYGR. At the reviewed 2024-08-22 commit the repository has no license file; it ships trained MODEL_base and MODEL_struct models, and its environment pins Python 3.8, PyTorch 1.8.1 with CUDA 10.2 and angr 9.0.7491. TyDa is not in the repository: the README links two Dropbox folders, one described as Gentoo C and C++ x86-64 binaries with per-optimization JSON metadata and one with the remaining C binaries, and notes that the dataset still contains duplicate functions.", "metadata_notes_zh": "USENIX 页面、其 BibTeX 条目与最终 PDF 的 14 位作者顺序、页码 4283–4300 及 ISBN 978-1-939133-44-1 一致。USENIX 不为论文分配 DOI，也未找到 arXiv 版本。论文在 github.com/sefcom/TYGR 发布研究产物。在所审阅的 2024-08-22 提交中，该仓库没有许可证文件；仓库附带训练好的 MODEL_base 与 MODEL_struct 模型，环境文件固定 Python 3.8、PyTorch 1.8.1（CUDA 10.2）与 angr 9.0.7491。TyDa 不在仓库内：README 链接了两个 Dropbox 文件夹，其一被描述为附有各优化级别 JSON 元数据的 Gentoo C 与 C++ x86-64 二进制，另一个包含其余 C 二进制，并说明数据集中仍有重复函数。", "pdf_url": "https://www.usenix.org/system/files/usenixsecurity24-zhu-chang.pdf", "project_url": null, "publication_date": "2024-08", "publication_status": "conference-paper", "record_type": "paper", "runtime_tested": false, "scope_limitations_en": "Ground truth comes from DWARF information in binaries compiled by the authors, and training and testing use TyDa-min, about 8% of TyDa's binaries, so the results do not cover wild, obfuscated or C++ code. The analysis is intra-procedural and covers stack and heap variables only, not globals; unresolved indirect jumps can leave code unexplored, and adjacent stack structs are predicted as one struct, though the authors find this rare in TyDa. Accuracy plateaus near 80% as training data grows, which the authors attribute to rare types and types that usage alone cannot distinguish. Comparisons follow each baseline's original setting: DIRTY and OSPREY on x64 only, and OSPREY through results its authors supplied for Coreutils x64-O0. Accuracy is not compared directly with Ghidra or IDA Pro. Predictions choose from a fixed set of base, pointer and struct-member types; they do not recover type names or full struct declarations.", "scope_limitations_zh": "真实标签来自作者自行编译的二进制中的 DWARF 信息，训练与测试使用 TyDa-min，即约 8% 的 TyDa 二进制，因此结果不涵盖野外样本、混淆代码或 C++ 代码。分析是过程内的，仅覆盖栈变量与堆变量，不包括全局变量；未解析的间接跳转可能使部分代码未被分析，相邻的栈上结构体会被预测为一个结构体，但作者发现这种情况在 TyDa 中很少见。随着训练数据增加，准确率在 80% 左右趋于平稳，作者将其归因于罕见类型以及仅凭使用方式无法区分的类型。比较按各基线的原始设定进行：DIRTY 与 OSPREY 仅在 x64 上比较，OSPREY 则使用其作者提供的 Coreutils x64-O0 结果。准确率未直接与 Ghidra 或 IDA Pro 比较。预测结果取自固定的基本类型、指针类型与结构体成员类型集合，并不恢复类型名称或完整的结构体声明。", "targets": [ "binary" ], "title": "TYGR: Type Inference on Stripped Binaries using Graph Neural Networks", "title_zh": "TYGR：基于图神经网络的剥离符号二进制类型推断", "url": "https://www.usenix.org/conference/usenixsecurity24/presentation/zhu-chang", "venue": "USENIX Security 2024", "verification": "source-reviewed", "verified_at": "2026-10-19", "why_fits_en": "Adds graph-neural-network type inference over data-flow graphs and a multi-architecture type-recovery dataset, complementing decompiler-output, LLM-based and synthesis-based type recovery research.", "why_fits_zh": "补充基于数据流图和图神经网络的类型推断方法及多架构类型恢复数据集，与基于反编译输出、大语言模型及程序合成的类型恢复研究互补。", "year": 2024 }