# TypeForge: Synthesizing and Selecting Best-Fit Composite Data Types for Stripped Binaries > TypeForge recovers composite data types, including struct layouts, unions and pointer or nesting relationships, from stripped binaries. A whole-program Type Flow Graph over Ghidra’s decompiler-inferred variables propagates member offsets and sizes, cuts conflicting edges caused by casts and unions, and synthesizes candidate type declarations. An LLM only selects among these statically synthesized candidates: each is applied through the decompiler’s retype interface, and a double-elimination tournament compares the resulting pseudocode for readability. On OSPREY’s coreutils dataset the authors report F1 of 81.7% for composite-type identification, 88.2% for layout recovery and 72.1% for relationship recovery. - Authors: Yanzhong Wang; Ruigang Liang; Yilin Li; Peiwei Hu; Kai Chen; Bolun Zhang - Venue: IEEE S&P 2025 - Status: Conference paper - Publication / posting date: 2025 (exact date not verified) - Date source: IEEE Xplore and the publisher’s Crossref deposit establish publication year 2025. Both list 12 May 2025, the first day of the May 12–15 symposium, and IEEE added the article to Xplore on 16 June 2025; neither date is treated as a verified publication day. - DOI: 10.1109/SP61157.2025.00193 - Sources reviewed: 2026-10-18 - Added to the catalog: 2026-10-18 - Original paper: - PDF: - Code: - BibTeX: - Catalog page: - Record JSON: - Chinese version: [简体中文](https://awesomerea.org/zh/papers/paper-typeforge/index.md) ## Scope and limitations Recovers member offsets, sizes and relationships, not original type or member names; relationship correctness is judged by matching layouts because names are unavailable. The main evaluation uses OSPREY’s dataset of GNU coreutils and larger Howard-dataset programs, over 10,000 functions and 11,000 composite-typed variables at O0–O3, with ground truth from debug information; the paper does not report results per architecture. In the baseline comparison, OSPREY results were supplied by its authors and its runtime is an estimate, and ReSym figures are its published results, so not every baseline was rerun. Conservative removal of conflicting edges can drop valid members, and compiler optimizations that merge or flatten members lower accuracy at higher levels. About 75% of runtime is the LLM selection stage; the default model was GPT-4o mini, with each comparison run three times. Downstream readability and vulnerability examples are case studies, not proof of semantic equivalence. ## Why it fits this collection Adds static composite-type and struct-layout recovery that feeds decompiler readability, complementing learned variable naming, data-structure symbol recovery and LLM refinement of decompiler output. ## Publication and review notes IEEE Xplore and Crossref agree on the title, six-author order and DOI; an arXiv title search found no preprint. Both list article-relative pages 1–18, whereas the repository’s BibTeX gives 2847–2864. The author-hosted PDF is the final paper, including the S&P meta-review appendix. The 2026-03-17 snapshot is a Ghidra extension tested with Ghidra 11.0.3; its Python 3.13 selection scripts pin LangChain 0.3.23 and openai 1.75.0, and their README example names gpt-4.1-mini rather than the paper’s GPT-4o mini. Ground-truth extraction needs DWARF 4 debug information. LICENSE contains BSD 3-Clause-style terms with an added requirement to cite the paper in academic work; the README badge says BSD 3-Clause and GitHub reports NOASSERTION. Evaluation.md links early-version data captured before LLM selection, notes a June 2025 identification bug fix after submission, and withholds the variable-alignment evaluation script, so the paper’s metrics cannot be recomputed from the release alone. ## Primary sources 1. 2. 3. 4. 5. 6. 7. 8. 9. 10. ## About this entry Reviewed against the paper and its primary sources. Cite the original authors using the linked paper or BibTeX. Original editorial content: MIT. Linked projects, papers and assets retain their own rights and licenses.