2024 · Conference paper
TYGR: Type Inference on Stripped Binaries using Graph Neural Networks
TYGR infers the types of stack and heap variables in stripped binaries by running an architecture-agnostic, intra-procedural data-flow analysis on angr's VEX IR and classifying each variable's data-flow graph with a graph neural network. It predicts base types, pointers and struct member layouts, covering 97.1% of the types observed in its data. The authors also build TyDa, 163,643 binaries compiled with debug information from Gentoo and Debian C packages for x86, x64, AArch64, Arm32 and MIPS at O0–O3, and deduplicate functions in the evaluated subset before splitting it. On x64 across O0–O3 they report 76.6% overall and 45.2% struct accuracy, and say TYGR beats prior work by at least 26.1% overall and 10.2% on structs.
Scope and limitations
Ground truth comes from DWARF information in binaries compiled by the authors, and training and testing use TyDa-min, about 8% of TyDa's binaries, so the results do not cover wild, obfuscated or C++ code. The analysis is intra-procedural and covers stack and heap variables only, not globals; unresolved indirect jumps can leave code unexplored, and adjacent stack structs are predicted as one struct, though the authors find this rare in TyDa. Accuracy plateaus near 80% as training data grows, which the authors attribute to rare types and types that usage alone cannot distinguish. Comparisons follow each baseline's original setting: DIRTY and OSPREY on x64 only, and OSPREY through results its authors supplied for Coreutils x64-O0. Accuracy is not compared directly with Ghidra or IDA Pro. Predictions choose from a fixed set of base, pointer and struct-member types; they do not recover type names or full struct declarations.
Why it fits this collection
Adds graph-neural-network type inference over data-flow graphs and a multi-architecture type-recovery dataset, complementing decompiler-output, LLM-based and synthesis-based type recovery research.
Publication and review details
- Venue
- USENIX Security 2024
- Status
- Conference paper
- Publication / posting date
- August 2024
- Date source
- Publication month in the official USENIX proceedings BibTeX; the August 14–16, 2024 symposium dates are not used to assert a publication day.
The USENIX page, its BibTeX entry and the final PDF agree on the 14-author order, pages 4283–4300 and ISBN 978-1-939133-44-1. USENIX assigns no paper DOI and no arXiv version was found, so the record relies on the reviewed USENIX Security 2024 URL/PDF identity. The paper releases its artifacts at github.com/sefcom/TYGR. At the reviewed 2024-08-22 commit the repository has no license file; it ships trained MODEL_base and MODEL_struct models, and its environment pins Python 3.8, PyTorch 1.8.1 with CUDA 10.2 and angr 9.0.7491. TyDa is not in the repository: the README links two Dropbox folders, one described as Gentoo C and C++ x86-64 binaries with per-optimization JSON metadata and one with the remaining C binaries, and notes that the dataset still contains duplicate functions. The Dropbox data was not downloaded, and no code or experiments were run.
Sources reviewed
Source review only; experiments were not rerun for this collection. Cite the original authors using the linked paper or BibTeX.
Primary sources
- https://www.usenix.org/conference/usenixsecurity24/presentation/zhu-chang
- https://www.usenix.org/system/files/usenixsecurity24-zhu-chang.pdf
- https://github.com/sefcom/TYGR/tree/280320129a7f8bbfb9ee61b9a2155d2ddeac44c6
- readme.md GitHub · sefcom/TYGR · Revision 2803201
- environment.yml GitHub · sefcom/TYGR · Revision 2803201
- model GitHub · sefcom/TYGR · Revision 2803201