AwesomeREA.org

2025 · Conference paper

TypeForge: Synthesizing and Selecting Best-Fit Composite Data Types for Stripped Binaries

Yanzhong Wang; Ruigang Liang; Yilin Li; Peiwei Hu; Kai Chen; Bolun Zhang

TypeForge recovers composite data types, including struct layouts, unions and pointer or nesting relationships, from stripped binaries. A whole-program Type Flow Graph over Ghidra’s decompiler-inferred variables propagates member offsets and sizes, cuts conflicting edges caused by casts and unions, and synthesizes candidate type declarations. An LLM only selects among these statically synthesized candidates: each is applied through the decompiler’s retype interface, and a double-elimination tournament compares the resulting pseudocode for readability. On OSPREY’s coreutils dataset the authors report F1 of 81.7% for composite-type identification, 88.2% for layout recovery and 72.1% for relationship recovery.

Scope and limitations

Recovers member offsets, sizes and relationships, not original type or member names; relationship correctness is judged by matching layouts because names are unavailable. The main evaluation uses OSPREY’s dataset of GNU coreutils and larger Howard-dataset programs, over 10,000 functions and 11,000 composite-typed variables at O0–O3, with ground truth from debug information; the paper does not report results per architecture. In the baseline comparison, OSPREY results were supplied by its authors and its runtime is an estimate, and ReSym figures are its published results, so not every baseline was rerun. Conservative removal of conflicting edges can drop valid members, and compiler optimizations that merge or flatten members lower accuracy at higher levels. About 75% of runtime is the LLM selection stage; the default model was GPT-4o mini, with each comparison run three times. Downstream readability and vulnerability examples are case studies, not proof of semantic equivalence.

Why it fits this collection

Adds static composite-type and struct-layout recovery that feeds decompiler readability, complementing learned variable naming, data-structure symbol recovery and LLM refinement of decompiler output.

Publication and review details

Venue
IEEE S&P 2025
Status
Conference paper
Publication / posting date
2025 (exact date not verified)
Date source
IEEE Xplore and the publisher’s Crossref deposit establish publication year 2025. Both list 12 May 2025, the first day of the May 12–15 symposium, and IEEE added the article to Xplore on 16 June 2025; neither date is treated as a verified publication day.
DOI
10.1109/SP61157.2025.00193

IEEE Xplore and Crossref agree on the title, six-author order and DOI; an arXiv title search found no preprint. Both list article-relative pages 1–18, whereas the repository’s BibTeX gives 2847–2864; neither range is recorded in the citation. The author-hosted PDF is the final paper, including the S&P meta-review appendix. The reviewed 2026-03-17 snapshot, identical to its dev branch at review time, is a Ghidra extension tested with Ghidra 11.0.3; its Python 3.13 selection scripts pin LangChain 0.3.23 and openai 1.75.0, and their README example names gpt-4.1-mini rather than the paper’s GPT-4o mini. Ground-truth extraction needs DWARF 4 debug information. LICENSE contains BSD 3-Clause-style terms with an added requirement to cite the paper in academic work; the README badge says BSD 3-Clause and GitHub reports NOASSERTION, so no single license is asserted here. Evaluation.md links early-version data captured before LLM selection, notes a June 2025 identification bug fix after submission, and withholds the variable-alignment evaluation script, so the paper’s metrics cannot be recomputed from the release alone. No code, model calls or downloads were run.

Sources reviewed

Source review only; experiments were not rerun for this collection. Cite the original authors using the linked paper or BibTeX.

Primary sources

  1. https://ieeexplore.ieee.org/document/11023499
  2. https://api.crossref.org/works/10.1109/SP61157.2025.00193
  3. https://noobone123.github.io/papers/typeforge-sp25.pdf
  4. README.md GitHub · noobone123/TypeForge · Revision 0f2ceff
  5. LICENSE GitHub · noobone123/TypeForge · Revision 0f2ceff
  6. Evaluation.md GitHub · noobone123/TypeForge · Revision 0f2ceff
  7. scripts/README.md GitHub · noobone123/TypeForge · Revision 0f2ceff
  8. scripts/requirements.txt GitHub · noobone123/TypeForge · Revision 0f2ceff
  9. scripts/judge/README.md GitHub · noobone123/TypeForge · Revision 0f2ceff
  10. scripts/judge/llm.py GitHub · noobone123/TypeForge · Revision 0f2ceff