2024 · Conference paper
“Len or index or count, anything but v1”: Predicting Variable Names in Decompilation Output with Transfer Learning
VarBERT suggests variable names for IDA Hex-Rays and Ghidra decompiler output with a BERT-style model pre-trained on 5.2M human-written C functions from Debian and fine-tuned on decompiled code; it also predicts whether each variable came from the developer or was introduced by the decompiler. The authors build VarCorpus from Gentoo C and C++ packages compiled for x86-64 at O0–O3, labeling decompiled variables from debug symbols. On per-function splits of O2 binaries, top-1 accuracy is 54.43% for IDA and 54.49% for Ghidra; on an IDA-O0 subset it reaches 50.70%, against 35.94% for DIRE and 38.00% for DIRTY.
Scope and limitations
Predicted names are learned suggestions scored against developer names, not recovered originals. Top-1 accuracy drops to 42.40% (IDA) and 40.49% (Ghidra) on per-binary O2 splits, and the per-binary IDA-O0 lead over DIRTY is 4.52 points. The DIRE and DIRTY comparison covers IDA at O0 only, on about 400K functions (roughly 15% of VarCorpus), because DIRE's training time was prohibitive. The method can name only variables the decompiler recovers, and labeling relies on IDA and Ghidra preserving variables when matching debug symbols. Corpora come from Linux distribution packages, mainly x86-64 with a smaller AArch64 O2 experiment, and may not represent Windows or macOS executables; deduplication removes exact duplicates only. The user study had 27 students who completed 13 function pairs. Types, structures and recompilable code are outside its scope.
Why it fits this collection
Adds transfer-learning variable-name prediction across two decompilers and four optimization levels, with a dataset that addresses train–test overlap in earlier naming benchmarks.
Publication and review details
- Venue
- IEEE S&P 2024
- Status
- Conference paper
- Publication / posting date
- 2024 (exact date not verified)
- Date source
- IEEE’s Crossref deposit and the proceedings title establish publication year 2024. Its published-print date, 2024-05-19, is the first day of the May 19–23 symposium, and the IEEE Xplore record could not be retrieved to confirm a separate publication date, so no day is asserted.
- DOI
- 10.1109/SP54263.2024.00152
Crossref gives the 13 authors in this order and pages 4069–4087 of the 2024 IEEE Symposium on Security and Privacy; the DOI resolves to IEEE Xplore document 10646727, whose page could not be retrieved during review. The title follows the paper's curly quotation marks; Crossref stores straight quotes. The 19-page author-hosted PDF, linked from the repository, lacks IEEE pagination and includes the program committee's meta-review. No arXiv version was found. The paper used IDA Pro 7.6, Ghidra 10.4, PyTorch 1.9.0, Transformers 4.10.0 and FairSeq 0.10.0. The reviewed 2025-12-17 repository commit has no license file, so no open license is asserted; its README lists Python 3.8+, Java 11 for Joern and Java 17+ for Ghidra 10.4, requirements.txt leaves torch and transformers unpinned, the Dockerfile (Ubuntu 22.04, Python 3.11) fetches a modified Joern from Dropbox, and the README serves the HSC and VarCorpus data, Gentoo binaries and 16 fine-tuned models from Dropbox. Inference is offered through the separate binsync/varbert_api library and the DAILA plugin. No data or models were downloaded and no code or experiments were run.
Sources reviewed
Source review only; experiments were not rerun for this collection. Cite the original authors using the linked paper or BibTeX.
Primary sources
- https://ieeexplore.ieee.org/document/10646727
- https://api.crossref.org/works/10.1109/SP54263.2024.00152
- https://www.atipriya.com/files/papers/varbert_oakland24.pdf
- README.md GitHub · sefcom/VarBERT · Revision 76f221a
- requirements.txt GitHub · sefcom/VarBERT · Revision 76f221a
- Dockerfile GitHub · sefcom/VarBERT · Revision 76f221a