Type recovery in stripped binaries: a comprehensive survey of inference tools and methods
TL;DR
A survey of 50 binary type inference tools highlights recent progress, especially in learning-based methods, but also reveals ongoing limitations, which include limited scalability, lack of standardized output formats, and poor support for dynamically typed languages.
Abstract
Understanding binary programs is challenging due to the loss of high-level abstractions during compilation. Type inference plays a key role in recovering information such as variable types, data structures, and class hierarchies, which is crucial for reverse engineering (RE), decompilation, and security analysis. This paper presents a survey of 50 binary type inference tools. We categorize the tools based on the types they recover and the methods they use, including dynamic analysis, static reasoning, symbolic execution, and machine learning. We also compare their input formats, supported languages, and evaluation strategies. In addition, the survey discusses the scope and origins of the area, its evolution over the past two decades, and the challenges that lie ahead. Our study highlights recent progress, especially in learning-based methods, but also reveals ongoing limitations. These include limited scalability, lack of standardized output formats, and poor support for dynamically typed languages. We also observe a lack of user-friendly interfaces and limited availability of source code for many tools, which hinders adoption and further development. We conclude by outlining open research problems and recommending future directions to make type inference tools more accurate, accessible, and widely applicable.