Type Inference in Stripped Binaries via NLP-Guided Binary Analysis

Abstract

Binary program analysis poses fundamental challenges due to the loss of high-level abstractions during the compilation process. In contrast to source code, binary executables lack explicit representations of variables, types, control structures, and other abstractions essential for program comprehension. The primary objective of this dissertation is to advance the state of type inference in binaries, a core problem in binary reverse engineering.

Accurately reconstructing data type information enables more reliable recovery of source-level representations. At the heart of our approach is the use of Natural Language Processing (NLP) models for type inference. We formulate type prediction as a sequence classification task over instruction-level representations. However, standard NLP architectures and tokenization strategies are not well-suited to the properties of assembly code. We therefore develop and evaluate specialized tokenization methods for assembly, designed to preserve semantic granularity and structural regularity in the input sequences. These methods yield measurable improvements in downstream model performance on type prediction tasks.

A further question concerns which class of models is best suited to type inference itself. Type inference can be performed using a smaller transformer trained specifically for the task or a large, general-purpose large language model (LLM) applied without task-specific supervision. To resolve this trade-off, we conduct a systematic evaluation that compares both paradigms across a spectrum of binary analysis tasks centered on type inference. This study clarifies when model scale can substitute for task-specific supervision and provides concrete guidance for selecting the appropriate modeling approach.

As the primary direction for future work, we outline an NLP-driven approach to reconstructing high-level type abstractions from C++ binaries. C++ binaries are especially difficult to analyze because features such as classes, templates, and multiple inheritance leave only fragmentary traces in raw binary form. We aim to map low-level assembly instructions to high-level abstractions, including Standard Template Library types (e.g., map, list) and their corresponding class and structure definitions. Recovering these object-oriented abstractions would improve decompilation, vulnerability detection, and the analysis of complex C++ programs.

Together, these components—specialized tokenization, transformer-based type inference, and a systematic evaluation of model paradigms—constitute a unified NLP-driven framework for binary program analysis, with improved disassembly reliability identified as a direction for future work.