TRex: Practical Type Reconstruction for Binary Code
summary
TRex is a deductive constraint-based tool that reconstructs behavior-capturing types using structural types and a final type rounding step, producing pointers, structs, unions, arrays and recursive types. It is deterministic, ships code on GitHub, and outperforms Ghidra on 123 of 125 binaries; a recent ML predictor (resim) is correct 2% of the time, yields valid-but-wrong types 36%, and produces unrecoverable outputs 62%. The paper proves ground-truth recovery impossible and shows type rounding is NP-hard.
AI-written summary · about
related talks
21mDemystify Today's Binary Disassembling and How Modern ABI Makes it Easier
18mScalable Bug Detection for Internally Unsafe Libraries: A Logical Approach to Type(…)
48mDPTrace: Dual Purpose Trace for Exploitability Analysis of Program Crashes
51mReverse Engineering Binaries
24mBTD: Unleashing the Power of Decompilation for x86 Deep Neural Network Executables
32mCodeQL: Also a Powerful Binary Analysis Engine
19mRex: Closing the language-verifier gap with safe and usable kernel extensions
30mEnhancing CTI Processes with Code Search Technology