Practical Type Inference: High-Throughput Recovery of Real-World Structures and Function Signatures

Abstract: The recovery of types from stripped binaries is a key to exact decompilation, yet its practical realization suffers. For composite structures in particular, both layout and semantic fidelity are required to enable end-to-end reconstruction. Many existing approaches either synthesize layouts or infer names post-hoc, which weakens downstream usability. This is further aggravated by an excessive runtime overhead that is especially prohibitive in automated environments. We present XTRIDE, an improved n-gram-based approach that focuses on practicality: highly optimized throughput and actionable confidence scores allow for deployment in automated pipelines. When compared to the state of the art in struct recovery, our method achieves comparable performance while being between 70 and 2300 times faster. As our inference is grounded in real-world types, we achieve the highest ratio of fully-correct struct layouts. With an optimized training regimen, our model outperforms the current state of the art on the DIRT dataset by 5.09 percentage points, achieving 90.15% type inference accuracy overall. Furthermore, we show that n-gram-based type prediction generalizes to function signature recovery: conducting a case study on embedded firmware, we show that this efficient approach to function similarity can assist in typical reverse engineering tasks.

• The paper presents XTRIDE, a groundbreaking n-gram-based system for high-throughput binary type recovery and function signature inference with 90.15% accuracy.
• It leverages optimized training, calibrated confidence estimation via isotonic regression, and a closed type vocabulary to quickly recover structures from stripped binaries.
• Experimental results demonstrate 70×–2300× speed improvements and robust semantic fidelity, enabling reliable and automated binary analysis at scale.

Practical Type Inference via XTRIDE: High-Throughput Recovery of Structures and Signatures

Problem Context and Motivation

Type inference from stripped binaries is fundamental to reverse engineering, security auditing, and decompilation. However, practical recovery of user-defined structures and function signatures remains challenging due to information loss during compilation, lack of semantic fidelity in recovered types, and severe performance constraints inherent in static or ML-driven approaches. The landscape of existing techniques is dichotomized between computationally expensive constraint/graph-based methods with limited throughput and ML/LLM-based solutions that, despite semantic gains, incur prohibitive runtime and often lack actionable confidence calibration.

A critical limitation in prior n-gram approaches (e.g., STRIDE) is their heuristic, non-calibrated scoring and restricted evaluation on real-world, non-primitive types. These factors, along with an inability to deliver actionable type names (as opposed to raw layouts), severely restrain applicability in automated pipelines or pipeline-scale environments.

Approach and System Overview

The paper introduces XTRIDE, an n-gram-driven binary type recovery system explicitly focused on throughput, semantic fidelity, and deployability. XTRIDE is designed for environments with recurrence of real-world types (e.g., large software stacks, firmware, libraries), leveraging high-performance token context matching, extensive groundtruth corpora, and a closed vocabulary of type signatures. The system extends the STRIDE foundation with three principal advancements:

1. Optimized Training and Database Design: Enlarged and more diverse n-gram context corpora, efficient memory and indexing, separation of bitness-dependent databases, and database reduction strategies achieving improved accuracy without exceeding the legacy memory footprint.
2. Calibrated, Actionable Confidence Estimation: A principled, isotonic regression-based calibration maps raw scores to well-behaved confidence estimates. This enables threshold-based abstention—allowing practitioners to trade coverage for precision—a key deployability requirement for automated binary analysis at scale.
3. Fast, Syntax-driven Function Signature Recovery: Aggregation of n-gram context matching is extended to function signature inference, with experimental evidence on firmware binaries establishing efficacy for rapid function triage.

Experimental Results

Accuracy and Throughput

On the comprehensive DIRT dataset, XTRIDE achieves 90.15% overall accuracy and 68.66% accuracy for out-of-training functions, outperforming the STRIDE baseline by 5.09 and 3.15 percentage points, respectively. Notably, inference is highly efficient: 0.04 ms per function in Rust, compared to STRIDE's 8.2 ms in Python and DIRTY's 200–8,500 ms (GPU/CPU), amounting to 70×–2300× speedup.

Struct Layout and Semantic Fidelity

For struct identification and layout recovery—key pain points in binary analysis—XTRIDE provides strong macro-level precision/recall metrics (macro F1: 0.768+), and when fine-tuned with partial in-domain groundtruth ($XTRIDE_{PLUS}$), achieves state-of-the-art full-match layout accuracy (0.943), surpassing both TypeForge and HyRES on benchmark coreutils, wget, grep, gzip, and lighttpd binaries. This is achieved with vastly reduced runtime (0.05–0.89s per binary versus 10–700s for baselines).

Confidence Calibration

The confidence score calibration is demonstrably effective: risk (error rate of non-abstained predictions) is driven below 2.4% with a coverage of ~48% at a threshold of 0.9, giving operators rigorous control over the precision–recall trade-off. No competing method provides an equivalent, calibrated abstention mechanism for reliable high-throughput integration.

Function Signature Recovery

Although function signature recovery is inherently constrained by vocabulary and context recurrence, XTRIDE achieves up to 61.27% precision on highly relevant targets (e.g., HAL functions in firmware), supporting fast triage for reverse engineering. The method is conservative (lower recall) but highly efficient and impactful in analyst-driven workflows.

Implications and Future Directions

Practical Deployment and Scalability

XTRIDE's design makes it suitable for deployment in automated pipelines, large-scale scanning, and CI/CD analysis targets where pervasive type recovery is needed. Its calibrated, throughput-oriented paradigm avoids downstream error amplification common with overconfident, non-thresholded systems. Memory and runtime benchmarks show feasibility on standard workstation hardware even for very large codebases.

Theoretical Considerations

By operating from a closed, real-world type vocabulary and leveraging larger, more diverse token contexts, XTRIDE demonstrates that semantic fidelity and layout reconstruction are not in opposition to speed. It provides strong evidence that n-gram approaches, when properly calibrated and trained, yield accuracy competitive with much heavier ML and hybrid systems, while also providing fully qualified and actionable type identities.

The primary limitation is the inherent closed-world assumption: the approach does not generalize to unseen or bespoke structs outside the training/induction corpus. However, for supply-chain, library-rich, or vendor-stable environments, this is often an acceptable or indeed optimal tradeoff. Hybrid deployment—falling back to heavier constraint/ML-based inference for unknown regions—is a natural strategic extension.

Prospects for AI in Binary Analysis

The successful extension of lightweight n-gram models to high-precision type and function inference in decompilation tasks demonstrates that not all advances in binary analysis need to come from parameter-heavy deep learning or LLM-based techniques. Instead, strategic use of lightweight, interpretable models with calibrated abstention, grounded in large-scale real-world corpora, can deliver actionable performance surges and new practical capabilities.

Integration with existing decompilers and program analysis pipelines is facilitated by the emission of semantically-rich, stable type identifiers—all with rigorous, quantifiably controlled reliability.

Conclusion

XTRIDE marks a significant step towards deployable, scalable, high-fidelity type inference in large binary analysis environments. The system robustly bridges efficiency and semantic recovery, substantiating n-gram-based closed-vocabulary inference as a practical solution where open-world generalization is not paramount. Its unification of structure and function recovery within one lightweight framework, in conjunction with actionable confidence, distinguishes it among type recovery approaches and points toward further advances in high-throughput program analysis and AI-assisted reverse engineering.