{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2024,9,11]],"date-time":"2024-09-11T13:24:09Z","timestamp":1726061049826},"reference-count":117,"publisher":"Association for Computing Machinery (ACM)","issue":"4","license":[{"start":{"date-parts":[[2017,5,2]],"date-time":"2017-05-02T00:00:00Z","timestamp":1493683200000},"content-version":"vor","delay-in-days":365,"URL":"http:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"funder":[{"name":"NSF","award":["1453011"]},{"name":"Regional Government of Madrid","award":["S2013\/ICE-2731"]},{"DOI":"10.13039\/100000181","name":"AFOSR","doi-asserted-by":"crossref","award":["FA9550-14-1- 0119"],"id":[{"id":"10.13039\/100000181","id-type":"DOI","asserted-by":"crossref"}]},{"name":"Spanish Government","award":["TIN2012-39391-C04-01"]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":["ACM Comput. Surv."],"published-print":{"date-parts":[[2016,5,2]]},"abstract":"In many applications, source code and debugging symbols of a target program are not available, and the only thing that we can access is the program executable. A fundamental challenge with executables is that, during compilation, critical information such as variables and types is lost. Given that typed variables provide fundamental semantics of a program, for the last 16 years, a large amount of research has been carried out on binary code type inference, a challenging task that aims to infer typed variables from executables (also referred to as binary code). In this article, we systematize the area of binary code type inference according to its most important dimensions: the applications that motivate its importance, the approaches used, the types that those approaches infer, the implementation of those approaches, and how the inference results are evaluated. We also discuss limitations, underdeveloped problems and open challenges, and propose further applications.<\/jats:p>","DOI":"10.1145\/2896499","type":"journal-article","created":{"date-parts":[[2016,5,2]],"date-time":"2016-05-02T12:16:07Z","timestamp":1462191367000},"page":"1-35","update-policy":"http:\/\/dx.doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":39,"title":["Type Inference on Executables"],"prefix":"10.1145","volume":"48","author":[{"given":"Juan","family":"Caballero","sequence":"first","affiliation":[{"name":"IMDEA Software Institute, Madrid, Spain"}]},{"given":"Zhiqiang","family":"Lin","sequence":"additional","affiliation":[{"name":"University of Texas at Dallas, TX, USA"}]}],"member":"320","published-online":{"date-parts":[[2016,5,2]]},"reference":[{"key":"e_1_2_1_1_1","doi-asserted-by":"publisher","DOI":"10.1145\/1609956.1609960"},{"key":"e_1_2_1_2_1","volume-title":"Understanding and Defeating Windows 8.1 Kernel Patch Protection. Retrieved","author":"Allievi Andrea","year":"2016"},{"key":"e_1_2_1_3_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-540-31985-6_19"},{"key":"e_1_2_1_4_1","doi-asserted-by":"crossref","unstructured":"Gogul Balakrishnan and Thomas Reps. 2004. Analyzing memory accesses in X86 executables. In Compiler Construction. Gogul Balakrishnan and Thomas Reps. 2004. Analyzing memory accesses in X86 executables. In Compiler Construction.","DOI":"10.1007\/978-3-540-24723-4_2"},{"key":"e_1_2_1_5_1","volume-title":"International Conference on Verification, Model Checking, and Abstract Interpretation.","author":"Balakrishnan G."},{"key":"e_1_2_1_6_1","volume-title":"USENIX Security Symposium.","author":"Bao Tiffany","year":"2014"},{"key":"e_1_2_1_7_1","volume-title":"Binary Analysis Platform. Retrieved","author":"BAP","year":"2016"},{"key":"e_1_2_1_8_1","doi-asserted-by":"publisher","DOI":"10.5555\/1247360.1247401"},{"key":"e_1_2_1_9_1","doi-asserted-by":"publisher","DOI":"10.5555\/1770351.1770381"},{"key":"e_1_2_1_10_1","doi-asserted-by":"publisher","DOI":"10.1145\/1134760.1220164"},{"key":"e_1_2_1_11_1","volume-title":"Bitblaze: Binary Analysis For Computer Security. Retrieved","author":"Bitblaze","year":"2016"},{"key":"e_1_2_1_12_1","volume-title":"Boomerang decompiler. Retrieved","author":"Boomerang","year":"2016"},{"key":"e_1_2_1_13_1","doi-asserted-by":"publisher","DOI":"10.1145\/186025.186093"},{"key":"e_1_2_1_14_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2011.28"},{"key":"e_1_2_1_15_1","volume-title":"ARTISTE: Automatic Generation of Hybrid Data Structure Signatures from Binary Code Executions. Technical Report TR-IMDEA-SW-2012-001","author":"Caballero Juan","year":"2012"},{"key":"e_1_2_1_16_1","doi-asserted-by":"publisher","DOI":"10.1145\/2338965.2336769"},{"key":"e_1_2_1_17_1","volume-title":"USENIX Security Symposium.","author":"Caballero Juan","year":"2011"},{"key":"e_1_2_1_18_1","volume-title":"Network and Distributed System Security Symposium.","author":"Caballero Juan","year":"2010"},{"key":"e_1_2_1_19_1","doi-asserted-by":"publisher","DOI":"10.1145\/1653662.1653737"},{"key":"e_1_2_1_20_1","doi-asserted-by":"publisher","DOI":"10.1145\/1315245.1315286"},{"key":"e_1_2_1_21_1","doi-asserted-by":"publisher","DOI":"10.1145\/1653662.1653729"},{"key":"e_1_2_1_22_1","doi-asserted-by":"publisher","DOI":"10.1145\/93542.93585"},{"key":"e_1_2_1_23_1","doi-asserted-by":"publisher","DOI":"10.1109\/WCRE.2013.6671277"},{"key":"e_1_2_1_24_1","doi-asserted-by":"publisher","DOI":"10.1145\/1108792.1108814"},{"key":"e_1_2_1_26_1","doi-asserted-by":"publisher","DOI":"10.5555\/520033.858247"},{"key":"e_1_2_1_27_1","unstructured":"CodeSurfer 2005. CodeSurfer. Retrieved March 9 2016 from http:\/\/www.grammatech.com\/research\/technologies\/codesurfer. CodeSurfer 2005. CodeSurfer. Retrieved March 9 2016 from http:\/\/www.grammatech.com\/research\/technologies\/codesurfer."},{"key":"e_1_2_1_28_1","volume-title":"USENIX Security Symposium.","author":"Costin Andrei","year":"2014"},{"key":"e_1_2_1_29_1","volume-title":"USENIX Symposium on Operating Systems Design and Implementation.","author":"Cozzie Anthony"},{"key":"e_1_2_1_30_1","volume-title":"Network and Distributed System Security Symposium.","author":"Cui Ang"},{"key":"e_1_2_1_31_1","doi-asserted-by":"publisher","DOI":"10.1145\/1455770.1455820"},{"key":"e_1_2_1_32_1","volume-title":"Knowledge-Based Software Engineering Conference.","author":"Dekker R."},{"key":"e_1_2_1_33_1","volume-title":"Network and Distributed System Security Symposium.","author":"Dewey David"},{"key":"e_1_2_1_34_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2011.11"},{"key":"e_1_2_1_35_1","doi-asserted-by":"publisher","DOI":"10.1134\/S0361768809020066"},{"key":"e_1_2_1_36_1","doi-asserted-by":"publisher","DOI":"10.1109\/WCRE.2008.20"},{"key":"e_1_2_1_37_1","volume-title":"Dyninst: Putting the Performance in High Performance Computing. Retrieved","author":"Dyninst","year":"2016"},{"key":"e_1_2_1_38_1","doi-asserted-by":"publisher","DOI":"10.1145\/2491956.2462165"},{"key":"e_1_2_1_39_1","doi-asserted-by":"publisher","DOI":"10.5555\/1038267.1039035"},{"key":"e_1_2_1_40_1","volume-title":"USENIX Symposium on Operating Systems Design and Implementation.","author":"Erlingsson \u00dalfar"},{"key":"e_1_2_1_41_1","doi-asserted-by":"publisher","DOI":"10.1109\/WCRE.2011.49"},{"key":"e_1_2_1_42_1","doi-asserted-by":"publisher","DOI":"10.1109\/CSMR.2010.43"},{"key":"e_1_2_1_43_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2012.40"},{"key":"e_1_2_1_44_1","volume-title":"Network and Distributed Systems Security Symposium.","author":"Garfinkel Tal","year":"2003"},{"key":"e_1_2_1_45_1","doi-asserted-by":"publisher","DOI":"10.1145\/237721.237724"},{"key":"e_1_2_1_46_1","volume-title":"USENIX Security Symposium.","author":"Giuffrida Cristiano"},{"key":"e_1_2_1_47_1","doi-asserted-by":"publisher","DOI":"10.1145\/2391229.2391234"},{"key":"e_1_2_1_48_1","doi-asserted-by":"publisher","DOI":"10.1109\/TCC.2014.2338305"},{"key":"e_1_2_1_49_1","doi-asserted-by":"publisher","DOI":"10.5555\/832308.837158"},{"key":"e_1_2_1_50_1","doi-asserted-by":"publisher","DOI":"10.1145\/1146238.1146268"},{"key":"e_1_2_1_51_1","volume-title":"Working Conference on Reverse Engineering.","author":"Haller Istv\u00e1n","year":"2013"},{"key":"e_1_2_1_52_1","first-page":"3","article-title":"DIGITAL FX!32: Combining emulation and binary translation","volume":"9","author":"Hookway Raymond J.","year":"1997","journal-title":"Digital Tech. J."},{"key":"e_1_2_1_53_1","unstructured":"IDA 2005. IDA. Retrieved March 9 2016 from https:\/\/www.hex-rays.com\/products\/ida\/. IDA 2005. IDA. Retrieved March 9 2016 from https:\/\/www.hex-rays.com\/products\/ida\/."},{"key":"e_1_2_1_54_1","doi-asserted-by":"publisher","DOI":"10.1145\/2024569.2024571"},{"key":"e_1_2_1_55_1","doi-asserted-by":"publisher","DOI":"10.1145\/1315245.1315262"},{"key":"e_1_2_1_56_1","doi-asserted-by":"publisher","DOI":"10.1145\/2556464.2556465"},{"key":"e_1_2_1_57_1","doi-asserted-by":"publisher","DOI":"10.1145\/1669112.1669122"},{"key":"e_1_2_1_58_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2010.10"},{"key":"e_1_2_1_59_1","volume-title":"USENIX Security Symposium.","author":"Kruegel Christopher","year":"2004"},{"key":"e_1_2_1_60_1","doi-asserted-by":"publisher","DOI":"10.1002\/spe.4380240204"},{"key":"e_1_2_1_61_1","volume-title":"Network and Distributed System Security Symposium.","author":"Lee JongHyup","year":"2011"},{"key":"e_1_2_1_62_1","doi-asserted-by":"publisher","DOI":"10.1109\/WCRE.2006.29"},{"key":"e_1_2_1_63_1","volume-title":"Network and Distributed System Security Symposium.","author":"Lin Zhiqiang","year":"2008"},{"key":"e_1_2_1_64_1","volume-title":"Network and Distributed System Security Symposium.","author":"Lin Zhiqiang","year":"2012"},{"key":"e_1_2_1_65_1","volume-title":"Network and Distributed System Security Symposium.","author":"Lin Zhiqiang","year":"2011"},{"key":"e_1_2_1_66_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-02918-9_7"},{"key":"e_1_2_1_67_1","volume-title":"Network and Distributed System Security Symposium.","author":"Lin Zhiqiang","year":"2010"},{"key":"e_1_2_1_68_1","volume-title":"The LLVM Compiler Infrastructure. Retrieved","author":"LLVM","year":"2016"},{"key":"e_1_2_1_69_1","doi-asserted-by":"publisher","DOI":"10.1145\/1065010.1065034"},{"key":"e_1_2_1_70_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-540-30579-8_13"},{"key":"e_1_2_1_71_1","doi-asserted-by":"publisher","DOI":"10.1145\/1542431.1542445"},{"key":"e_1_2_1_72_1","volume-title":"USENIX Security Symposium.","author":"McCamant Stephen","year":"2006"},{"key":"e_1_2_1_73_1","doi-asserted-by":"publisher","DOI":"10.1016\/0022-0000(78)90014-4"},{"key":"e_1_2_1_74_1","doi-asserted-by":"publisher","DOI":"10.5555\/645393.651886"},{"key":"e_1_2_1_75_1","doi-asserted-by":"publisher","DOI":"10.1145\/1250734.1250746"},{"key":"e_1_2_1_76_1","doi-asserted-by":"publisher","DOI":"10.1145\/253228.253351"},{"key":"e_1_2_1_77_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2008.24"},{"key":"e_1_2_1_78_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.diin.2006.10.001"},{"key":"e_1_2_1_79_1","volume-title":"Pin - A Dynamic Binary Instrumentation Tool. Retrieved","author":"PIN","year":"2016"},{"key":"e_1_2_1_80_1","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2015.23297"},{"key":"e_1_2_1_81_1","volume-title":"QEMU: An open source processor emulator. Retrieved","author":"Qemu","year":"2016"},{"key":"e_1_2_1_82_1","doi-asserted-by":"publisher","DOI":"10.1145\/292540.292553"},{"key":"e_1_2_1_83_1","doi-asserted-by":"publisher","DOI":"10.1145\/1111583.1111585"},{"key":"e_1_2_1_84_1","doi-asserted-by":"publisher","DOI":"10.1145\/2505879.2505901"},{"key":"e_1_2_1_85_1","volume-title":"ROSE compiler infrastructure. Retrieved","author":"Rose","year":"2016"},{"key":"e_1_2_1_86_1","doi-asserted-by":"publisher","DOI":"10.1145\/292540.292552"},{"key":"e_1_2_1_87_1","volume-title":"USENIX Security Symposium.","author":"Schwartz Edward J.","year":"2013"},{"key":"e_1_2_1_88_1","doi-asserted-by":"publisher","DOI":"10.5555\/882506.885138"},{"key":"e_1_2_1_89_1","volume-title":"Workshop on Binary Translation.","author":"Schwarz Benjamin","year":"2001"},{"key":"e_1_2_1_90_1","unstructured":"SecondWrite. 2013. SecondWrite. Retrieved March 9 2016 from http:\/\/www.secondwrite.com\/. SecondWrite. 2013. SecondWrite. Retrieved March 9 2016 from http:\/\/www.secondwrite.com\/."},{"key":"e_1_2_1_91_1","volume-title":"USENIX Security Symposium.","author":"Richard Shin Eui Chul","year":"2015"},{"key":"e_1_2_1_92_1","doi-asserted-by":"publisher","DOI":"10.1109\/2.214441"},{"key":"e_1_2_1_93_1","doi-asserted-by":"publisher","DOI":"10.1145\/151220.151227"},{"key":"e_1_2_1_94_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-08509-8_1"},{"key":"e_1_2_1_95_1","doi-asserted-by":"publisher","DOI":"10.1145\/1851276.1851280"},{"key":"e_1_2_1_96_1","volume-title":"Network and Distributed System Security Symposium.","author":"Slowinska Asia","year":"2011"},{"key":"e_1_2_1_97_1","volume-title":"USENIX Annual Technical Conference.","author":"Slowinska Asia","year":"2012"},{"key":"e_1_2_1_98_1","volume-title":"SmartDec decompiler. Retrieved","year":"2016"},{"key":"e_1_2_1_99_1","doi-asserted-by":"crossref","unstructured":"Venkatesh Srinivasan and Thomas Reps. 2014. Recovery of class hierarchies and composition relationships from machine code. In Compiler Construction. Venkatesh Srinivasan and Thomas Reps. 2014. Recovery of class hierarchies and composition relationships from machine code. In Compiler Construction.","DOI":"10.1007\/978-3-642-54807-9_4"},{"key":"e_1_2_1_100_1","doi-asserted-by":"publisher","DOI":"10.1109\/SCAM.2010.24"},{"key":"e_1_2_1_101_1","unstructured":"Udis. 2009. Udis86 Disassembler. Retrieved March 9 2016 from https:\/\/github.com\/vmt\/udis86. Udis. 2009. Udis86 Disassembler. Retrieved March 9 2016 from https:\/\/github.com\/vmt\/udis86."},{"key":"e_1_2_1_102_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-11212-1_14"},{"key":"e_1_2_1_103_1","unstructured":"Valgrind. 2007. Valgrind. Retrieved March 9 2016 from http:\/\/valgrind.org\/. Valgrind. 2007. Valgrind. Retrieved March 9 2016 from http:\/\/valgrind.org\/."},{"key":"e_1_2_1_104_1","volume-title":"USENIX Security Symposium.","author":"Vogl Sebastian","year":"2014"},{"key":"e_1_2_1_105_1","doi-asserted-by":"publisher","DOI":"10.1145\/168619.168635"},{"key":"e_1_2_1_106_1","volume-title":"Network and Distributed System Security Symposium.","author":"Wondracek Gilbert","year":"2008"},{"key":"e_1_2_1_107_1","doi-asserted-by":"publisher","DOI":"10.1145\/1745312.1745315"},{"key":"e_1_2_1_108_1","first-page":"14","article-title":"Conservative Signed\/Unsigned Type Inference for Binaries using Minimum Cut","author":"Yan Qiuchen","year":"2014","journal-title":"Technical Report"},{"key":"e_1_2_1_109_1","volume-title":"Network and Distributed System Security Symposium.","author":"Yin Heng","year":"2008"},{"key":"e_1_2_1_110_1","volume-title":"TEMU: Binary Code Analysis via Whole-System Layered Annotative Execution. Technical Report UCB\/EECS-2010-3. EECS Department","author":"Yin Heng","year":"2010"},{"key":"e_1_2_1_111_1","doi-asserted-by":"publisher","DOI":"10.1109\/APSEC.2014.44"},{"key":"e_1_2_1_112_1","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2014.23229"},{"key":"e_1_2_1_113_1","doi-asserted-by":"publisher","DOI":"10.1145\/2508859.2516664"},{"key":"e_1_2_1_114_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-26362-5_25"},{"key":"e_1_2_1_115_1","volume-title":"Network and Distributed Systems Security Symposium.","author":"Zhang Chao","year":"2015"},{"key":"e_1_2_1_116_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2013.44"},{"key":"e_1_2_1_117_1","doi-asserted-by":"publisher","DOI":"10.1109\/COMPSAC.2007.163"},{"key":"e_1_2_1_118_1","volume-title":"Network and Distributed System Security Symposium.","author":"Zhang Mingwei","year":"2012"}],"container-title":["ACM Computing Surveys"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/2896499","content-type":"application\/pdf","content-version":"vor","intended-application":"syndication"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/2896499","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2022,12,31]],"date-time":"2022-12-31T08:54:20Z","timestamp":1672476860000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/2896499"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2016,5,2]]},"references-count":117,"journal-issue":{"issue":"4","published-print":{"date-parts":[[2016,5,2]]}},"alternative-id":["10.1145\/2896499"],"URL":"https:\/\/doi.org\/10.1145\/2896499","relation":{},"ISSN":["0360-0300","1557-7341"],"issn-type":[{"value":"0360-0300","type":"print"},{"value":"1557-7341","type":"electronic"}],"subject":[],"published":{"date-parts":[[2016,5,2]]},"assertion":[{"value":"2015-04-01","order":0,"name":"received","label":"Received","group":{"name":"publication_history","label":"Publication History"}},{"value":"2016-01-01","order":1,"name":"accepted","label":"Accepted","group":{"name":"publication_history","label":"Publication History"}},{"value":"2016-05-02","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}