Static Type Inference from Machine Code via Intermediate Representation

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing techniques for reconstructing type information from machine code are inefficient and inaccurate, particularly in stripped binaries, due to the loss of type information during compilation and the presence of optimizations like polymorphic functions, recursive types, and type-unsafe idioms.

Innovation Solution

A novel static type inference algorithm that generates intermediate representations, type constraints, and inferred types, using subtyping and sketches to accurately recover type information, even in the presence of optimizations and type-unsafe code, by separating sound type inference from heuristic conversion to human-readable C types.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Measurement precision

If conventional type reconstruction techniques are used on stripped binaries, then type information can be partially recovered, but accuracy and precision are significantly degraded due to type erasure and optimizations

Engineering Contradiction:

Improvetype reconstruction accuracyVSAvoidtype information loss

Core Design Contradiction:

Measurement precisionVSLoss of information

Solution Approach 1:

The patent segments the type reconstruction process into distinct phases: intermediate representation generation from machine code, constraint generation from the IR, constraint solving to infer types, and conversion to C types. This segmentation allows each phase to handle specific aspects of type recovery independently, improving overall accuracy despite information loss in stripped binaries

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent performs preliminary generation of an intermediate representation from machine code before type inference. This intermediate representation preserves structural information that would otherwise be lost, enabling more accurate type reconstruction by establishing a high-level view of the code before type constraints are applied

Inventive Principle:

Principle #10Preliminary action

2Productivity

If type-unsafe optimizations and polymorphic functions are applied during compilation, then code efficiency and versatility improve, but type information is erased and reconstruction becomes more difficult

Engineering Contradiction:

Improvecode execution efficiencyVSAvoidtype reconstruction complexity

Core Design Contradiction:

ProductivityVSDevice complexity

Solution Approach 1:

The patent introduces an intermediate representation as a mediator between the optimized machine code and the type inference process. This intermediate representation serves as a bridge that preserves type-relevant information while allowing the system to work with efficiently optimized code, reducing the complexity of reconstructing types from highly optimized binaries

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The patent changes the parameters of type reconstruction by using constraint-based inference with sketches that model type capabilities rather than traditional type recovery methods. This parameter change allows the system to handle polymorphic functions and type-unsafe optimizations more effectively by reasoning about type capabilities rather than exact types

Inventive Principle:

Principle #35Parameter changes

3Reliability

If existing type reconstruction methods are applied to machine code with recursive types and polymorphism, then some type information can be recovered, but the methods are inefficient and inaccurate

Engineering Contradiction:

Improvetype information recovery reliabilityVSAvoidtype reconstruction time

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

The patent employs dynamic constraint solving with sketches that can adapt to different code structures including recursive types and polymorphic functions. The constraint solving process dynamically adjusts to the complexity of the code being analyzed, improving reliability for complex programs while managing analysis time through efficient constraint propagation

Inventive Principle:

Principle #15Dynamics

Solution Approach 2:

The patent replaces traditional mechanical type recovery methods with a constraint-based inference system using sketches. This substitution enables more reliable type reconstruction for complex programs with recursion and polymorphism by using logical constraint satisfaction rather than pattern matching or heuristic approaches, while maintaining efficiency through optimized constraint solving

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

Data Source

PatentUS10942718B2Systems and/or methods for type inference from machine code

Publication Date: 2021.03.09 GRAMMATECH INC

AI summary

Systems, methods and computer readable medium described herein relate to techniques for automatic type inference from machine code. An example technique includes receiving a machine code of a program, generating an intermediate representation of the machine code, generating a plurality of type constraints from the intermediate representation, generating one or more inferred types based at least upon the plurality of type constraints, converting the generated inferred types to C types, updating the intermediate representation by applying the inferred types to the intermediate representation, and outputting said inferred types, said converted C types, and/or at least a portion of the updated intermediate representation.