← JSNice

SRI Lab · ETH Zurich

DEBIN

Predicting Debug Information in Stripped Binaries. Names, types and locations are recovered.

Compiled binaries are usually shipped stripped: the symbol table is gone, and with it every variable name, function name and type that a debugger would have shown. DEBIN predicts this information from the context around.

Works on ELF binaries for x86, x64 and ARM.

DEBIN example

Stripped binary, decompiled

sub_4013f0(a1, a2) {
  v3 = *(a1 + 8);
  ...
}

After DEBIN

read_header(FILE *stream, int flags) {
  size_t len = stream->size;
  ...
}
Schematic illustration of the task, not output from a specific run.

The paper

DEBIN: Predicting Debug Information in Stripped Binaries

Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security (CCS 2018).

More resources

Related on this site: JSNice, for JavaScript, and DeGuard, for Android applications.