type inference algorithm used in ghidra

[Ruturaj4]

For research purposes I am interesting in knowing what sort of algorithm is used in ghidra for type recovery. I read few current papers on type recovery and I was curious to know what approach is implemented in ghidra. Specifically for array bound detection.

Citing few state-of-the-art approaches and surveys.

1. Lee, JongHyup, Thanassis Avgerinos, and David Brumley. "TIE: Principled reverse engineering of types in binary programs." (2011).

2. Caballero, Juan, and Zhiqiang Lin. "Type inference on executables." ACM Computing Surveys (CSUR) 48.4 (2016): 1-35.

3. Maier, Alwin, et al. "TypeMiner: Recovering types in binary programs using machine learning." International Conference on Detection of Intrusions and Malware, and Vulnerability Assessment. Springer, Cham, 2019.

4. Noonan, Matt, Alexey Loginov, and David Cok. "Polymorphic type inference for machine code." Proceedings of the 37th ACM SIGPLAN Conference on Programming Language Design and Implementation. 2016.

5. Caballero, Juan, et al. "ARTISTE: Automatic generation of hybrid data structure signatures from binary code executions." IMDEA Software Institute, Tech. Rep. TR-IMDEA-SW-2012-001 (2012).