CuLifter: Lifting GPU Binaries to Typed IR

2026-04-30

AI Summary

This work addresses the challenge of type erasure in GPU binaries, where GPU compilers uniformly store all data types in the register file, thereby discarding type information and impeding disassembly and semantic recovery. To systematically resolve this issue, the paper introduces a constraint-propagation-based type inference method that integrates conflict detection, control-flow reconstruction, and multi-instruction pattern recognition to lift SASS binaries into typed LLVM IR. Evaluated on 24,437 GPU functions across eight benchmark suites, the approach achieves a 99.98% lifting success rate. Ablation studies further demonstrate that disabling type recovery reduces the x86 compatibility rate from 73.8% to 0%, underscoring the critical role of accurate type reconstruction in generating semantically correct intermediate representations.

Abstract

GPU compilers merge all data types into a single unified register file, erasing the type information that binary-analysis tools rely on. We show that type recovery from this untyped register file is the central challenge of GPU binary lifting. We present CuLifter, a SASS-to-LLVM IR lifting framework that recovers register types via constraint propagation with conflict detection, reconstructs explicit control flow, and aggregates multi-instruction patterns. Across eight benchmark suites (24,437 GPU functions in 919 cubins) spanning open-source applications, vendor libraries, and optimized ML runtimes, CuLifter successfully lifts 99.98% of functions to valid LLVM IR. An ablation study confirms that type recovery is the only step required to produce semantically correct IR: disabling it drops the x86 pass rate from 73.8% to 0%, a 73.8 percentage-point drop.

Problem

• GPU binary lifting
• type recovery
• register file
• binary analysis
• LLVM IR

Innovation

• type recovery
• GPU binary lifting
• constraint propagation
• SASS-to-LLVM
• register typing