CiRCLE: Recovering Complex Data Structures in Binaries Beyond Fragmentation

Decompilation of stripped binaries is hindered by the loss of user-defined data structures, causing pseudocode to degrade into raw offsets, casts, and generic pointers. Recovering these structures remains challenging for three main reasons: local evidence becomes fragmented once accesses go beyond simple one-hop forms, program-wide aggregation fragments under polymorphism, and residual cases such as dynamic offsets or irreconcilable conflicts are not reliably resolvable by static rules alone. We present CiRCLE, a staged framework for recovering complex data structures from stripped binaries. CiRCLE first constructs the MOSAIC graph, a shared evidence representation that explicitly preserves computed and intermediate pointer expressions at expression granularity. It then performs conflict-aware interprocedural aggregation directly on the same evidence graph, enabling evidence reuse across monomorphic flows while isolating true polymorphic boundaries. For the small residue of underdetermined cases, it invokes LLM refinement only on localized evidence packages and falls back to the deterministic static result when refinement fails. On the OSPREY dataset, CiRCLE surpasses the best prior method by up to 15.6 % in Structure Identification, 47.7 % in Relationship Recovery, and 33.6 % in Layout Recovery. On a corpus of 140,000 functions from real-world applications, it achieves $59.7 \% ~\mathrm{F} 1$ in Layout Recovery, a 51.1 % relative improvement over the best prior method in that setting.