{"id":"ae869a9b-1d4e-48ae-81ea-304dd6cb574a","arxiv_id":"2501.13256","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":0,"one_line_summary":"Arphsy bypasses Darcula's Array Canary by building a harness that calls the obfuscated file's own resolver function over a computed address range.","lead":"This paper reveals a new anti-analysis trick, the Array Canary, inside the Darcula phishing kit, and ships a tool called Arphsy that automatically resolves the hidden calls by reusing the code's own functions. Defenders get a pre-processing step that turns canaried JavaScript into readable text before deeper analysis.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The bypass depends on a variant-specific 'most reassigned variable' heuristic and an offset-range formula that are unverified on real Darcula samples; a wrong decoder selection or range breaks the entire deobfuscation.","rationale":"Read in good faith, the paper gives a plausible description of a Darcula-specific deobfuscation pipeline and releases code and samples, which is real evidence. However, the central claim - that AFCR 'bypasses Array Canaries' and Arphsy can deobfuscate canaried files - is never demonstrated in the manuscript. There is no results section, no benchmark, no output listing, and no comparison against a baseline. The authors' own Section 4 limits directly undermine the unqualified abstract/title: they admit files over 1,000 lines were not fully deobfuscated, the approach depends on RegEx hooks that future variants can change, and the target-function override case fails. Under the rule that self-asserted limitations count as evidence, these concessions should be weighed in the verdict. The reader's weakest assumption pointed to the same Section 3.4/3.5 heuristic, so I agree. A single held-out benchmark with ground-truth string mappings would settle whether the concern lands. If the benchmark succeeds on all named samples, the paper's practical claim for current Darcula is credible; if it fails on any family, the bypass claim is overbroad. The appropriate verdict is UNCHANGED: the reader's CONDITIONAL verdict already captures the missing evaluation, and I would not move it.","tokens_in":14883,"tokens_out":7452,"duration_ms":71070,"concrete_test":"Run Arphsy on the 20 uspass rSGF6 samples and the shopife loadDarcula.js/darcula.js/66bcd94a3aHKX.js chain from Tables 1-2. For ground truth, instrument each original file to log every (hexIndex, decodedString) pair produced by its decoder before the canary loop terminates, and also record the decoder's real base offset and the true string table length. Compare against Arphsy's output for every hex value in its computed range. If any resolved string differs, any real hex index falls outside Arphsy's range, or any file over 1,000 lines hangs, the load-bearing heuristic is falsified; report per-family success rates.","verdict_should_be":"UNCHANGED","load_bearing_attack":"Central claim requires that Sec. 3.4's most-reassigned-variable finding reliably identifies the string-decoder function, and that Sec. 3.5's first-offset + largest-array-length formula bounds the actual hex indices used by the canaried file. The paper supplies neither a correctness argument nor an evaluation: no Arphsy run on any of the 43 cJS artifacts in Tables 1-2 is reported, no ground-truth comparison is made, and no success/failure counts are given. The heuristic is reverse-engineered from specific samples and is admittedly fragile - Sec. 4 says overriding the target function breaks the hex-offset search, files over 1,000 lines were not fully deobfuscated, and future Darcula variants can defeat the RegEx hooks. If the most reassigned variable is a busy local variable rather than the decoder, or if the largest array is not the string table, the harness calls the wrong function or wrong address window and silently produces incorrect output, so the claimed general bypass does not follow. The strongest claim should be read as 'Arphsy worked on some observed samples,' not as a general Array Canary bypass, unless the omitted evaluation is supplied.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"This paper reports the observation of an \"Array Canary\" anti-analysis mechanism in JavaScript used by the Darcula Phishing-as-a-Service framework: a string array is shuffled by an IIFE whose parseInt-based check must equal a specific constant, and modifying the array values causes an infinite loop. The authors propose Autonomous Function Call Resolution (AFCR), implemented in a proof-of-concept tool called Arphsy, which extracts IIFEs, filters functions by whether they call only locally defined functions, selects the \"most reassigned variable\" as the decoder entry point, computes a hex offset range from the first offset and the largest string array, and appends driver code to resolve calls by invoking the target file's own functions. The paper claims that this approach bypasses Array Canaries and can guide LLMs and security researchers in deobfuscating canaried JavaScript code, and it points to a public GitHub repository containing the code and sample artifacts.","tokens_in":15086,"tokens_out":5312,"duration_ms":50107,"significance":"The observation of a canary-style infinite-loop lock in Darcula is potentially useful to the phishing defense community, and the living-off-the-land idea of using the obfuscated code's own functions to resolve strings is a sensible way to avoid tripping the lock. The paper ships concrete implementation sketches, lists real deployment artifacts, and opens a public repository, which are strengths. However, the contribution as stated (\"bypasses Array Canaries\") is not backed by any empirical evaluation in the manuscript; the key methodological assumptions are unvalidated, and the authors themselves enumerate conditions under which the approach fails. As written, the result is best read as a technique description with a proof-of-concept, not as a demonstrated general bypass.","major_comments":[{"comment":"The central claim that Arphsy bypasses Array Canaries is not supported by any reported evaluation. The manuscript lists many Darcula artifacts in Tables 1 and 2 but does not report a single Arphsy run on any of them, no success/failure counts, no comparison between resolved output and ground truth (e.g., strings obtained by executing the file with the canary intact or by manual analysis), and no error analysis. Section 4 additionally concedes that files over 1,000 lines were not fully deobfuscated, that overriding the target function breaks the hex-offset search, and that RegEx hooks are fragile to future Darcula variants. An evaluation on the listed samples, with per-family and per-file outcomes, is necessary before the abstract's \"bypass Array Canaries\" claim can be accepted.","section":"Section 4; Tables 1-2"},{"comment":"The two central heuristics are unverified and under-specified. The algorithm assumes that the most reassigned variable is the entry point to the deobfuscation routine and that the largest string array's length plus the first hex offset bounds the canaried address range. The paper gives no correctness argument for either assumption and no evidence that they hold across the Darcula variants in Tables 1-2. In fact, the code in Section 3.4 counts identifier occurrences as initializers or right-hand sides of assignment expressions, which is not the same as counting reassignments; this could select a busy local variable unrelated to the decoder. A wrong selection silently produces an incorrect address window and invalid resolved strings, so the claimed general bypass does not follow from the described implementation.","section":"Sections 3.4 and 3.5"},{"comment":"The offset-range calculation has an off-by-one ambiguity. If the largest string array has n entries and the first offset is the starting hex value, the valid canary indices are from that offset through offset + n - 1; the paper states that the second value is \"the length of the largest string array added to the first offset found,\" which would make the range include one extra value. The driver code should define the exact lower and upper bounds used for the loop and justify why the extra iteration is intentional or harmless.","section":"Section 3.5; Figure 5"}],"minor_comments":[{"comment":"Typos appear in the prose and code: \"FunctionDeclaratoin\" in Section 3.3 and \"findMostReassignedVariabe\" in Section 3.4.","section":"Section 3.3 and 3.4"},{"comment":"All code listings are referenced as \"Listing ??\" without actual listing numbers, making it difficult to connect the prose to the code examples.","section":"Throughout"},{"comment":"\"Phishing-as-a-Serivce\" is misspelled, and the sentence \"If none of the Array Canaries or modified\" is grammatically incomplete.","section":"Section 2.1"},{"comment":"The anecdotes about LLM prompting failures are interesting motivation, but they are presented without a controlled comparison or any systematic measurement; they should be framed as a design rationale rather than as evidence of LLM inadequacy.","section":"Section 4"}],"recommendation":"major_revision","confidential_remarks":null},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Quick take: this is a real contribution as a field description of a live anti-analysis pattern, and the tool is worth knowing about. But the paper's central claim—that Arphsy bypasses Array Canaries—is not backed by any reported evaluation. The authors list 43 in-the-wild samples in Tables 1 and 2 but never say how many Arphsy successfully deobfuscated, or why it failed where it did. That gap is the whole ballgame.\n\nWhat is genuinely new: the Array Canary pattern itself—an array-shuffle with a sentinel string that triggers an infinite loop if tampered—is clearly explained with readable examples. The connection to Emotet's array shuffling is plausible and contextualized. Arphsy's idea of using the code's own decoder functions (living off the land) is sensible and the AST-based approach is laid out step by step. The authors also shipped the tool and sample files, so someone else can reproduce the mechanics.\n\nThe soft spots, in proportion. First, the missing evaluation is real. There are no success/failure counts, no ground truth comparison, no runtime stats, no error analysis. The authors admit they did not fully deobfuscate files over 1,000 lines and that the regex hooks are fragile against future Darcula variants. That means the title 'Bypassing Array Canaries' should read 'A heuristic that worked on some observed samples.' The most-reassigned-variable heuristic and the first-offset-plus-largest-array-length formula are demonstrated on what look like a few hand-picked listings but not shown to generalize across the 43 artifacts. Second, some presentation issues: several listings are referenced as 'Listing ??' and never appear, and the paper has a few typos. Those are minor but cost polish.\n\nOn the circularity concern: I don't think it lands. Reusing the obfuscated code's own functions to resolve calls is standard dynamic analysis, not circular reasoning. The resolved strings are outputs of the code under analysis, not parameters fitted to a target result. That worry can be set aside.\n\nWho this is for: defenders and analysts working on Darcula or similar array-shuffling obfuscators will get the most value, especially the pattern description and the PoC tool. As a scientific claim of a general bypass, it is not there yet.\n\nRecommendation: This should go to peer review—a serious referee can push the authors to add a small benchmark and scope the claims. It is not a desk reject, but it is not an accept as-is either.","headline":"A genuine first look at Darcula's Array Canary with a plausible but unproven bypass; needs an evaluation before the strong claims can stand.","tokens_in":15618,"tokens_out":2252,"would_cite":false,"duration_ms":20758,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"This paper claims that Darcula, a phishing-as-a-service framework, protects its JavaScript payloads with Array Canaries that infinite-loop if altered, and that its new static method AFCR, implemented as Arphsy, resolves the canaried calls…","keywords":["Array Canary","Darcula","JavaScript deobfuscation","Phishing-as-a-Service","Autonomous Function Call Resolution","Abstract Syntax Tree","Emotet array shuffling","anti-analysis bypass"],"falsifier":"Take a canaried Darcula sample, run Arphsy, and compare the hex values in the harness's resolved range against the array indices actually consulted by the IIFE's parseInt checks; if any required index lies outside the computed range, the bypass fails. A second test: create a synthetic canaried file in which the most reassigned variable is a decoy unrelated to the shuffle; if Arphsy still resolves the file correctly, the heuristic is not load-bearing, and if it fails, the assumption is confirmed.","tokens_in":14626,"feed_emoji":"🔓","tokens_out":12665,"duration_ms":101226,"temperature":0.7,"pith_summary":"The paper reports a new anti-analysis technique, the Array Canary, in the in-the-wild JavaScript payloads of the Darcula phishing-as-a-service framework. A canary is a string embedded in a shuffled array: if any canary value is changed, an immediately invoked function expression (IIFE) that performs parseInt-based arithmetic never reaches its target constant and the whole program loops forever. The paper argues that this is an advanced form of the array-shuffling obfuscation used by Emotet's downloader, and that it can be bypassed without ever modifying a canary by statically reconstructing the deobfuscation routine. Its proposed Autonomous Function Call Resolution (AFCR), implemented as Arphsy, extracts the relevant functions, locates the entry point via the most reassigned variable, computes the hex range of canary addresses from the largest string array, and runs a harness that resolves all calls. If correct, defenders can strip the canaries from Darcula payloads and feed the recovered strings to an LLM or a human analyst.","feed_headline":"New parser bypasses Darcula's Array Canary infinite-loop lock","feed_subtitle":"AFCR finds the entry point statically and resolves canaried strings without tripping the loop.","key_machinery":"The load-bearing mechanism is the pairing of two heuristics: the 'most reassigned variable' identifies the function that drives the canary shuffle, and the two-offset range (first hex offset plus largest string array length) delimits which hex addresses belong to canary resolution. These heuristics let the harness reuse the file's own functions to resolve calls, a living-off-the-land approach that avoids touching canary values. Arphsy is an Abstract Syntax Tree (AST) parser and aggregator that implements this pipeline: find IIFEs, filter functions to those with no imported calls, find the most reassigned variable, compute the offset range, aggregate functions into a harness, and append driver code.","core_discovery":"We observed that Darcula embeds Array Canaries inside the shuffled string arrays of its JavaScript. Each canary value participates in a parseInt-based arithmetic check that must equal a fixed constant; if any canary is modified, the IIFE shifts the array forever and the payload never deobfuscates. AFCR bypasses this by leaving the canaries untouched: it extracts all immediately invoked function expressions (IIFEs), keeps only functions that call internal definitions, identifies the most reassigned variable as the entry point to the deobfuscation routine, takes the first hex offset from that function, and adds the length of the largest string array to bound the range of hex values to resolve. Arphsy builds a harness that invokes the entry function on each hex in that range, yielding the resolved strings. The method is demonstrated on the observed Darcula variants, with the caveat that it fails when the target function is overridden or files exceed 1,000 lines.","pith_inferences":["The paper leaves AFCR's generality unquantified: a natural test is to run Arphsy across all observed Darcula samples and across synthetic canaried files with multiple large arrays, measuring what fraction of resolved strings match the original.","If the most-reassigned-variable heuristic is specific to Darcula's obfuscator, a future variant could shuffle two arrays equally often and break the entry-point guess; a more robust version might identify the entry function by its while-true-parseInt structure instead of assignment counts.","The reported LLM failures suggest a division of labor that the paper does not explore: deterministic AFCR for resolution, then LLMs for semantic interpretation of the recovered strings.","The paper's framing implies that whole-file machine-learning detectors trained on canaried samples may learn 'canary-avoidance' rather than true malicious behavior; de-canarying first could improve both detection and interpretability."],"forward_implications":["If AFCR is correct, any observed canaried Darcula payload can be reduced to a harness that resolves every obfuscated string call, enabling further manual or LLM-based analysis without tripping the infinite-loop lock.","Existing machine-learning deobfuscators that analyze whole files would hit the canary lock; AFCR offers a pre-processing step that removes the canary before analysis.","Because Darcula's Array Canaries are an advanced form of Emotet's array shuffling, the same approach may be back-ported to less sophisticated array-based JavaScript obfuscation.","The method is knowingly variant-specific: changing static hooks such as the target function override or RegEx patterns would defeat the current Arphsy implementation, motivating AST-centric generalization.","For files over 1,000 lines the current implementation does not fully deobfuscate, so scaling and caching are identified as necessary next steps."],"supporting_citations":[{"why":"A threat-intelligence report that tracked Darcula as a large phishing-as-a-service framework, providing the campaign context and the observed canaried files.","marker":"[22]"},{"why":"A web-scanning service whose collected scan data showed over 8,000 domains requesting the canaried JavaScript, tying the technique to live infrastructure.","marker":"[2]"},{"why":"Introduces the original canary idea, which the paper says Array Canaries adapt from memory protection to JavaScript obfuscation.","marker":"[14]"},{"why":"Analysis of the Emotet JavaScript downloader's array-shuffling IIFE, identified as the predecessor of Darcula's Array Canary.","marker":"[33]"},{"why":"An AST-based parser/aggregator for malicious NPM packages whose API-sequence mapping Arphsy adapts, substituting the most-reassigned-variable heuristic.","marker":"[30]"},{"why":"A published reverse-engineering account of bypassing a loader family's anti-analysis by reusing the malware's own code; the direct precedent for AFCR.","marker":"[38]"},{"why":"The concept of reusing a program's own resources, cited as the design basis for AFCR's self-resolution approach.","marker":"[52]"}],"fun_headline_variants":["AFCR bypasses Darcula's Array Canary infinite-loop lock","Autonomous Function Call Resolution defeats Array Canaries","New AFCR tool resolves canaried JS without triggering loop","AFCR: static entry-point hunting bypasses canary anti-analysis"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The method assumes that the most reassigned variable in a canaried file always holds the deobfuscation entry point, and that the length of the largest string array added to the first hex offset exactly bounds the range of canary addresses to resolve; if a Darcula variant changes either, the harness computes wrong offsets and the bypass stops working.","fun_headline_variants_meta":{"raw":{"variants":["AFCR bypasses Darcula's Array Canary infinite-loop lock","Autonomous Function Call Resolution defeats Array Canaries","New AFCR tool resolves canaried JS without triggering loop","AFCR: static entry-point hunting bypasses canary anti-analysis"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000387,"raw_usage":{"total_tokens":2061,"prompt_tokens":984,"completion_tokens":1077,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":600,"completion_tokens_details":{"reasoning_tokens":1020}},"tokens_in":600,"tokens_out":1077,"duration_ms":10258,"temperature":1.0,"reasoning_tokens":1020,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-10T16:19:10.105620+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Take a canaried Darcula sample, run Arphsy, and compare the hex values in the harness's resolved range against the array indices actually consulted by the IIFE's parseInt checks; if any required index lies outside the computed range, the bypass fails. A second test: create a synthetic canaried file in which the most reassigned variable is a decoy unrelated to the shuffle; if Arphsy still resolves the file correctly, the heuristic is not load-bearing, and if it fails, the assumption is confirmed.","supporting_citations":[{"cited_title":"Out of the shadows - ’darcula’ iMessage and RCS smishing attacks target USPS and global postal services — Netcraft — netcraft.com","cited_arxiv_id":null,"evidence_quote":"A threat-intelligence report that tracked Darcula as a large phishing-as-a-service framework, providing the campaign context and the observed canaried files."},{"cited_title":"https://urlscan.io","cited_arxiv_id":null,"evidence_quote":"A web-scanning service whose collected scan data showed over 8,000 domains requesting the canaried JavaScript, tying the technique to live infrastructure."},{"cited_title":"Stackguard: automatic adaptive detection and prevention of buffer-overflow attacks","cited_arxiv_id":null,"evidence_quote":"Introduces the original canary idea, which the paper says Array Canaries adapt from memory protection to JavaScript obfuscation."},{"cited_title":"Emotet javascript downloader","cited_arxiv_id":null,"evidence_quote":"Analysis of the Emotet JavaScript downloader's array-shuffling IIFE, identified as the predecessor of Darcula's Array Canary."},{"cited_title":"DONAPI: Malicious NPM Packages Detector using Behavior Sequence Knowledge Mapping","cited_arxiv_id":"2403.08334","evidence_quote":"An AST-based parser/aggregator for malicious NPM packages whose API-sequence mapping Arphsy adapts, substituting the most-reassigned-variable heuristic."},{"cited_title":"Defeating BazarLoader Anti-Analysis Techniques — unit42.paloaltonetworks.com","cited_arxiv_id":null,"evidence_quote":"A published reverse-engineering account of bypassing a loader family's anti-analysis by reusing the malware's own code; the direct precedent for AFCR."},{"cited_title":"The case for cyber foraging","cited_arxiv_id":null,"evidence_quote":"The concept of reusing a program's own resources, cited as the design basis for AFCR's self-resolution approach."}],"review_version":1}