{"id":"c5a728a0-48d1-46f9-b9ac-2dbfbe90a566","arxiv_id":"2605.29620","paper_version":1,"verdict":"UNVERDICTED","confidence":"LOW","novelty_score":6.0,"correctness_risk":"high","formal_verification":"none","parameter_count":0,"one_line_summary":"Symbolic execution with speculative library preloading recovers 29.8% more CFG nodes and 26.5% more edges than static analysis alone, with 100% precision and recall on library detection across 16 synthetic obfuscated benchmarks.","lead":"The paper proposes combining symbolic execution with custom hooks that intercept and perform dynamic library loading to recover more complete control flow graphs from binaries using runtime linking. This could aid security analysis of malware and protected software that hides dependencies from static tools.","discovery_kind":"new_method","skeptic_critique":{"model":"grok-4.3","headline":"Evaluation on 16 synthetic benchmarks only; no real malware or protected software tested","rationale":"The reader's weakest assumption correctly flags the unproven handling of the obfuscation list inside the symbolic engine. However, the quantitative headline claim is even more directly load-bearing on the narrow synthetic-only evaluation; the two concerns are related but the evaluation scope is the more immediate threat to the reported percentages.","tokens_in":1788,"tokens_out":334,"duration_ms":17350,"concrete_test":"Obtain 8–10 real-world binaries (e.g., from public malware repositories) that employ at least three of the listed dynamic-loading techniques; execute the module and a standard static CFG tool on each, compute additional nodes/edges recovered, and cross-validate every reported library with Frida; if mean additional recovery falls below 15 % or any false-positive library resolution appears, the headline percentages do not generalize.","verdict_should_be":"CONDITIONAL","load_bearing_attack":"The strongest claim (29.8 % additional nodes, 26.5 % additional edges, 100 % precision/recall) rests on results from a batch of 16 synthetic benchmarks engineered with the listed obfuscations. For the claim to support the stated goal of recovering CFGs from protected software and modern malware that use dynamic loading, the same recovery rates and perfect detection must hold on authentic samples. No such evaluation is described; synthetic cases can be constructed to exercise exactly the interception points implemented in the two-level architecture, while real binaries may trigger path explosion, incomplete symbolic resolution of environment-derived paths, or manual ELF parsing that the hooks do not cover.","agreement_with_reader":"partial"},"referee_report":{"model":"grok-4.3","summary":"The paper proposes a symbolic execution method with speculative library preloading and custom hooks to intercept dynamic loading operations, enabling recovery of more complete control flow graphs (CFGs) from binaries that use runtime dynamic linking for evasion. It describes a two-level architecture storing interception functions and instruction tracking in the symbolic environment, evaluates the approach on 16 synthetic benchmarks covering obfuscations including encrypted names, network-triggered loading, environment-derived paths, multi-stage decryption, fileless execution, and manual ELF parsing, and reports average gains of 29.8% additional CFG nodes and 26.5% additional edges over static analysis alone, with 100% precision and 100% recall in library detection, all validated via Frida-based dynamic instrumentation.","tokens_in":1926,"tokens_out":612,"duration_ms":25849,"significance":"If the reported gains and perfect detection metrics hold beyond the synthetic setting, the technique would offer a valuable, instrumentation-free approach to CFG recovery for obfuscated code, addressing a practical gap in malware analysis where static methods fail on unresolved indirect calls. The emphasis on symbolic-only execution is a strength for safety when analyzing potentially malicious binaries.","major_comments":[{"comment":"Abstract / Evaluation: The central quantitative claims (29.8% additional nodes, 26.5% additional edges, 100% precision/recall) rest exclusively on results from 16 synthetic benchmarks; no evaluation on real malware samples or protected software is described, leaving open whether path explosion, incomplete resolution of environment-derived paths, or uncovered manual ELF parsing cases would degrade performance in the target setting.","section":"Abstract / Evaluation"},{"comment":"Methodology: The two-level architecture for interception and tracking is described at a high level but lacks sufficient detail on how it correctly resolves all listed obfuscation techniques (e.g., network-triggered loading or multi-stage decryption) without false library resolutions or missed edges, making it impossible to assess the risk of over-approximation in the symbolic state that could undermine the 100% detection metrics.","section":"Methodology"},{"comment":"Abstract: No error bars, per-obfuscation breakdown, or discussion of potential over-approximation is provided for the reported averages, and the full methodology for symbolic state management during library preloading is absent, weakening the soundness of the quantitative results.","section":"Abstract"}],"minor_comments":[{"comment":"Abstract: Minor grammatical issues such as 'experiments results show' (should be 'experimental results show') and 'the module recovers' (should be 'the proposed module recovers') reduce readability.","section":"Abstract"}],"recommendation":"major_revision","confidential_remarks":"The exclusive use of synthetic benchmarks engineered to match the implemented hooks is a load-bearing limitation for the paper's stated goal of aiding analysis of modern malware; this should be flagged for the authors to either extend the evaluation or narrow the claims."},"author_rebuttal":{"model":"grok-4.3","summary":"We thank the referee for the constructive feedback. We address each major comment below, indicating revisions where the manuscript will be updated.","responses":[{"response":"We agree the evaluation uses only synthetic benchmarks, chosen to enable controlled testing with verifiable ground truth via Frida. Real malware evaluation is absent because obtaining reliable ground truth is difficult. We will add a Limitations section discussing risks such as path explosion and environment-derived paths in real settings.","revision_made":"partial","referee_comment":"[Abstract / Evaluation] The central quantitative claims (29.8% additional nodes, 26.5% additional edges, 100% precision/recall) rest exclusively on results from 16 synthetic benchmarks; no evaluation on real malware samples or protected software is described, leaving open whether path explosion, incomplete resolution of environment-derived paths, or uncovered manual ELF parsing cases would degrade performance in the target setting."},{"response":"The manuscript presents the architecture at a high level for clarity. We will expand the Methodology section with concrete examples of hook behavior for each obfuscation (e.g., symbolic modeling of network inputs and decryption stages) and explicit discussion of safeguards against over-approximation.","revision_made":"yes","referee_comment":"[Methodology] The two-level architecture for interception and tracking is described at a high level but lacks sufficient detail on how it correctly resolves all listed obfuscation techniques (e.g., network-triggered loading or multi-stage decryption) without false library resolutions or missed edges, making it impossible to assess the risk of over-approximation in the symbolic state that could undermine the 100% detection metrics."},{"response":"We will update the evaluation section to report per-obfuscation breakdowns and error bars on the averages. We will also add detail on symbolic state management during preloading and a discussion of over-approximation risks to strengthen the soundness claims.","revision_made":"yes","referee_comment":"[Abstract] No error bars, per-obfuscation breakdown, or discussion of potential over-approximation is provided for the reported averages, and the full methodology for symbolic state management during library preloading is absent, weakening the soundness of the quantitative results."}],"tokens_in":1545,"tokens_out":502,"duration_ms":21616,"standing_objections":["Evaluation on real malware or protected software samples (no such data exists in the current work)"]},"desk_editor":{"model":"grok-4.3","letter":"The core contribution is a two-level hook architecture inside a symbolic executor that intercepts dynamic loading calls, resolves the libraries speculatively, and augments the CFG without running the binary. This directly targets indirect calls that static analysis misses when malware or protected code uses encrypted names, environment paths, or manual ELF parsing.\n\nIt does a clean job of staying inside symbolic execution rather than relying on dynamic instrumentation like Frida for the analysis itself, which keeps the process safer for malware samples. The reported average lift of 29.8 % nodes and 26.5 % edges, plus perfect library detection on their test set, is a straightforward quantitative result.\n\nThe main limitation is that all numbers come from 16 synthetic benchmarks engineered to match the listed obfuscations. There is no evaluation on real malware or commercial protected binaries, so it is unclear whether path explosion, incomplete environment resolution, or more complex multi-stage loading would reduce the gains or introduce false resolutions. The abstract also gives no breakdown by obfuscation type or discussion of symbolic-state over-approximation.\n\nThis work is aimed at people building or extending binary analysis tools for security, particularly those already using symbolic execution. The idea is narrow but practical, and the implementation details appear reproducible enough to test. It deserves a serious referee to check the hook correctness and see whether the synthetic results hold up on authentic samples.","headline":"The paper integrates symbolic execution with two-level hooks for on-the-fly library preloading to recover more CFG nodes and edges from dynamically loaded code, but the entire evaluation stays on 16 synthetic benchmarks.","tokens_in":2374,"tokens_out":360,"would_cite":false,"duration_ms":13400,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"grok-4.3","headline":"Symbolic execution with library interception recovers 29.8 percent more CFG nodes and 26.5 percent more edges from dynamically loaded code.","keywords":["control flow graph","symbolic execution","dynamic loading","library resolution","malware analysis","obfuscation","binary analysis","static analysis"],"falsifier":"A single binary that uses one of the covered obfuscation methods yet causes the module to either load an incorrect library or omit an edge that dynamic instrumentation later confirms as present.","tokens_in":2687,"feed_emoji":"","tokens_out":693,"duration_ms":16454,"temperature":0.7,"pith_summary":"The paper establishes a method that augments static control flow graph recovery by running symbolic execution while intercepting dynamic library loads and actually preloading the resolved libraries into the analysis state. Custom hooks capture loading operations such as encrypted names or network-triggered paths and feed the real libraries back into the symbolic environment without executing the target code. This resolves indirect calls that static analysis cannot follow. On 16 synthetic benchmarks covering multiple evasion techniques the approach yields the stated average gains in nodes and edges while reporting perfect precision and recall for library identification. All results were cross-checked with separate dynamic instrumentation.","feed_headline":"Symbolic hooks recover 30 percent more CFG nodes from dynamic code","feed_subtitle":"Interception during symbolic execution resolves indirect calls that static analysis leaves open, adding nodes and edges at measured rates.","key_machinery":"Two-level architecture of interception functions and instruction tracking inside the symbolic execution environment that captures dynamic loading calls and performs actual library preloading.","core_discovery":"The module recovers on average 29.8 % additional Control Flow Graph nodes and 26.5 % additional edges compared to static analysis alone, achieves 100 % precision and 100 % recall in library detection, with all discoveries validated through Frida-based dynamic instrumentation. The methodology uses custom software hooks that intercept dynamic loading operations during symbolic execution and perform actual library loading into the analysis state.","pith_inferences":["The same interception pattern could be applied to other dynamic linking formats beyond the ELF cases examined.","Extending the benchmark set to include real-world protected applications would test whether the reported gains hold outside synthetic cases.","Integration with existing symbolic execution frameworks would allow the recovered edges to feed directly into downstream analyses such as taint tracking.","The approach suggests a route for handling fileless execution by preloading libraries whose paths are derived at runtime inside the symbolic state."],"forward_implications":["Control flow graphs for binaries that rely on runtime dynamic linking become more complete than those produced by static analysis alone.","Indirect calls introduced by encrypted names, environment-derived paths, or manual ELF parsing are resolved during analysis.","The entire recovery process remains confined to symbolic execution and therefore does not require running potentially malicious payloads.","Library detection reaches 100 percent precision and recall on the tested set of 16 benchmarks.","Additional CFG nodes and edges are produced at the reported average rates of 29.8 percent and 26.5 percent respectively."],"fun_headline_variants":["Symbolic hooks add 30% more CFG nodes from dynamic loading","Library hooks add 29.8% nodes and 26.5% edges via symbolic exec","Dynamic load hooks achieve 100% library detection precision","Symbolic resolution of dynamic libs adds 29.8% CFG nodes"],"cache_read_input_tokens":2112,"weakest_assumption_plain":"The interception and tracking layers can correctly resolve every listed obfuscation technique without producing false library identifications or missing edges.","fun_headline_variants_meta":{"raw":{"variants":["Symbolic hooks add 30% more CFG nodes from dynamic loading","Library hooks add 29.8% nodes and 26.5% edges via symbolic exec","Dynamic load hooks achieve 100% library detection precision","Symbolic resolution of dynamic libs adds 29.8% CFG nodes"]},"model":"grok-4.3","cost_usd":0.007601,"raw_usage":{"total_tokens":3505,"prompt_tokens":714,"num_sources_used":0,"completion_tokens":75,"cost_in_usd_ticks":76012000,"prompt_tokens_details":{"text_tokens":714,"audio_tokens":0,"image_tokens":0,"cached_tokens":256},"completion_tokens_details":{"audio_tokens":0,"reasoning_tokens":2716,"accepted_prediction_tokens":0,"rejected_prediction_tokens":0}},"tokens_in":714,"tokens_out":75,"duration_ms":20295,"temperature":1.0,"reasoning_tokens":2716,"cache_read_input_tokens":256,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-06-29T06:34:27.214024+00:00","model_set":{"reader":"grok-4.3"},"falsifier":"A single binary that uses one of the covered obfuscation methods yet causes the module to either load an incorrect library or omit an edge that dynamic instrumentation later confirms as present.","supporting_citations":[],"review_version":1}