Pith. sign in

REVIEW 3 major objections 1 minor 18 references

Control Flow Graph Recovery for Dynamically Loaded Code via Symbolic Library Resolution

T0 review · 3 major / 1 minor · reviewed 2026-06-29 · grok-4.3

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Symbolic execution with library interception recovers 29.8 percent more CFG nodes and 26.5 percent more edges from dynamically loaded code.

desk verdict The paper integrates symbolic execution with two-level hooks for on-the-fly library preloading to recover more CFG nodes and edges from dynamically loaded code, but the entire evaluation stays on 16 synthetic benchmarks. read the letter →

arxiv 2605.29620 v1 pith:OQX64UVD submitted 2026-05-28 cs.CR cs.SE

Oleksandr Mostovyi This is my paper · ORCID
classification cs.CRcs.SE
keywords controlflowgraphsymbolicexecutiondynamicloadinglibraryresolutionmalwareanalysisobfuscationbinarystatic
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper establishes a method that augments static control flow graph recovery by running symbolic execution while intercepting dynamic library loads and actually preloading the resolved libraries into the analysis state. Custom hooks capture loading operations such as encrypted names or network-triggered paths and feed the real libraries back into the symbolic environment without executing the target code. This resolves indirect calls that static analysis cannot follow. On 16 synthetic benchmarks covering multiple evasion techniques the approach yields the stated average gains in nodes and edges while reporting perfect precision and recall for library identification. All results were cross-checked with separate dynamic instrumentation.

What carries the argument

Two-level architecture of interception functions and instruction tracking inside the symbolic execution environment that captures dynamic loading calls and performs actual library preloading.

What would settle it

A single binary that uses one of the covered obfuscation methods yet causes the module to either load an incorrect library or omit an edge that dynamic instrumentation later confirms as present.

Watch

Extended reading notes

Core claim

The module recovers on average 29.8 % additional Control Flow Graph nodes and 26.5 % additional edges compared to static analysis alone, achieves 100 % precision and 100 % recall in library detection, with all discoveries validated through Frida-based dynamic instrumentation. The methodology uses custom software hooks that intercept dynamic loading operations during symbolic execution and perform actual library loading into the analysis state.

Load-bearing premise

The interception and tracking layers can correctly resolve every listed obfuscation technique without producing false library identifications or missing edges.

Editorial extensions

If this is right

  • Control flow graphs for binaries that rely on runtime dynamic linking become more complete than those produced by static analysis alone.
  • Indirect calls introduced by encrypted names, environment-derived paths, or manual ELF parsing are resolved during analysis.
  • The entire recovery process remains confined to symbolic execution and therefore does not require running potentially malicious payloads.
  • Library detection reaches 100 percent precision and recall on the tested set of 16 benchmarks.
  • Additional CFG nodes and edges are produced at the reported average rates of 29.8 percent and 26.5 percent respectively.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The same interception pattern could be applied to other dynamic linking formats beyond the ELF cases examined.
  • Extending the benchmark set to include real-world protected applications would test whether the reported gains hold outside synthetic cases.
  • Integration with existing symbolic execution frameworks would allow the recovered edges to feed directly into downstream analyses such as taint tracking.
  • The approach suggests a route for handling fileless execution by preloading libraries whose paths are derived at runtime inside the symbolic state.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

3 major / 1 minor

Summary. The paper proposes a symbolic execution method with speculative library preloading and custom hooks to intercept dynamic loading operations, enabling recovery of more complete control flow graphs (CFGs) from binaries that use runtime dynamic linking for evasion. It describes a two-level architecture storing interception functions and instruction tracking in the symbolic environment, evaluates the approach on 16 synthetic benchmarks covering obfuscations including encrypted names, network-triggered loading, environment-derived paths, multi-stage decryption, fileless execution, and manual ELF parsing, and reports average gains of 29.8% additional CFG nodes and 26.5% additional edges over static analysis alone, with 100% precision and 100% recall in library detection, all validated via Frida-based dynamic instrumentation.

Significance. If the reported gains and perfect detection metrics hold beyond the synthetic setting, the technique would offer a valuable, instrumentation-free approach to CFG recovery for obfuscated code, addressing a practical gap in malware analysis where static methods fail on unresolved indirect calls. The emphasis on symbolic-only execution is a strength for safety when analyzing potentially malicious binaries.

major comments (3)
  1. [Abstract / Evaluation] Abstract / Evaluation: The central quantitative claims (29.8% additional nodes, 26.5% additional edges, 100% precision/recall) rest exclusively on results from 16 synthetic benchmarks; no evaluation on real malware samples or protected software is described, leaving open whether path explosion, incomplete resolution of environment-derived paths, or uncovered manual ELF parsing cases would degrade performance in the target setting.
  2. [Methodology] Methodology: The two-level architecture for interception and tracking is described at a high level but lacks sufficient detail on how it correctly resolves all listed obfuscation techniques (e.g., network-triggered loading or multi-stage decryption) without false library resolutions or missed edges, making it impossible to assess the risk of over-approximation in the symbolic state that could undermine the 100% detection metrics.
  3. [Abstract] Abstract: No error bars, per-obfuscation breakdown, or discussion of potential over-approximation is provided for the reported averages, and the full methodology for symbolic state management during library preloading is absent, weakening the soundness of the quantitative results.
minor comments (1)
  1. [Abstract] Abstract: Minor grammatical issues such as 'experiments results show' (should be 'experimental results show') and 'the module recovers' (should be 'the proposed module recovers') reduce readability.

Simulated Author's Rebuttal

3 responses · 1 unresolved

We thank the referee for the constructive feedback. We address each major comment below, indicating revisions where the manuscript will be updated.

read point-by-point responses

  1. Referee: [Abstract / Evaluation] The central quantitative claims (29.8% additional nodes, 26.5% additional edges, 100% precision/recall) rest exclusively on results from 16 synthetic benchmarks; no evaluation on real malware samples or protected software is described, leaving open whether path explosion, incomplete resolution of environment-derived paths, or uncovered manual ELF parsing cases would degrade performance in the target setting.

    Authors: We agree the evaluation uses only synthetic benchmarks, chosen to enable controlled testing with verifiable ground truth via Frida. Real malware evaluation is absent because obtaining reliable ground truth is difficult. We will add a Limitations section discussing risks such as path explosion and environment-derived paths in real settings. revision: partial

  2. Referee: [Methodology] The two-level architecture for interception and tracking is described at a high level but lacks sufficient detail on how it correctly resolves all listed obfuscation techniques (e.g., network-triggered loading or multi-stage decryption) without false library resolutions or missed edges, making it impossible to assess the risk of over-approximation in the symbolic state that could undermine the 100% detection metrics.

    Authors: The manuscript presents the architecture at a high level for clarity. We will expand the Methodology section with concrete examples of hook behavior for each obfuscation (e.g., symbolic modeling of network inputs and decryption stages) and explicit discussion of safeguards against over-approximation. revision: yes

  3. Referee: [Abstract] No error bars, per-obfuscation breakdown, or discussion of potential over-approximation is provided for the reported averages, and the full methodology for symbolic state management during library preloading is absent, weakening the soundness of the quantitative results.

    Authors: We will update the evaluation section to report per-obfuscation breakdowns and error bars on the averages. We will also add detail on symbolic state management during preloading and a discussion of over-approximation risks to strengthen the soundness claims. revision: yes

standing simulated objections not resolved
  • Evaluation on real malware or protected software samples (no such data exists in the current work)

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity; empirical measurements on synthetic benchmarks

full rationale

The paper describes an engineering technique combining symbolic execution with custom hooks for dynamic library resolution and reports direct experimental measurements (29.8% additional nodes, 26.5% additional edges, 100% precision/recall) on 16 synthetic benchmarks. No equations, fitted parameters, predictions that reduce to inputs, or load-bearing self-citations appear in the abstract or described methodology. Results are presented as observed outcomes validated by Frida, not as derivations that collapse to prior fitted quantities or self-referential definitions. The evaluation design is independent of any internal circular reduction.

Assumptions & free parameters 0 free parameters · 1 assumptions · 0 invented entities

Central claim rests on the domain assumption that symbolic execution can faithfully model dynamic loading calls and that the custom hooks can safely perform actual library loads without side effects or loss of precision.

assumptions (1)
  • domain assumption Symbolic execution accurately models the effects of dynamic library loading operations without requiring concrete execution.
    Invoked when the hooks intercept loading calls and perform actual library loading into the analysis state.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Control Flow Graph Recovery for Dynamically Loaded Code via Symbolic Library Resolution." pith.science (2026). https://pith.science/paper/OQX64UVD

@misc{pith2026260529620,
  author       = {Pith},
  title        = {Pith review of: Control Flow Graph Recovery for Dynamically Loaded Code via Symbolic Library Resolution},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/OQX64UVD}},
  note         = {Machine review of arXiv:2605.29620}
}
read the original abstract

Control Flow Graphs are one of the main data sources for software analysis that use dynamic and static software analysis methods. Protected software and modern malware increasingly depend on dynamic code loading techniques to evade static analysis. Usage of runtime dynamic linking mechanisms introduces unresolved indirect calls that stop static Control Flow Graph recovery. This serves to hide dynamic library that can be used for prevention of security analysis. To address this limitation, an analysis technique is proposed that combines symbolic execution with speculative library preloading to recover Control Flow Graphs from binaries by using dynamic loading. The methodology uses custom software hooks that intercept dynamic loading operations during symbolic execution and perform actual library loading into the analysis state. The module is based on a two-level architecture that stores interception functions and instruction tracking at the same time, all within a symbolic execution environment. To avoid executing potentially malicious code that dynamic instrumentation tools require, the analysis was conducted entirely through symbolic execution, making it safe for malware analysis. For evaluation a batch of 16 synthetic benchmarks was used, employing various obfuscation techniques including encrypted library names, network-triggered loading, environment-derived paths, multi-stage decryption chains, fileless execution and manual executable and linkable format parsing. The experiments results show that module recovers on average 29.8 % additional Control Flow Graph nodes and 26.5 % additional edges compared to static analysis alone, achieves 100 % precision and 100 % recall in library detection, with all discoveries validated through Frida-based dynamic instrumentation.

Figures

Figures reproduced from arXiv: 2605.29620 by the authors.

Figure 5
Figure 5. Algorithm 5 Evaluation Pipeline Both CFGs are generated through the same analysis – the only difference is that the module CFG includes libraries resolved and loaded by our module. The difference between the two graphs directly reflects the module’s [PITH_FULL_IMAGE:figures/full_fig_p004_5.png] view at source ↗

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

18 extracted references · 11 canonical work pages

  1. [1]

    SoK: (State of) The Art of War: Offensive Techniques in Binary Analysis

    Shoshitaishvili Y., Wang R., Salls C., Stephens N., Polino M., Dutcher A., Grosen J., Feng S., Hauser C., Kruegel C., Vigna G. SoK: (State of) The Art of War: Offensive Techniques in Binary Analysis. IEEE Symposium on Security and Privacy (S&P). 2016, pp. 138–157. DOI: 10.1109/SP.2016.17

    work page doi:10.1109/sp.2016.17 2016

  2. [2]

    Control-Flow Integrity Principles, Implementations, and Applications

    Abadi M. Control-Flow Integrity Principles, Implementations, and Applications. ACM Transactions on Information and System Security (TISSEC). 2009, vol. 13, no. 1, pp. 1–40. DOI: 10.1145/1609956.1609960

    work page doi:10.1145/1609956.1609960 2009

  3. [3]

    Control Flow Integrity for COTS Binaries

    Zhang M., Sekar R. Control Flow Integrity for COTS Binaries. USENIX Security Symposium. 2013, pp. 337–352

    2013

  4. [4]

    Ramblr: Making Reassembly Great Again

    Wang R., Shoshitaishvili Y., Bianchi A., Machiry A., Grosen J., Grosen P., Kruegel C., Vigna G. Ramblr: Making Reassembly Great Again. Network and Distributed System Security Symposium (NDSS)

  5. [5]

    DOI: 10.14722/NDSS.2017.23225

    work page doi:10.14722/ndss.2017.23225 2017

  6. [6]

    Learning to Evade Static PE Machine Learning Malware Models via Reinforcement Learning

    Anderson, H. S., Kharkar, A., Filar, B., Evans, D. and Roth, P. Learning to Evade Static PE Machine Learning Malware Models via Reinforcement Learning. arXiv preprint, arXiv:1801.08917. 2018. DOI: 10.48550/arXiv.1801.08917

    work page Pith review arXiv doi:10.48550/arxiv.1801.08917 2018

  7. [7]

    Cross- Architecture Bug Search in Binary Executables

    Pewny J., Garmany B., Gawlik R., Rossow C., Holz T. Cross- Architecture Bug Search in Binary Executables. IEEE Symposium on Security and Privacy (S&P). 2015, pp. 709–724. DOI: 10.1109/SP.2015.49

    work page doi:10.1109/sp.2015.49 2015

  8. [8]

    IDA Pro: The Interactive Disassembler

    Hex-Rays. IDA Pro: The Interactive Disassembler. 2024. Available at: https://hex-rays.com/ida-pro/ (accessed 30.11.2025)

    2024

Show all 18 references
  1. [9]

    Ghidra: A Software Reverse Engineering Framework

    National Security Agency. Ghidra: A Software Reverse Engineering Framework. 2019. Available at: https://ghidra-sre.org/ (accessed 30.11.2025)

    2019

  2. [10]

    J., Hazelwood K

    Luk C., Cohn R., Muth R., Patil H., Klauser A., Lowney G., Wallace S., Reddi V. J., Hazelwood K. Pin: Building Customized Program Analysis Tools with Dynamic Instrumentation. ACM SIGPLAN Conference on Programming Language Design and Implementation (PLDI). 2005, pp. 190–200. DO...

    2005 doi

  3. [11]

    Oleavy O. A. Frida: A World-Class Dynamic Instrumentation Framework. 2013. Available at: https://frida.re (accessed 30.11.2025)

    2013

  4. [12]

    S2E: A Platform for In-Vivo Multi-Path Analysis of Software Systems

    Chipounov V., Kuznetsov V., Candea G. S2E: A Platform for In-Vivo Multi-Path Analysis of Software Systems. International Conference on Architectural Support for Programming Languages and Operating Systems (ASPLOS). 2011, pp. 265–278. DOI: 10.1145/1950365.1950396

    2011 doi

  5. [13]

    IEEE Standard for Information Technology-Portable Operating System Interface (POSIX®) Base Specifications, Issue 7

    IEEE. IEEE Standard for Information Technology-Portable Operating System Interface (POSIX®) Base Specifications, Issue 7. IEEE Std 1003.1-2017. IEEE/The Open Group, 2018. DOI: 10.1109/IEEESTD.2018.8277153

    2017 doi

  6. [14]

    TIS Committee, 1995

    Tool Interface Standard (TIS) Executable and Linking Format (ELF) Specification, Version 1.2. TIS Committee, 1995. 83 p

    1995

  7. [15]

    Z3: An Efficient SMT Solver

    De Moura L., Bjørner N. Z3: An Efficient SMT Solver. International Conference on Tools and Algorithms for the Construction and Analysis of Systems (TACAS). Springer, 2008, pp. 337–340. DOI: 10.1007/978-3-540-78800-3_24

    2008 doi

  8. [16]

    Valgrind: A Framework for Heavyweight Dynamic Binary Instrumentation

    Nethercote N., Seward J. Valgrind: A Framework for Heavyweight Dynamic Binary Instrumentation. ACM SIGPLAN Conference on Programming Language Design and Implementation (PLDI). ACM, 2007, pp. 89 –100. DOI: 10.1145/1250734.1250746

    2007 doi

  9. [17]

    The Geometry of Innocent Flesh on the Bone: Return- into-libc without Function Calls (on the x86)

    Shacham H. The Geometry of Innocent Flesh on the Bone: Return- into-libc without Function Calls (on the x86). ACM Conference on Computer and Communications Security (CCS). ACM, 2007, pp. 552–561. DOI: 10.1145/1315245.1315313

    2007 doi

  10. [18]

    Received 02.03.2026 Accepted 01.04.2026 Published 20.05.2026 УДК 004.415:004.423 О

    Mostovyi O., DynPathResolver: Source Code and Experiment Available at: https://github.com/smander/dynpathresolver (accessed 31.02 .2026). Received 02.03.2026 Accepted 01.04.2026 Published 20.05.2026 УДК 004.415:004.423 О. С. МОСТОВИЙ, аспірант, відділ теорії цифрових автоматів...

    2026

Pith tools

Reviewed June 29, 2026 · model on record in the stance chip above.