Precise system-wide concatic malware unpacking

David Korczynski

REVIEW 3 major objections 5 minor 1 cited by

Precise system-wide concatic malware unpacking

T0 review · 3 major / 5 minor · reviewed 2026-08-14 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Minerva claims that taint-based execution waves recover packed malware code and its external dependencies with enough precision for static analysis, outperforming current unpackers on system-wide packing.

desk verdict Minerva is a real step forward for system-wide unpacking with genuinely new wave semantics and PE reconstruction, but the evaluation's single black-box baseline and the unaddressed implicit-flow gap keep it from being fully convincing. read the letter →

arxiv 1908.09204 v1 pith:VPAYOAO3 submitted 2019-08-24 cs.CR

David Korczynski This is my paper · ORCID

classification cs.CR

keywords malwareunpackingdynamictaintanalysisexecutionwavesimportaddresstablereconstructionsystem-wideruntimepackingcodeinjectionPEfile

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Minerva is an automatic malware unpacker that tries to solve the two hard parts of unpacking at once: recovering dynamically generated code no matter which process wrote it, and reconstructing executable files that reveal the malware's external dependencies. Its central claim is that a system-wide dynamic taint trace, partitioned into per-process execution waves, captures every layer of packed malicious code even when benign OS code performs the writes, and that static reconstruction from those waves yields PE files with import tables and patched API calls suitable for off-the-shelf analysis. If this is right, unpacking stops being a memory-dump heuristic and becomes a recoverable intermediate representation connecting dynamic behavior to static code, with direct use in reverse engineering and malware triage.

What carries the argument

The central machinery is the malware execution trace, defined as the set of instructions whose operands or address are tainted, and the execution-wave partition maintained by the paper's wave-collection algorithm. A wave is carried by a shadow memory of tainted bytes and a set of tainted writes; when an executing instruction's address is in the tainted writes but not in the current shadow memory, a new wave starts and the old wave is dumped. This handles shared-memory transfers, code injection into other processes, and dynamically generated code written by benign code, because taint follows the data, not the writer. The second half of the machinery is dependency capture: every branch destination in the malware trace is checked against the per-process export table, and the resulting API-call log is merged into reconstructed PE files by patching six-byte branch instructions and rebuilding the import address table. Related memory dumps are grouped into sections by speculative disassembly, so the final PE files are self-contained and keep the virtual addresses of the dumped memory.

What would settle it

Run a sample where malicious code is generated by an implicit flow, for example a tainted value that selects a branch or indexes a table without the tainted byte being moved, and check whether Minerva's wave dumps include the generated executable bytes; if an executed instruction is missing from the malware trace, the taint model is incomplete.

Watch

Extended reading notes

Core claim

The paper claims that information-flow-based 'execution waves' should replace the write-then-execute heuristic. An execution wave is a process-level sequence of instructions whose memory is tainted, together with the tainted memory itself, and waves are delimited whenever execution reaches freshly written tainted memory that is not in the current wave's shadow memory. Because taint propagates through benign and malicious instructions alike, a wave can contain code that was written by an OS API, by another process, or by a code-reuse gadget, not only by the malware's own instructions. The paper further claims that recording every branch destination in the malware trace and matching it against loaded module exports gives exact API-call attribution per wave, which makes it possible to build new PE files whose import address table is valid and whose API calls are patched even when the original malware used a custom loader or obfuscated the call instruction. Empirical comparison against a state-of-the-art unpacker shows the baseline over-approximates API calls roughly 200x on synthetic samples and fails to detect multi-process unpacking, while Minerva recovers the expected calls and imports.

Load-bearing premise

Everything downstream assumes the dynamic taint engine tracks every information flow that carries malware-generated bytes and no more; if taint misses an implicit flow or spreads to benign memory, the execution waves and reconstructed files lose their precision.

Editorial extensions

If this is right

Packed samples that inject code into benign processes can be unpacked without requiring the malware's own instructions to perform the memory writes.
The output PE files expose external dependencies, so follow-up analysis can identify behavior, such as injection APIs, without first reversing a custom import resolution routine.
API-call counts and unique-API sets reported by an unpacker become trustworthy, since calls are attributed to tainted instructions rather than to the whole process.
New ground-truth benchmarks for unpacking become possible, because the paper's benchmark samples combine code injection, dynamic code generation, and import-address-table destruction in known configurations.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

Editorial inference: because wave boundaries are defined by taint propagation, a natural next test is to add implicit-flow tracking and check whether new waves appear for malware that transfers control through addresses computed from tainted values without moving tainted bytes.
Editorial inference: the performance findings suggest a practical extension in which replay detects stalling loops and skips or summarizes them; a testable claim is that this would reduce the reported slowdown without losing wave content.
Editorial inference: the same wave abstraction could be applied to non-PE targets, such as firmware or script-based packers, although the paper only demonstrates Windows PE reconstruction.

Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Worth a read if you work on unpacking or dynamic taint analysis applied to malware. The core idea is to replace the write-then-execute heuristic with whole-system taint: an execution wave is the set of instructions whose memory is tainted, and the tool then reconstructs PE files with import address tables and patched API calls. The wave semantics are clearly defined in Definitions 1-3, and the post-processing pipeline is genuinely new: grouping related memory pages, building IATs, and patching call sites. This goes beyond the author's earlier Tartarus, which simply dumped tainted memory. The new synthetic benchmark suite (Table 2) is a real contribution; it gives ground truth and is easy to reason about, exactly what the area lacks.

The case studies, especially the Tinba one, show the tool working on real samples in a way that is concrete and plausible. I believe the central mechanism works as described for the cases tested.

Soft spots, in order of severity. First, the comparative evaluation only pits Minerva against PackerInspector, a black-box web service that runs on Windows XP while Minerva runs on Windows 7. The author acknowledges this, but it still means the headline precision gain is a cross-environment comparison with no baseline against Tartarus or RePEconstruct, the author's own closest systems. The reader's conditional accept is right: a controlled comparison or an artifact release would settle this. Second, the taint model only tracks explicit data-flow; there is no implicit-flow handling. The stress-test note is correct about the gap: if benign code uses tainted values as a branch condition to decide which bytes to write, those writes will not be tainted and the generated code will be missed. This does qualify the Section 4.2 claim that execution waves capture dynamically generated code independent of who wrote the code. In practice, most real unpacking payloads are written through explicit data-dependent operations, so I see this as a limitation to document rather than a fatal flaw, but the paper is silent on it. Third, the performance evaluation is single-environment and the distribution tables (5-9) are hard to interpret without per-sample ground truth.

Overall, the design is plausible, the formalization is a genuine advance for the subfield, and the negative results against PackerInspector are believable. The main work for a revision is an honest comparison to the author's own prior systems and a paragraph on implicit flows and taint precision. The paper deserves a serious referee.

Referee Report

3 major / 5 minor

Summary. The paper presents Minerva, an automatic malware-unpacking system that combines full-system dynamic taint analysis (built on PANDA) with static reconstruction of PE files. The system defines a "malware execution trace" as the set of instructions whose memory is tainted (Definition 1, Algorithm 1), partitions this trace into per-process "execution waves" based on information-flow analysis (Section 4), collects API calls made by tainted instructions and maps them to waves (Section 5), and then statically merges memory dumps, rebuilds import address tables, and patches branch calls to produce PE files (Section 6). The evaluation uses a new self-authored synthetic benchmark suite, selected malware families (CryptoWall, Tinba, Gapz, Ramnit), 13 public packers, and 119 real-world malware samples. The paper compares Minerva against PackerInspector (Ugarte et al.) as a black-box baseline and claims that Minerva is significantly more precise than previous work, particularly for system-wide unpacking and for exposing API dependencies in unpacked code.

Significance. If the central claims hold, Minerva would be a useful contribution to malware analysis: it formalizes a wave-based model of dynamically generated code, addresses system-wide unpacking through taint propagation, and produces PE files with reconstructed IATs that are suitable for follow-up static analysis. The paper's strengths include the explicit formal model of execution waves, the design of a benchmark suite with synthetic ground-truth samples, and the implementation of the full pipeline on PANDA with reproducible machine-checked trace and output artifacts. However, the significance is weakened by two fundamental concerns: (1) the taint model appears to handle only explicit flows, so the claim of capturing malicious code generated via benign code is not fully supported; and (2) the comparative evaluation rests on a single black-box baseline running on a different OS, with no comparison to the author's closest prior system (Tartarus), making the "significantly more precise than previous work" claim under-evidenced.

major comments (3)

[Section 3.3, Algorithm 2; Section 4.2] The central claim that execution waves "capture dynamically generated code independent of who wrote the code" (Section 4.2) is not supported for implicit information flows. Algorithm 2 (lines 3-5) taints only the explicit outputs of instructions in the malware execution trace, and no mechanism for propagating taint along control dependencies is described. Consequently, if benign code uses tainted malware data as a branch condition that determines which bytes are written to executable memory, the writing instruction is not tainted and its output is not tainted, so the generated code would be missed by the wave collector. The synthetic benchmarks in Table 2 (D1-D4, C1-C5, M1) all generate code through explicit data-flow paths; none exercises an implicit-flow scenario. Since the paper's precision and generality claims depend on the taint set exactly capturing all dynamically generated malicious code, this limitation should be addressed either by implementing implicit-flow tracking or by explicitly restricting the claim to explicit data flows and discussing the consequences of the restriction.
[Section 7.4, Tables 3 and 4; Section 7 introduction] The comparative evaluation that supports the main claim of being "significantly more precise than previous work" is based on a single baseline, PackerInspector, which is accessed as a black-box web service and runs on a different OS (Windows XP, inferred by the authors) than Minerva (Windows 7). The authors acknowledge this environment mismatch in Section 7.4 but still draw strong comparative conclusions. More importantly, Minerva is a direct extension of Tartarus [29], which the paper identifies as the closest prior work, yet no comparison to Tartarus is included. Without a side-by-side evaluation against Tartarus (or a reimplementation) under the same conditions and on the same ground-truth benchmarks, the magnitude and source of the precision improvement over prior art are not established. The authors should either provide such a comparison or substantially temper the comparative claims.
[Section 4.1, Definition 3; Section 4.2, Algorithm 1] There appears to be an internal tension between the formal wave definition and the wave-collection algorithm. Definition 3's second bullet enforces a strict ordering of all instructions between waves, and the text states this "preclude[s] instructions from any given execution wave to be used in any other execution wave." However, Section 4.2 case (1) describes the situation where "code from the current wave transfers execution to code that is part of an earlier wave," and the algorithm then appends that instruction to the current wave. If an instruction address from an earlier wave is executed again in a later wave, the claim of preclusion is either incorrect or relies on an implicit distinction between instruction instances and addresses; this distinction is not made explicit. The authors should clarify how the formal definition and the algorithm reconcile repeated execution of the same address across waves.

minor comments (5)

[Title] The word "concatic" in the title appears to be a typo for "concatenative" or "concolic"; please correct it.
[Section 7.5] The text reads "in order to ensure the samples are indeed benign," which should say "malicious" given the preceding discussion of anti-malware vendor detection.
[Table 10] The row for "WinUpack" contains an out-of-place character "w" in the #PE column; this looks like a typographical error that should be fixed.
[Section 8] The limitations section does not mention the implicit-flow limitation of the taint model, despite it being a core threat to the generality claim; this should be added.
[Section 7.5, Tables 5-9] The real-world evaluation reports only aggregate distributions (e.g., 66%, 15%, 9%, 5%, 5% for process counts) without per-sample counts or a description of how these metrics were computed; including per-sample data or a scatterplot would improve reproducibility and interpretability.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: Minerva's construction is an algorithmic design, and its claims are empirically evaluated against ground-truth samples and an external baseline, not derived from fitted inputs or self-cited uniqueness theorems.

full rationale

Minerva does not perform any parameter fitting or predictive modeling in the classic sense: its input is a malware binary, its malware execution trace is defined through taint inclusion (Definition 1, Algorithms 1 and 2), and its execution waves are defined as a partition of that trace (Definition 3). The statement that execution waves capture dynamically generated code independent of who wrote the code follows from the taint propagation design (Section 4.2) rather than from reusing the output as an input; it is a stated algorithmic property, and the paper checks it against ground-truth synthetic samples and real-world malware. The tracing component is attributed to the author's prior Tartarus work [29] and is summarized in Algorithms 1 and 2, so this is a normal implementation-level self-citation, not a load-bearing appeal to an unverified external theorem. The comparison to PackerInspector is empirical and not forced by construction. The main scientific risk, already noted by the skeptical reviewer, is whether the taint model handles implicit flows soundly; that is a correctness or soundness limitation of the underlying dynamic analysis, not a circular derivation. The paper's stronger conclusions about general superiority over previous work rest on a limited baseline comparison, but that is a scope/evidence concern, not a circularity concern.

Assumptions & free parameters 5 free parameters · 4 assumptions · 0 invented entities

The central claims rest on empirical assumptions about taint analysis, wave boundaries, and evaluation cutoffs rather than on fitted physical parameters. The paper introduces no new physical entities; 'execution waves' is an analytical abstraction whose usefulness is measured only by the paper's own evaluation.

free parameters (5)

Recording window = 25 seconds
Each sample was recorded for 25 seconds; unpacking stages after that cutoff are missed, so the reported wave and PE-file distributions depend on this choice. Stated in Section 7.2.
Max replay time = 120 minutes
Replay was capped at 120 minutes, which can truncate samples with long stalling loops, as acknowledged in Section 7.8 and Section 8.
AV vendor detection threshold = at least 15 vendors
Benchmark set #4 only includes samples detected by at least 15 anti-malware vendors, which shapes the dataset and excludes less detected malware. Stated in Section 7.
Family label threshold = at least 2 vendors
Samples required at least two vendors to agree on the same family label, affecting the ground-truth family assignment for real-world samples. Stated in Section 7.
Samples per family = 7
Seven samples per family were collected to keep the real-world dataset balanced; the resulting family distribution is a chosen evaluation design, not an external standard.

assumptions (4)

domain assumption Dynamic taint propagation in PANDA, as modified, accurately models all relevant explicit information flows for x86 instructions in the Windows 7 guest.
The malware execution trace is defined as exactly the instructions whose memory is tainted, per Section 3.3 and Algorithm 1 lines 7-8. Any missed or spurious taint directly corrupts wave extraction, API attribution, and PE reconstruction.
domain assumption The first instruction executed in the replay is the entry point of the malware sample.
Initial taint is applied to the malware module under this assumption, per Section 3.3 and Algorithm 1 line 1. If another process executes first, the taint seed is wrong and the entire trace is mislabeled.
domain assumption A new execution wave is correctly triggered whenever an instruction executes tainted memory not present in the current wave's shadow memory, or whose contents changed since the wave started.
This is the paper's wave boundary rule, described in Section 4.2 and Algorithm 1 cases 2 and 3. The PE reconstruction pipeline depends on these boundaries matching real unpacking stages.
domain assumption The 25-second recording window exposes all relevant unpacking behavior of each sample.
Samples that unpack or inject later are only partially captured, as the authors acknowledge in Section 8. The distributions in Tables 5 through 9 are conditional on this cutoff.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Precise system-wide concatic malware unpacking." pith.science (2026). https://pith.science/paper/VPAYOAO3

@misc{pith2026190809204,
  author       = {Pith},
  title        = {Pith review of: Precise system-wide concatic malware unpacking},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/VPAYOAO3}},
  note         = {Machine review of arXiv:1908.09204}
}

read the original abstract

Run time packing is a common approach malware use to obfuscate their payloads, and automatic unpacking is, therefore, highly relevant. The problem has received much attention, and so far, solutions based on dynamic analysis have been the most successful. Nevertheless, existing solutions lack in several areas, both conceptually and architecturally, because they focus on a limited part of the unpacking problem. These limitations significantly impact their applicability, and current unpackers have, therefore, experienced limited adoption. In this paper, we introduce a new tool, called Minerva, for effective automatic unpacking of malware samples. Minerva introduces a unified approach to precisely uncover execution waves in a packed malware sample and produce PE files that are well-suited for follow-up static analysis. At the core, Minerva deploys a novel information flow model of system-wide dynamically generated code, precise collection of API calls and a new approach for merging execution waves and API calls. Together, these novelties amplify the generality and precision of automatic unpacking and make the output of Minerva highly usable. We extensively evaluate Minerva against synthetic and real-world malware samples and show that our techniques significantly improve on several aspects compared to previous work.

Figures

Figures reproduced from arXiv: 1908.09204 by the authors.

**Figure 2.** e output of unpackers when being matched with [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗

**Figure 3.** First, we use the dynamic analysis in Minerva to precisely [PITH_FULL_IMAGE:figures/full_fig_p004_3.png] view at source ↗

Figures from the paper (4 more)

**Figure 4.** Figure 4: e process of identifying which tainted pages from dynamic analysis that are relevant when reconstructing un [PITH_FULL_IMAGE:figures/full_fig_p009_4.png]

**Figure 5.** Figure 5: e average number and standard deviation of in [PITH_FULL_IMAGE:figures/full_fig_p013_5.png]

**Figure 6.** Figure 6: e amount of instructions needed to replay the [PITH_FULL_IMAGE:figures/full_fig_p014_6.png]

**Figure 7.** Figure 7: e time taken to explore the unique instructions [PITH_FULL_IMAGE:figures/full_fig_p014_7.png]

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

A characterisation of system-wide propagation in the malware landscape
cs.CR 2019-08 conditional novelty 6.0 of 10

A large-scale dynamic analysis of 650 malware samples finds that system-wide, multi-process propagation is common (23% of samples), diverse (33 injection signatures), and has not increased in prevalence from 2012 to 2018.

Reference graph

Works this paper leans on

48 extracted references · 27 canonical work pages · cited by 1 Pith paper

[29]

David Korczynski and Heng Yin. 2017. Capturing Malware Propagations with Code Injections and Code-Reuse A/t_tacks. InProceedings of the 2017 ACM SIGSAC 16 Conference on Computer and Communications Security, CCS 2017, Dallas, TX, USA, October 30 - November 03, 2017 , Bhavani M. /T_huraisingham, David Evans, Tal Malkin, and Dongyan Xu (Eds.). ACM, 1691–1708...

arXiv 2017
[1]

Andrei Bacs, Remco Vermeulen, Asia Slowinska, and Herbert Bos. 2013. System- Level Support for Intrusion Recovery. In Detection of Intrusions and Malware, and Vulnerability Assessment, Ulrich Flegel, Evangelos Markatos, and William Robertson (Eds.). Springer Berlin Heidelberg, Berlin, Heidelberg, 144–163

2013
[2]

Balakrishnan, T

G. Balakrishnan, T. Reps, D. Melski, and T. Teitelbaum. 2008. WYSINWYX: What You See Is Not What You eXecute . Springer Berlin Heidelberg, Berlin, Heidelberg, 202–213. h/t_tps://doi.org/10.1007/978-3-540-69149-5 22

doi:10.1007/978-3-540-69149-5 2008
[3]

Tiﬀany Bao, Jonathan Burket, Maverick Woo, Rafael Turner, and David Brumley

work page
[4]

/T_homas Barabosch, Niklas Bergmann, Adrian Dombeck, and Elmar Padilla. 2017. /Q_uincy: Detecting Host-Based Code Injection A/t_tacks in Memory Dumps. In Detection of Intrusions and Malware, and Vulnerability Assessment , Michalis Poly- chronakis and Michael Meier (Eds.). Springer International Publishing, Cham, 209–229

work page 2017
[5]

/T_homas Barabosch, Sebastian Eschweiler, and Elmar Gerhards-Padilla. 2014. Bee Master: Detecting Host-Based Code Injection A/t_tacks. InDetection of Intru- sions and Malware, and Vulnerability Assessment , Sven Dietrich (Ed.). Springer International Publishing, Cham, 235–254

work page 2014
[6]

Guillaume Bonfante, Jose Fernandez, Jean-Yves Marion, Benjamin Rouxel, Fab- rice Sabatier, and Aur ´elien /T_hierry. 2015. CoDisasm: Medium Scale Con- catic Disassembly of Self-Modifying Binaries with Overlapping Instructions. In Proceedings of the 22Nd ACM SIGSAC Conference on Computer and Com- munications Security (CCS ’15) . ACM, New York, NY, USA, 745...

arXiv 2015
[7]

Erik Bosman, Asia Slowinska, and Herbert Bos. 2011. Minemu: /T_he World’s Fastest Taint Tracker. InProceedings of the 14th International Conference on Recent Advances in Intrusion Detection (RAID’11). Springer-Verlag, Berlin, Heidelberg, 1–20. h/t_tps://doi.org/10.1007/978-3-642-23644-0 1

work page doi:10.1007/978-3-642-23644-0 2011

Show all 48 references

[8]

Jim Chow, Tal Gar/f_inkel, and Peter M. Chen. 2008. Decoupling Dynamic Pro- gram Analysis from Execution in Virtual Environments. In USENIX 2008 Annual Technical Conference (ATC’08). USENIX Association, Berkeley, CA, USA, 1–14. h/t_tp://dl.acm.org/citation.cfm?id=1404014.1404015

2008
[9]

John Gough

Cristina Cifuentes and K. John Gough. 1995. Decompilation of Binary Pro- grams. So/f_tw. Pract. Exper.25, 7 (July 1995), 811–829. h/t_tps://doi.org/10.1002/ spe.4380250706

1995
[10]

Artem Dinaburg, Paul Royal, Monirul Sharif, and Wenke Lee. 2008. Ether: Malware Analysis via Hardware Virtualization Extensions. In Proceedings of the 15th ACM Conference on Computer and Communications Security (CCS ’08). ACM, New York, NY, USA, 51–62. h/t_tps://doi.org/10.114...

2008
[11]

Brendan Dolan-Gavi/t_t, Josh Hodosh, Patrick Hulin, Tim Leek, and Ryan Whelan
[12]

/T_homas Dullien and Rolf Rolles. 2005. Graph-based comparison of executable objects (english version). SSTIC 5 (01 2005)

2005
[13]

Mike Van Emmerik. 1994. Signatures for Library Functions in Executable Files

1994
[14]

Halvar Flake. 2004. Structural Comparison of Executable Objects. In Detection of Intrusions and Malware & Vulnerability Assessment, GI SIG SIDAR Workshop, DIMV A 2004, Dortmund, Germany, July 6.7, 2004, Proceedings . 161–173. h/t_tp: //subs.emis.de/LNI/Proceedings/Proceedings4...

2004
[15]

Fanglu Guo, Peter Ferrie, and Tzi-cker Chiueh. 2008. A Study of the Packer Problem and Its Solutions. In Recent Advances in Intrusion Detection , Richard Lippmann, Engin Kirda, and Ari Trachtenberg (Eds.). Springer Berlin Heidelberg, Berlin, Heidelberg, 98–115

2008
[16]

Andrew Henderson, Lok-Kwong Yan, Xunchao Hu, Aravind Prakash, Heng Yin, and Stephen McCamant. 2017. DECAF: A Platform-Neutral Whole-System Dynamic Binary Analysis Platform. IEEE Trans. So/f_tw. Eng.43, 2 (Feb. 2017), 164–184. h/t_tps://doi.org/10.1109/TSE.2016.2589242

2017
[17]

Xin Hu, Sandeep Bhatkar, Kent Griﬃn, and Kang G. Shin. 2013. MutantX-S: Scalable Malware Clustering Based on Static Features. In Proceedings of the 2013 USENIX Conference on Annual Technical Conference (USENIX ATC’13). USENIX Association, Berkeley, CA, USA, 187–198. h/t_tp://d...

2013
[18]

/T_homas Hungenberg and Ma/t_thias Eckert. 2018. h/t_tp://www.inetsim.org/

2018
[19]

Ispoglou and Mathias Payer

Kyriakos K. Ispoglou and Mathias Payer. 2016. malWASH: Washing Malware to Evade Dynamic Analysis. In 10th USENIX Workshop on Oﬀensive Technolo- gies (WOOT 16) . USENIX Association, Austin, TX. h/t_tps://www.usenix.org/ conference/woot16/workshop-program/presentation/ispoglou

2016
[20]

Jacobson, Nathan Rosenblum, and Barton P

Emily R. Jacobson, Nathan Rosenblum, and Barton P. Miller. 2011. Labeling Library Functions in Stripped Binaries. In Proceedings of the 10th ACM SIGPLAN- SIGSOFT Workshop on Program Analysis for So/f_tware Tools (PASTE ’11). ACM, New York, NY, USA, 1–8. h/t_tps://doi.org/10.11...

2011
[21]

S´ebastien Josse. 2007. Secure and advanced unpacking using computer emulation. Journal in Computer Virology 3, 3 (01 Aug 2007), 221–236. h/t_tps://doi.org/10. 1007/s11416-007-0046-0

2007
[22]

S. Josse. 2014. Malware Dynamic Recompilation. In2014 47th Hawaii International Conference on System Sciences . 5080–5089. h/t_tps://doi.org/10.1109/HICSS.2014. 624

2014 doi
[23]

Min Gyung Kang, Pongsin Poosankam, and Heng Yin. 2007. Renovo: A Hidden Code Extractor for Packed Executables. In Proceedings of the 2007 ACM Workshop on Recurring Malcode (WORM ’07). ACM, New York, NY, USA, 46–53. h/t_tps: //doi.org/10.1145/1314389.1314399

2007
[24]

Yuhei Kawakoya, Makoto Iwamura, and Jun Miyoshi. 2018. Taint-assisted IAT Reconstruction against Position Obfuscation. JIP 26 (2018), 813–824. h/t_tps: //doi.org/10.2197/ipsjjip.26.813

2018 doi
[25]

Yuhei Kawakoya, Eitaro Shioji, Makoto Iwamura, and Jun Miyoshi. 2019. API Chaser: Taint-Assisted Sandbox for Evasive Malware Analysis. Journal of Infor- mation Processing 27 (2019), 297–314. h/t_tps://doi.org/10.2197/ipsjjip.27.297

2019 doi
[26]

Johannes Kinder and Helmut Veith. 2008. Jakstab: A Static Analysis Platform for Binaries. In Proceedings of the 20th International Conference on Computer Aided Veri/f_ication (CA V ’08). Springer-Verlag, Berlin, Heidelberg, 423–427. h/t_tps: //doi.org/10.1007/978-3-540-70545-1 40

2008 doi
[27]

Clemens Kolbitsch, Engin Kirda, and Christopher Kruegel. 2011. /T_he Power of Procrastination: Detection and Mitigation of Execution-stalling Malicious Code. In Proceedings of the 18th ACM Conference on Computer and Communications Security (CCS ’11). ACM, New York, NY, USA, 28...

2011
[28]

David Korczynski. 2016. RePEconstruct: reconstructing binaries with self- modifying code and import address table destruction. In IEEE 11th Interna- tional Conference on Malicious and Unwanted So/f_tware, MALW ARE 2016, Fa- jardo, PR, USA, October 18-21, 2016 . IEEE Computer S...

2016
[30]

Christopher Kruegel, Engin Kirda, Darren Mutz, William Robertson, and Gio- vanni Vigna. 2006. Polymorphic Worm Detection Using Structural Information of Executables. In Proceedings of the 8th International Conference on Recent Advances in Intrusion Detection (RAID’05). Springe...

2006 doi
[31]

Christopher Kruegel, William Robertson, Fredrik Valeur, and Giovanni Vigna
[32]

Yujia Li, Chenjie Gu, /T_homas Dullien, Oriol Vinyals, and Pushmeet Kohli. 2019. Graph Matching Networks for Learning the Similarity of Graph Structured Objects. h/t_tps://openreview.net/forum?id=S1xiOjC9F7

2019
[33]

Martignoni, M

L. Martignoni, M. Christodorescu, and S. Jha. 2007. OmniUnpack: Fast, Generic, and Safe Unpacking of Malware. In Twenty-/T_hird Annual Computer Security Applications Conference (ACSAC 2007). 431–441. h/t_tps://doi.org/10.1109/ACSAC. 2007.15

2007 doi
[34]

Mario Polino, Andrea Continella, Sebastiano Mariani, Stefano D’Alessio, Lorenzo Fontana, Fabio Gri/t_ti, and Stefano Zanero. 2017. Measuring and Defeating Anti- Instrumentation-Equipped Malware. In Detection of Intrusions and Malware, and Vulnerability Assessment, Michalis Pol...

2017
[35]

Georgios Portokalidis, Asia Slowinska, and Herbert Bos. 2006. Argos: an Emula- tor for Fingerprinting Zero-Day A/t_tacks. InProc. ACM SIGOPS EUROSYS’2006. Leuven, Belgium

2006
[36]

Symantec Security Response. 2015. W32.Ramnit analysis

2015
[37]

Rosenblum, Xiaojin Zhu, Barton P

Nathan E. Rosenblum, Xiaojin Zhu, Barton P. Miller, and Karen Hunt. 2008. Learning to Analyze Binary Computer Code. In Proceedings of the Twenty-/T_hird AAAI Conference on Arti/f_icial Intelligence, AAAI 2008, Chicago, Illinois, USA, July 13-17, 2008. 798–804. h/t_tp://www.aaa...

2008
[38]

Paul Royal, Mitch Halpin, David Dagon, Robert Edmonds, and Wenke Lee. 2006. PolyUnpack: Automating the Hidden-Code Extraction of Unpack-Executing Malware. In Proceedings of the 22Nd Annual Computer Security Applications Conference (ACSAC ’06). IEEE Computer Society, Washington...

2006 doi
[39]

Monirul Sharif, Vinod Yegneswaran, Hassen Saidi, Phillip Porras, and Wenke Lee
[40]

Sites, Anton Chernoﬀ, Ma/t_thew B

Richard L. Sites, Anton Chernoﬀ, Ma/t_thew B. Kirk, Maurice P. Marks, and Sco/t_t G. Robinson. 1993. Binary Translation. Commun. ACM 36, 2 (Feb. 1993), 69–81. h/t_tps://doi.org/10.1145/151220.151227

1993
[41]

Wei Song, Heng Yin, Chang Liu, and Dawn Song. 2018. DeepMem: Learning Graph Neural Network Models for Fast and Robust Memory Forensic Analysis. In Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security, CCS 2018, Toronto, ON, Canada, October 15-1...

2018
[42]

Xabier Ugarte-pedrero, Davide Balzaro/t_ti, Igor Santos, and Pablo G. Bringas. [n.d.]. SoK: Deep Packer Inspection: A Longitudinal Study of the Complexity of Run-Time Packers
[43]

Heng Yin, Dawn Song, Manuel Egele, Christopher Kruegel, and Engin Kirda
[2004]

InProceedings of the 13th Confer- ence on USENIX Security Symposium - Volume 13 (SSYM’04)

Static Disassembly of Obfuscated Binaries. InProceedings of the 13th Confer- ence on USENIX Security Symposium - Volume 13 (SSYM’04). USENIX Association, Berkeley, CA, USA, 18–18. h/t_tp://dl.acm.org/citation.cfm?id=1251375.1251393
[2007]

In Proceedings of the 14th ACM Conference on Computer and Communications Security (CCS ’07)

Panorama: Capturing System-wide Information Flow for Malware De- tection and Analysis. In Proceedings of the 14th ACM Conference on Computer and Communications Security (CCS ’07) . ACM, New York, NY, USA, 116–127. h/t_tps://doi.org/10.1145/1315245.1315261 17
[2008]

In Computer Security - ESORICS 2008 , Sushil Jajodia and Javier Lopez (Eds.)

Eureka: A Framework for Enabling Static Malware Analysis. In Computer Security - ESORICS 2008 , Sushil Jajodia and Javier Lopez (Eds.). Springer Berlin Heidelberg, Berlin, Heidelberg, 481–500

2008
[2014]

In Proceedings of the 23rd USENIX Security Symposium, San Diego, CA, USA, August 20-22, 2014

BYTEWEIGHT: Learning to Recognize Functions in Binary Code. In Proceedings of the 23rd USENIX Security Symposium, San Diego, CA, USA, August 20-22, 2014. 845–860. h/t_tps://www.usenix.org/conference/usenixsecurity14/ technical-sessions/presentation/bao

2014
[2015]

In Proceedings of the 5th Program Protection and Reverse Engineering Workshop (PPREW-5)

Repeatable Reverse Engineering with PANDA. In Proceedings of the 5th Program Protection and Reverse Engineering Workshop (PPREW-5) . ACM, New York, NY, USA, Article 4, 11 pages. h/t_tps://doi.org/10.1145/2843859.2843867

Pith tools

Reviewed August 14, 2026 · model on record in the stance chip above.

[1] [29]

David Korczynski and Heng Yin. 2017. Capturing Malware Propagations with Code Injections and Code-Reuse A/t_tacks. InProceedings of the 2017 ACM SIGSAC 16 Conference on Computer and Communications Security, CCS 2017, Dallas, TX, USA, October 30 - November 03, 2017 , Bhavani M. /T_huraisingham, David Evans, Tal Malkin, and Dongyan Xu (Eds.). ACM, 1691–1708...

arXiv 2017

[2] [1]

Andrei Bacs, Remco Vermeulen, Asia Slowinska, and Herbert Bos. 2013. System- Level Support for Intrusion Recovery. In Detection of Intrusions and Malware, and Vulnerability Assessment, Ulrich Flegel, Evangelos Markatos, and William Robertson (Eds.). Springer Berlin Heidelberg, Berlin, Heidelberg, 144–163

2013

[3] [2]

Balakrishnan, T

G. Balakrishnan, T. Reps, D. Melski, and T. Teitelbaum. 2008. WYSINWYX: What You See Is Not What You eXecute . Springer Berlin Heidelberg, Berlin, Heidelberg, 202–213. h/t_tps://doi.org/10.1007/978-3-540-69149-5 22

doi:10.1007/978-3-540-69149-5 2008

[4] [3]

Tiﬀany Bao, Jonathan Burket, Maverick Woo, Rafael Turner, and David Brumley

work page

[5] [4]

/T_homas Barabosch, Niklas Bergmann, Adrian Dombeck, and Elmar Padilla. 2017. /Q_uincy: Detecting Host-Based Code Injection A/t_tacks in Memory Dumps. In Detection of Intrusions and Malware, and Vulnerability Assessment , Michalis Poly- chronakis and Michael Meier (Eds.). Springer International Publishing, Cham, 209–229

work page 2017

[6] [5]

/T_homas Barabosch, Sebastian Eschweiler, and Elmar Gerhards-Padilla. 2014. Bee Master: Detecting Host-Based Code Injection A/t_tacks. InDetection of Intru- sions and Malware, and Vulnerability Assessment , Sven Dietrich (Ed.). Springer International Publishing, Cham, 235–254

work page 2014

[7] [6]

Guillaume Bonfante, Jose Fernandez, Jean-Yves Marion, Benjamin Rouxel, Fab- rice Sabatier, and Aur ´elien /T_hierry. 2015. CoDisasm: Medium Scale Con- catic Disassembly of Self-Modifying Binaries with Overlapping Instructions. In Proceedings of the 22Nd ACM SIGSAC Conference on Computer and Com- munications Security (CCS ’15) . ACM, New York, NY, USA, 745...

arXiv 2015

[8] [7]

Erik Bosman, Asia Slowinska, and Herbert Bos. 2011. Minemu: /T_he World’s Fastest Taint Tracker. InProceedings of the 14th International Conference on Recent Advances in Intrusion Detection (RAID’11). Springer-Verlag, Berlin, Heidelberg, 1–20. h/t_tps://doi.org/10.1007/978-3-642-23644-0 1

work page doi:10.1007/978-3-642-23644-0 2011