{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2024:FO2TUBIM4QSVZXXSO7LZSMF3FR","short_pith_number":"pith:FO2TUBIM","canonical_record":{"source":{"id":"2405.00298","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by-nc-sa/4.0/","primary_cat":"cs.CR","submitted_at":"2024-05-01T03:48:22Z","cross_cats_sorted":[],"title_canon_sha256":"4486db6c35aae4ee1c926c364d090a3ba546ca5185ff809bc76358bad132863c","abstract_canon_sha256":"8c0cee1d4271068e9db10a1c9cac5da04d014a29a57c0d76caa736015d4d8d18"},"schema_version":"1.0"},"canonical_sha256":"2bb53a050ce4255cdef277d79930bb2c775e861a5755bb6c8aa0d0265cdd8af7","source":{"kind":"arxiv","id":"2405.00298","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2405.00298","created_at":"2026-07-05T08:14:11Z"},{"alias_kind":"arxiv_version","alias_value":"2405.00298v1","created_at":"2026-07-05T08:14:11Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2405.00298","created_at":"2026-07-05T08:14:11Z"},{"alias_kind":"pith_short_12","alias_value":"FO2TUBIM4QSV","created_at":"2026-07-05T08:14:11Z"},{"alias_kind":"pith_short_16","alias_value":"FO2TUBIM4QSVZXXS","created_at":"2026-07-05T08:14:11Z"},{"alias_kind":"pith_short_8","alias_value":"FO2TUBIM","created_at":"2026-07-05T08:14:11Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2024:FO2TUBIM4QSVZXXSO7LZSMF3FR","target":"record","payload":{"canonical_record":{"source":{"id":"2405.00298","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by-nc-sa/4.0/","primary_cat":"cs.CR","submitted_at":"2024-05-01T03:48:22Z","cross_cats_sorted":[],"title_canon_sha256":"4486db6c35aae4ee1c926c364d090a3ba546ca5185ff809bc76358bad132863c","abstract_canon_sha256":"8c0cee1d4271068e9db10a1c9cac5da04d014a29a57c0d76caa736015d4d8d18"},"schema_version":"1.0"},"canonical_sha256":"2bb53a050ce4255cdef277d79930bb2c775e861a5755bb6c8aa0d0265cdd8af7","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T08:14:11.095024Z","signature_b64":"hduSgOr8MGQkw+O9o/NbD3a0OE/x5ieCT4Dcs+Xu4uhcULWO1Fv1IpLTVAI+GgCEivBEI8poUTXsSqMba0jcCA==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"2bb53a050ce4255cdef277d79930bb2c775e861a5755bb6c8aa0d0265cdd8af7","last_reissued_at":"2026-07-05T08:14:11.094571Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T08:14:11.094571Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2405.00298","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T08:14:11Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"jOktQoIg43dBtXJC9kZYs+aCzN+vwCKoffrTRxRNeMUdv/LWzPIPVEMXUrVpMy8yV2IWMMvHqDAc8JEzCcLfBQ==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-04T05:21:36.583620Z"},"content_sha256":"fabf64cc179faf573148ac3789999dca21824437240266b625bf37923bbda5f2","schema_version":"1.0","event_id":"sha256:fabf64cc179faf573148ac3789999dca21824437240266b625bf37923bbda5f2"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2024:FO2TUBIM4QSVZXXSO7LZSMF3FR","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"The Reversing Machine: Reconstructing Memory Assumptions","license":"http://creativecommons.org/licenses/by-nc-sa/4.0/","headline":"","cross_cats":[],"primary_cat":"cs.CR","authors_text":"Erik van der Kouwe, Jeong-A Lee, Mohammad K. Fallah, Mohammad Sina Karvandi, Saeid Gorgin, Saleh Khalaj Monfared, Sima Arasteh, Soroush Meghdadizanjani","submitted_at":"2024-05-01T03:48:22Z","abstract_excerpt":"Existing anti-malware software and reverse engineering toolkits struggle with stealthy sub-OS rootkits due to limitations of run-time kernel-level monitoring. A malicious kernel-level driver can bypass OS-level anti-virus mechanisms easily. Although static analysis of such malware is possible, obfuscation and packing techniques complicate offline analysis. Moreover, current dynamic analyzers suffer from virtualization performance overhead and create detectable traces that allow modern malware to evade them.\n  To address these issues, we present \\textit{The Reversing Machine} (TRM), a new hyper"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2405.00298","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2405.00298/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T08:14:11Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"WnIu0wMuRLgE8v+DgObnTKfbNWAH/g1CuL6iz860ThqeFYZJqUSxWUwqvudT6g1Nozq/F+lhQlRHYl66LcGNCg==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-04T05:21:36.584123Z"},"content_sha256":"cb848a60b9a865ca8fcf5410f3b7abebe5ae09dd9794fa7a07e962110471c952","schema_version":"1.0","event_id":"sha256:cb848a60b9a865ca8fcf5410f3b7abebe5ae09dd9794fa7a07e962110471c952"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/FO2TUBIM4QSVZXXSO7LZSMF3FR/bundle.json","state_url":"https://pith.science/pith/FO2TUBIM4QSVZXXSO7LZSMF3FR/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/FO2TUBIM4QSVZXXSO7LZSMF3FR/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-04T05:21:36Z","links":{"resolver":"https://pith.science/pith/FO2TUBIM4QSVZXXSO7LZSMF3FR","bundle":"https://pith.science/pith/FO2TUBIM4QSVZXXSO7LZSMF3FR/bundle.json","state":"https://pith.science/pith/FO2TUBIM4QSVZXXSO7LZSMF3FR/state.json","well_known_bundle":"https://pith.science/.well-known/pith/FO2TUBIM4QSVZXXSO7LZSMF3FR/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2024:FO2TUBIM4QSVZXXSO7LZSMF3FR","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"8c0cee1d4271068e9db10a1c9cac5da04d014a29a57c0d76caa736015d4d8d18","cross_cats_sorted":[],"license":"http://creativecommons.org/licenses/by-nc-sa/4.0/","primary_cat":"cs.CR","submitted_at":"2024-05-01T03:48:22Z","title_canon_sha256":"4486db6c35aae4ee1c926c364d090a3ba546ca5185ff809bc76358bad132863c"},"schema_version":"1.0","source":{"id":"2405.00298","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2405.00298","created_at":"2026-07-05T08:14:11Z"},{"alias_kind":"arxiv_version","alias_value":"2405.00298v1","created_at":"2026-07-05T08:14:11Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2405.00298","created_at":"2026-07-05T08:14:11Z"},{"alias_kind":"pith_short_12","alias_value":"FO2TUBIM4QSV","created_at":"2026-07-05T08:14:11Z"},{"alias_kind":"pith_short_16","alias_value":"FO2TUBIM4QSVZXXS","created_at":"2026-07-05T08:14:11Z"},{"alias_kind":"pith_short_8","alias_value":"FO2TUBIM","created_at":"2026-07-05T08:14:11Z"}],"graph_snapshots":[{"event_id":"sha256:cb848a60b9a865ca8fcf5410f3b7abebe5ae09dd9794fa7a07e962110471c952","target":"graph","created_at":"2026-07-05T08:14:11Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2405.00298/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Existing anti-malware software and reverse engineering toolkits struggle with stealthy sub-OS rootkits due to limitations of run-time kernel-level monitoring. A malicious kernel-level driver can bypass OS-level anti-virus mechanisms easily. Although static analysis of such malware is possible, obfuscation and packing techniques complicate offline analysis. Moreover, current dynamic analyzers suffer from virtualization performance overhead and create detectable traces that allow modern malware to evade them.\n  To address these issues, we present \\textit{The Reversing Machine} (TRM), a new hyper","authors_text":"Erik van der Kouwe, Jeong-A Lee, Mohammad K. Fallah, Mohammad Sina Karvandi, Saeid Gorgin, Saleh Khalaj Monfared, Sima Arasteh, Soroush Meghdadizanjani","cross_cats":[],"headline":"","license":"http://creativecommons.org/licenses/by-nc-sa/4.0/","primary_cat":"cs.CR","submitted_at":"2024-05-01T03:48:22Z","title":"The Reversing Machine: Reconstructing Memory Assumptions"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2405.00298","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:fabf64cc179faf573148ac3789999dca21824437240266b625bf37923bbda5f2","target":"record","created_at":"2026-07-05T08:14:11Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"8c0cee1d4271068e9db10a1c9cac5da04d014a29a57c0d76caa736015d4d8d18","cross_cats_sorted":[],"license":"http://creativecommons.org/licenses/by-nc-sa/4.0/","primary_cat":"cs.CR","submitted_at":"2024-05-01T03:48:22Z","title_canon_sha256":"4486db6c35aae4ee1c926c364d090a3ba546ca5185ff809bc76358bad132863c"},"schema_version":"1.0","source":{"id":"2405.00298","kind":"arxiv","version":1}},"canonical_sha256":"2bb53a050ce4255cdef277d79930bb2c775e861a5755bb6c8aa0d0265cdd8af7","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"2bb53a050ce4255cdef277d79930bb2c775e861a5755bb6c8aa0d0265cdd8af7","first_computed_at":"2026-07-05T08:14:11.094571Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T08:14:11.094571Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"hduSgOr8MGQkw+O9o/NbD3a0OE/x5ieCT4Dcs+Xu4uhcULWO1Fv1IpLTVAI+GgCEivBEI8poUTXsSqMba0jcCA==","signature_status":"signed_v1","signed_at":"2026-07-05T08:14:11.095024Z","signed_message":"canonical_sha256_bytes"},"source_id":"2405.00298","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:fabf64cc179faf573148ac3789999dca21824437240266b625bf37923bbda5f2","sha256:cb848a60b9a865ca8fcf5410f3b7abebe5ae09dd9794fa7a07e962110471c952"],"state_sha256":"63ff6e331077516f4cbb3e4d33be2e0544b22f4fcd2eb658229e6297b19f3a8c"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"7Ma1O2iQc7BvFGgyRRjDyo5VdKxY2xCFoi8Aqx96tSRyiGNGfE9owHoOdwPnEUY1/rr3KY4El5pcZSTJGHmYCg==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-04T05:21:36.588702Z","bundle_sha256":"71831e8151d3a0dcaa7d1c26949db5d6f1a5c9041795cc643d917dcbe4a82ff9"}}