{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2024:FO2TUBIM4QSVZXXSO7LZSMF3FR","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"8c0cee1d4271068e9db10a1c9cac5da04d014a29a57c0d76caa736015d4d8d18","cross_cats_sorted":[],"license":"http://creativecommons.org/licenses/by-nc-sa/4.0/","primary_cat":"cs.CR","submitted_at":"2024-05-01T03:48:22Z","title_canon_sha256":"4486db6c35aae4ee1c926c364d090a3ba546ca5185ff809bc76358bad132863c"},"schema_version":"1.0","source":{"id":"2405.00298","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2405.00298","created_at":"2026-07-05T08:14:11Z"},{"alias_kind":"arxiv_version","alias_value":"2405.00298v1","created_at":"2026-07-05T08:14:11Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2405.00298","created_at":"2026-07-05T08:14:11Z"},{"alias_kind":"pith_short_12","alias_value":"FO2TUBIM4QSV","created_at":"2026-07-05T08:14:11Z"},{"alias_kind":"pith_short_16","alias_value":"FO2TUBIM4QSVZXXS","created_at":"2026-07-05T08:14:11Z"},{"alias_kind":"pith_short_8","alias_value":"FO2TUBIM","created_at":"2026-07-05T08:14:11Z"}],"graph_snapshots":[{"event_id":"sha256:cb848a60b9a865ca8fcf5410f3b7abebe5ae09dd9794fa7a07e962110471c952","target":"graph","created_at":"2026-07-05T08:14:11Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2405.00298/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Existing anti-malware software and reverse engineering toolkits struggle with stealthy sub-OS rootkits due to limitations of run-time kernel-level monitoring. A malicious kernel-level driver can bypass OS-level anti-virus mechanisms easily. Although static analysis of such malware is possible, obfuscation and packing techniques complicate offline analysis. Moreover, current dynamic analyzers suffer from virtualization performance overhead and create detectable traces that allow modern malware to evade them.\n  To address these issues, we present \\textit{The Reversing Machine} (TRM), a new hyper","authors_text":"Erik van der Kouwe, Jeong-A Lee, Mohammad K. Fallah, Mohammad Sina Karvandi, Saeid Gorgin, Saleh Khalaj Monfared, Sima Arasteh, Soroush Meghdadizanjani","cross_cats":[],"headline":"","license":"http://creativecommons.org/licenses/by-nc-sa/4.0/","primary_cat":"cs.CR","submitted_at":"2024-05-01T03:48:22Z","title":"The Reversing Machine: Reconstructing Memory Assumptions"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2405.00298","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:fabf64cc179faf573148ac3789999dca21824437240266b625bf37923bbda5f2","target":"record","created_at":"2026-07-05T08:14:11Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"8c0cee1d4271068e9db10a1c9cac5da04d014a29a57c0d76caa736015d4d8d18","cross_cats_sorted":[],"license":"http://creativecommons.org/licenses/by-nc-sa/4.0/","primary_cat":"cs.CR","submitted_at":"2024-05-01T03:48:22Z","title_canon_sha256":"4486db6c35aae4ee1c926c364d090a3ba546ca5185ff809bc76358bad132863c"},"schema_version":"1.0","source":{"id":"2405.00298","kind":"arxiv","version":1}},"canonical_sha256":"2bb53a050ce4255cdef277d79930bb2c775e861a5755bb6c8aa0d0265cdd8af7","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"2bb53a050ce4255cdef277d79930bb2c775e861a5755bb6c8aa0d0265cdd8af7","first_computed_at":"2026-07-05T08:14:11.094571Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T08:14:11.094571Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"hduSgOr8MGQkw+O9o/NbD3a0OE/x5ieCT4Dcs+Xu4uhcULWO1Fv1IpLTVAI+GgCEivBEI8poUTXsSqMba0jcCA==","signature_status":"signed_v1","signed_at":"2026-07-05T08:14:11.095024Z","signed_message":"canonical_sha256_bytes"},"source_id":"2405.00298","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:fabf64cc179faf573148ac3789999dca21824437240266b625bf37923bbda5f2","sha256:cb848a60b9a865ca8fcf5410f3b7abebe5ae09dd9794fa7a07e962110471c952"],"state_sha256":"63ff6e331077516f4cbb3e4d33be2e0544b22f4fcd2eb658229e6297b19f3a8c"}