{"record_type":"pith_number_record","schema_url":"https://pith.science/schemas/pith-number/v1.json","pith_number":"pith:2026:ORCJVCRMBVJMGUESDTHJHZI6SM","short_pith_number":"pith:ORCJVCRM","schema_version":"1.0","canonical_sha256":"74449a8a2c0d52c350921cce93e51e9308f3081fbc76eeaefed630071aa07970","source":{"kind":"arxiv","id":"2605.30902","version":1},"attestation_state":"computed","paper":{"title":"A Core-Structure-Based Automated Analysis Tool for Commercial Virtualization Obfuscation Deobfuscation","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"","cross_cats":[],"primary_cat":"cs.CR","authors_text":"Eun-Sun Cho, Seoksu Lee, Wanju Kim","submitted_at":"2026-05-29T06:36:46Z","abstract_excerpt":"Virtualization obfuscation is a more powerful obfuscation technique compared to other obfuscation methods, and as it is increasingly being applied to malware, it demands significant effort and time from analysts. This study analyzes virtualization obfuscation and proposes a tool called VMPredator that automatically extracts semantic units. The proposed tool performs various analyses including memory analysis and trace analysis, while minimizing dependency on the specific internal structure of virtual machines in order to handle diverse forms of virtualization obfuscation that existing tools ar"},"verification_status":{"content_addressed":true,"pith_receipt":true,"author_attested":false,"weak_author_claims":0,"strong_author_claims":0,"externally_anchored":false,"storage_verified":false,"citation_signatures":0,"replication_records":0,"graph_snapshot":true,"references_resolved":false,"formal_links_present":false},"canonical_record":{"source":{"id":"2605.30902","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2026-05-29T06:36:46Z","cross_cats_sorted":[],"title_canon_sha256":"93dea4723b9564ea0624e317b45e44710dc2546cae58182b6ff3b56d28ac648b","abstract_canon_sha256":"bb48291582ced8025e313206b11f15444259fd619a89409e4b8312ee5e8c3d70"},"schema_version":"1.0"},"receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-06-01T01:03:24.690831Z","signature_b64":"+R5v/Dg/kz7mB5fHBi1dE4m0AB3BIOa8hDzr7TezvX9pw7cmPVemxIi0f9bZdXZ2u6KvDY5hAeudyTFmlaJ0BA==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"74449a8a2c0d52c350921cce93e51e9308f3081fbc76eeaefed630071aa07970","last_reissued_at":"2026-06-01T01:03:24.690031Z","signature_status":"signed_v1","first_computed_at":"2026-06-01T01:03:24.690031Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"graph_snapshot":{"paper":{"title":"A Core-Structure-Based Automated Analysis Tool for Commercial Virtualization Obfuscation Deobfuscation","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"","cross_cats":[],"primary_cat":"cs.CR","authors_text":"Eun-Sun Cho, Seoksu Lee, Wanju Kim","submitted_at":"2026-05-29T06:36:46Z","abstract_excerpt":"Virtualization obfuscation is a more powerful obfuscation technique compared to other obfuscation methods, and as it is increasingly being applied to malware, it demands significant effort and time from analysts. This study analyzes virtualization obfuscation and proposes a tool called VMPredator that automatically extracts semantic units. The proposed tool performs various analyses including memory analysis and trace analysis, while minimizing dependency on the specific internal structure of virtual machines in order to handle diverse forms of virtualization obfuscation that existing tools ar"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2605.30902","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2605.30902/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"aliases":[{"alias_kind":"arxiv","alias_value":"2605.30902","created_at":"2026-06-01T01:03:24.690145+00:00"},{"alias_kind":"arxiv_version","alias_value":"2605.30902v1","created_at":"2026-06-01T01:03:24.690145+00:00"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2605.30902","created_at":"2026-06-01T01:03:24.690145+00:00"},{"alias_kind":"pith_short_12","alias_value":"ORCJVCRMBVJM","created_at":"2026-06-01T01:03:24.690145+00:00"},{"alias_kind":"pith_short_16","alias_value":"ORCJVCRMBVJMGUES","created_at":"2026-06-01T01:03:24.690145+00:00"},{"alias_kind":"pith_short_8","alias_value":"ORCJVCRM","created_at":"2026-06-01T01:03:24.690145+00:00"}],"events":[],"event_summary":{},"paper_claims":[],"inbound_citations":{"count":0,"internal_anchor_count":0,"sample":[]},"formal_canon":{"evidence_count":0,"sample":[],"anchors":[]},"links":{"html":"https://pith.science/pith/ORCJVCRMBVJMGUESDTHJHZI6SM","json":"https://pith.science/pith/ORCJVCRMBVJMGUESDTHJHZI6SM.json","graph_json":"https://pith.science/api/pith-number/ORCJVCRMBVJMGUESDTHJHZI6SM/graph.json","events_json":"https://pith.science/api/pith-number/ORCJVCRMBVJMGUESDTHJHZI6SM/events.json","paper":"https://pith.science/paper/ORCJVCRM"},"agent_actions":{"view_html":"https://pith.science/pith/ORCJVCRMBVJMGUESDTHJHZI6SM","download_json":"https://pith.science/pith/ORCJVCRMBVJMGUESDTHJHZI6SM.json","view_paper":"https://pith.science/paper/ORCJVCRM","resolve_alias":"https://pith.science/api/pith-number/resolve?arxiv=2605.30902&json=true","fetch_graph":"https://pith.science/api/pith-number/ORCJVCRMBVJMGUESDTHJHZI6SM/graph.json","fetch_events":"https://pith.science/api/pith-number/ORCJVCRMBVJMGUESDTHJHZI6SM/events.json","actions":{"anchor_timestamp":"https://pith.science/pith/ORCJVCRMBVJMGUESDTHJHZI6SM/action/timestamp_anchor","attest_storage":"https://pith.science/pith/ORCJVCRMBVJMGUESDTHJHZI6SM/action/storage_attestation","attest_author":"https://pith.science/pith/ORCJVCRMBVJMGUESDTHJHZI6SM/action/author_attestation","sign_citation":"https://pith.science/pith/ORCJVCRMBVJMGUESDTHJHZI6SM/action/citation_signature","submit_replication":"https://pith.science/pith/ORCJVCRMBVJMGUESDTHJHZI6SM/action/replication_record"}},"created_at":"2026-06-01T01:03:24.690145+00:00","updated_at":"2026-06-01T01:03:24.690145+00:00"}