A Core-Structure-Based Automated Analysis Tool for Commercial Virtualization Obfuscation Deobfuscation

• URL: http://arxiv.org/abs/2605.30902v1
• Date: Fri, 29 May 2026 06:36:46 GMT
• Title: A Core-Structure-Based Automated Analysis Tool for Commercial Virtualization Obfuscation Deobfuscation
• Abstract summary: The length of obfuscated programs was reduced by approximately 85%.<n>It was verified through validation that small-scale programs were fully restored to semantics identical to the original.
• Score: 4.0782474409194736
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Virtualization obfuscation is a more powerful obfuscation technique compared to other obfuscation methods, and as it is increasingly being applied to malware, it demands significant effort and time from analysts. This study analyzes virtualization obfuscation and proposes a tool called VMPredator that automatically extracts semantic units. The proposed tool performs various analyses including memory analysis and trace analysis, while minimizing dependency on the specific internal structure of virtual machines in order to handle diverse forms of virtualization obfuscation that existing tools are unable to process. Experimental results demonstrate that the length of obfuscated programs was reduced by approximately 85%, and it was verified through validation that small-scale programs were fully restored to semantics identical to the original.

Related papers

• Dynamic analysis enhances issue resolution [53.50448142467294]
  DAIRA (Dynamic Analysis-enhanced Issue Resolution Agent) is an automated repair framework that embeds dynamic analysis into the agent's reasoning cycle.<n> Driven by a Test Tracing-Driven methodology, DAIRA utilizes lightweight monitors to extract critical runtime data.<n>When powered by Gemini 3 Flash Preview, DAIRA establishes a new state-of-the-art (SOTA) performance, achieving a 79.4% resolution rate on the SWE-bench Verified dataset.
  arXiv  Detail & Related papers  (2026-03-23T14:48:54Z)
• Pushan: Trace-Free Deobfuscation of Virtualization-Obfuscated Binaries [18.483613577646974]
  Existing automated deobfuscation techniques suffer from three major drawbacks.<n>They only work on execution traces, which prevents them from recovering all logic in an obfuscated binary.<n> PUSHAN is trace-free and avoids path-constraint accumulation.<n>It is the first approach that also decompiles the protected code into high-quality C pseudocode to enable effective analysis.
  arXiv  Detail & Related papers  (2026-03-18T23:37:39Z)
• An Explainable Memory Forensics Approach for Malware Analysis [1.2744523252873352]
  Memory forensics is an effective methodology for analyzing living-off-the-land malware.<n>In this paper, we propose an explainable, AI-assisted memory forensics approach.<n>We apply the proposed methodology to both Windows and Android malware.
  arXiv  Detail & Related papers  (2026-02-23T13:30:04Z)
• ForgeryVCR: Visual-Centric Reasoning via Efficient Forensic Tools in MLLMs for Image Forgery Detection and Localization [62.03035862528452]
  ForgeryVCR is a framework that materializes imperceptible traces into explicit visual intermediates via Visual-Centric Reasoning.<n>ForgeryVCR achieves state-of-the-art (SOTA) performance in both detection and localization tasks.
  arXiv  Detail & Related papers  (2026-02-15T11:14:47Z)
• Sponge Tool Attack: Stealthy Denial-of-Efficiency against Tool-Augmented Agentic Reasoning [58.432996881401415]
  Recent work augments large language models (LLMs) with external tools to enable agentic reasoning.<n>We propose Sponge Tool Attack (STA), which disrupts agentic reasoning solely by rewriting the input prompt.<n>STA generates benign-looking prompt rewrites from the original one with high semantic fidelity.
  arXiv  Detail & Related papers  (2026-01-24T19:36:51Z)
• Static Detection of Core Structures in Tigress Virtualization-Based Obfuscation Using an LLVM Pass [4.7664516965746335]
  This paper aims to identify the structural components of virtualization-based obfuscation through static analysis.<n> Experimental results show that, in the absence of compiler optimizations, the proposed LLVM Pass successfully detects all core structures across major virtualization options.
  arXiv  Detail & Related papers  (2026-01-19T10:15:59Z)
• HALF: Process Hollowing Analysis Framework for Binary Programs with the Assistance of Kernel Modules [10.10348463565392]
  This paper presents a new binary program analysis framework, in order to improve the usability and performance of fine-grained analysis.<n>The framework mainly uses the kernel module to further expand the analysis capability of the traditional dynamic binary instrumentation.<n>It can reuse the functions of the existing dynamic binary instrumentation platforms and also reduce the impact on the execution of the target program.
  arXiv  Detail & Related papers  (2025-12-26T14:34:30Z)
• Certifiably robust malware detectors by design [48.367676529300276]
  We propose a new model architecture for robust malware detection by design.<n>We show that every robust detector can be decomposed into a specific structure, which can be applied to learn empirically robust malware detectors.<n>Our framework ERDALT is based on this structure.
  arXiv  Detail & Related papers  (2025-08-10T09:19:29Z)
• Evaluating Software Plagiarism Detection in the Age of AI: Automated Obfuscation and Lessons for Academic Integrity [0.0]
  Plagiarism in programming assignments is a persistent issue in computer science education.<n>Software plagiarism detectors are widely used to identify suspicious similarities at scale.<n>They are vulnerable to advanced obfuscation based on structural modification of program code.
  arXiv  Detail & Related papers  (2025-05-26T15:59:01Z)
• ReF Decompile: Relabeling and Function Call Enhanced Decompile [50.86228893636785]
  The goal of decompilation is to convert compiled low-level code (e.g., assembly code) back into high-level programming languages.<n>This task supports various reverse engineering applications, such as vulnerability identification, malware analysis, and legacy software migration.
  arXiv  Detail & Related papers  (2025-02-17T12:38:57Z)
• Software Vulnerability Detection via Deep Learning over Disaggregated Code Graph Representation [57.92972327649165]
  This work explores a deep learning approach to automatically learn the insecure patterns from code corpora. Because code naturally admits graph structures with parsing, we develop a novel graph neural network (GNN) to exploit both the semantic context and structural regularity of a program.
  arXiv  Detail & Related papers  (2021-09-07T21:24:36Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.