@inproceedings{SpringerSchmitzLeinweberetal.2025, author = {Springer, Raphael and Schmitz, Alexander and Leinweber, Artur and Urban, Tobias and Dietrich, Christian J.}, title = {Padding Matters - Exploring Function Detection in PE Files: Data/Toolset}, series = {CODASPY '25: Proceedings of the Fifteenth ACM Conference on Data and Application Security and Privacy, June 4-6 2025, Pittsburgh PA USA}, volume = {2025}, booktitle = {CODASPY '25: Proceedings of the Fifteenth ACM Conference on Data and Application Security and Privacy, June 4-6 2025, Pittsburgh PA USA}, publisher = {Association for Computing Machinery (ACM)}, address = {New York}, isbn = {979-8-4007-1476-4}, doi = {10.1145/3714393.3726003}, url = {http://nbn-resolving.de/urn:nbn:de:hbz:1010-opus4-48386}, pages = {179 -- 184}, year = {2025}, abstract = {Function detection is a well-known problem in binary analysis. While prior work has focused on Linux/ELF, Windows/PE binaries have only partially been considered. This paper introduces FuncPEval, a dataset for Windows x86 and x64 PE files, featuring Chromium and the Conti ransomware, along with ground truth data for 1,092,820 function starts. Utilizing FuncPEval, we evaluate five heuristics-based (Ghidra, IDA, Nucleus, rev.ng, SMDA) and three machine-learning-based (DeepDi, RNN, XDA) function start detection tools. Among these, IDA achieves the highest F1-score (98.44\%) for Chromium x64, while DeepDi closely follows (97\%) but stands out as the fastest. Towards explainability, we examine the impact of padding between functions on the detection results, finding all tested tools, except rev.ng, are susceptible to randomized padding. The randomized padding significantly diminishes the effectiveness of the RNN, XDA, and Nucleus. Among the learning-based tools, DeepDi exhibits the least sensitivity, while Nucleus is the most adversely affected among the non-learning-based tools.}, language = {en} }