TY - CHAP A1 - Springer, Raphael A1 - Schmitz, Alexander A1 - Leinweber, Artur A1 - Urban, Tobias A1 - Dietrich, Christian J. T1 - Padding Matters - Exploring Function Detection in PE Files: Data/Toolset T2 - CODASPY '25: Proceedings of the Fifteenth ACM Conference on Data and Application Security and Privacy, June 4-6 2025, Pittsburgh PA USA N2 - Function detection is a well-known problem in binary analysis. While prior work has focused on Linux/ELF, Windows/PE binaries have only partially been considered. This paper introduces FuncPEval, a dataset for Windows x86 and x64 PE files, featuring Chromium and the Conti ransomware, along with ground truth data for 1,092,820 function starts. Utilizing FuncPEval, we evaluate five heuristics-based (Ghidra, IDA, Nucleus, rev.ng, SMDA) and three machine-learning-based (DeepDi, RNN, XDA) function start detection tools. Among these, IDA achieves the highest F1-score (98.44%) for Chromium x64, while DeepDi closely follows (97%) but stands out as the fastest. Towards explainability, we examine the impact of padding between functions on the detection results, finding all tested tools, except rev.ng, are susceptible to randomized padding. The randomized padding significantly diminishes the effectiveness of the RNN, XDA, and Nucleus. Among the learning-based tools, DeepDi exhibits the least sensitivity, while Nucleus is the most adversely affected among the non-learning-based tools. KW - Binary Code Analysis KW - Function Detection KW - Malware Y1 - 2025 U6 - http://nbn-resolving.de/urn/resolver.pl?urn:nbn:de:hbz:1010-opus4-48386 SN - 979-8-4007-1476-4 VL - 2025 SP - 179 EP - 184 PB - Association for Computing Machinery (ACM) CY - New York ER -