Padding Matters - Exploring Function Detection in PE Files: Data/Toolset
- Function detection is a well-known problem in binary analysis. While prior work has focused on Linux/ELF, Windows/PE binaries have only partially been considered. This paper introduces FuncPEval, a dataset for Windows x86 and x64 PE files, featuring Chromium and the Conti ransomware, along with ground truth data for 1,092,820 function starts. Utilizing FuncPEval, we evaluate five heuristics-based (Ghidra, IDA, Nucleus, rev.ng, SMDA) and three machine-learning-based (DeepDi, RNN, XDA) function start detection tools. Among these, IDA achieves the highest F1-score (98.44%) for Chromium x64, while DeepDi closely follows (97%) but stands out as the fastest. Towards explainability, we examine the impact of padding between functions on the detection results, finding all tested tools, except rev.ng, are susceptible to randomized padding. The randomized padding significantly diminishes the effectiveness of the RNN, XDA, and Nucleus. Among the learning-based tools, DeepDi exhibits the least sensitivity, while Nucleus is the most adversely affected among the non-learning-based tools.
| Author: | Raphael SpringerORCiD, Alexander SchmitzORCiD, Artur LeinweberORCiD, Tobias UrbanORCiD, Christian DietrichORCiD |
|---|---|
| URN: | urn:nbn:de:hbz:1010-opus4-48386 |
| DOI: | https://doi.org/10.1145/3714393.3726003 |
| ISBN: | 979-8-4007-1476-4 |
| Parent Title (English): | CODASPY '25: Proceedings of the Fifteenth ACM Conference on Data and Application Security and Privacy |
| Publisher: | ACM Digital Library |
| Document Type: | Conference Proceeding |
| Language: | English |
| Date of Publication (online): | 2025/06/04 |
| Year of first Publication: | 2025 |
| Publishing Institution: | Westfälische Hochschule Gelsenkirchen Bocholt Recklinghausen |
| Release Date: | 2025/11/03 |
| Tag: | Binary Code Analysis; Function Detection; Malware |
| Page Number: | 6 |
| First Page: | 179 |
| Last Page: | 184 |
| Institutes: | Institute / Institut für Internetsicherheit |
| Dewey Decimal Classification: | Informatik, Informationswissenschaft, allgemeine Werke / Informatik, Wissen, Systeme / Datenverarbeitung; Informatik |
| Licence (German): | Creative Commons - Namensnennung |



