• search hit 1 of 10
Back to Result List

Padding Matters - Exploring Function Detection in PE Files: Data/Toolset

  • Function detection is a well-known problem in binary analysis. While prior work has focused on Linux/ELF, Windows/PE binaries have only partially been considered. This paper introduces FuncPEval, a dataset for Windows x86 and x64 PE files, featuring Chromium and the Conti ransomware, along with ground truth data for 1,092,820 function starts. Utilizing FuncPEval, we evaluate five heuristics-based (Ghidra, IDA, Nucleus, rev.ng, SMDA) and three machine-learning-based (DeepDi, RNN, XDA) function start detection tools. Among these, IDA achieves the highest F1-score (98.44%) for Chromium x64, while DeepDi closely follows (97%) but stands out as the fastest. Towards explainability, we examine the impact of padding between functions on the detection results, finding all tested tools, except rev.ng, are susceptible to randomized padding. The randomized padding significantly diminishes the effectiveness of the RNN, XDA, and Nucleus. Among the learning-based tools, DeepDi exhibits the least sensitivity, while Nucleus is the most adversely affected among the non-learning-based tools.

Download full text files

Export metadata

Additional Services

Search Google Scholar
Metadaten
Author:Raphael SpringerORCiD, Alexander SchmitzORCiD, Artur LeinweberORCiD, Tobias UrbanORCiD, Christian DietrichORCiD
URN:urn:nbn:de:hbz:1010-opus4-48386
DOI:https://doi.org/10.1145/3714393.3726003
ISBN:979-8-4007-1476-4
Parent Title (English):CODASPY '25: Proceedings of the Fifteenth ACM Conference on Data and Application Security and Privacy
Publisher:ACM Digital Library
Document Type:Conference Proceeding
Language:English
Date of Publication (online):2025/06/04
Year of first Publication:2025
Publishing Institution:Westfälische Hochschule Gelsenkirchen Bocholt Recklinghausen
Release Date:2025/11/03
Tag:Binary Code Analysis; Function Detection; Malware
Page Number:6
First Page:179
Last Page:184
Institutes:Institute / Institut für Internetsicherheit
Dewey Decimal Classification:Informatik, Informationswissenschaft, allgemeine Werke / Informatik, Wissen, Systeme / Datenverarbeitung; Informatik
Licence (German):Creative Commons - Namensnennung
Einverstanden ✔
Diese Webseite verwendet technisch erforderliche Session-Cookies. Durch die weitere Nutzung der Webseite stimmen Sie diesem zu. Unsere Datenschutzerklärung finden Sie hier.