AwesomeREA.org

2026 · Preprint

Semantic Validation of Packer Identification Tools: Characterization, Repair, and Downstream Impact

Fangtian Zhong; Zhuoyun Qian; Yili Jiang; Jiaqi Huang; Yunming Pang; Xiuzhen Cheng

Uses unpacking outcomes as reference evidence to assess packer labels, normalizes heterogeneous tool results, and evaluates complementary signature/heuristic pools with static predicates derived from unpacker implementations. It traces how identification errors affect later unpacking and malware classification.

Scope and limitations

The corpus is approximately 160,000 Windows PE samples, split into roughly 130,000 for analysis/rule construction and 30,000 for testing. Unpacker failures or partial recovery can compromise the derived reference labels. Family-identification improvements use common pooled-rule configurations, not independently validated patches to seven separate tools. Repair evaluation excludes proprietary implementations and graph/learning-based methods. Results do not establish coverage of other executable formats, all packer families or general semantic equivalence.

Why it fits this collection

Examines the reliability of packer identification as a prerequisite for recovering analyzable binary content; it is a foundation-tool evaluation rather than an agent benchmark.

Publication and review details

Venue
arXiv
Status
Preprint
Publication / posting date
May 25, 2026
Date source
First arXiv submission was 2026-05-25; reviewed v3 was revised on 2026-10-19. No formal publication was verified.
First arXiv submission
May 25, 2026
arXiv
2605.25923
Reviewed arXiv version
v3
DOI
10.48550/arxiv.2605.25923

Reviewed the October v3 while retaining the May first-submission date. Its six-author list agrees across the current abstract, versioned PDF and updated DataCite record; v2 lists seven authors and is not combined with v3. The article is CC BY-SA 4.0, which does not license malware samples or third-party tools. Reviewed sources and focused search did not establish a paper-specific public release or its license. No malware samples, unpackers or experiment code were downloaded or executed.

Sources reviewed

Source review only; experiments were not rerun for this collection. Cite the original authors using the linked paper or BibTeX.

Primary sources

  1. https://arxiv.org/abs/2605.25923
  2. https://arxiv.org/html/2605.25923v3
  3. https://api.datacite.org/dois/10.48550/arxiv.2605.25923
  4. https://arxiv.org/pdf/2605.25923v3
  5. https://arxiv.org/abs/2605.25923v2