AwesomeREA.org

2026 · Conference paper

ShieldedCode: Learning Robust Representations for Virtual Machine Protected Code

Mingqiao Mo; Yunlong Tan; Hao Zhang; Heng Zhang; Yangfan He

ShieldedCode studies software protection from the defender's side: it trains code language models on pairs of C source functions and their virtualization-protected (VMP) x86-64 code so that the models can generate, compare and rank protected variants. Training pairs come from AnghaBench functions compiled at O0–O3, protected at levels L0–L3 by a commercial VMP tool, then disassembled and normalized. The model adds attention masks for dependencies within, between adjacent and across virtual instructions, contrastive objectives for functional equivalence and protection strength, and a protection-effectiveness task that ranks variants of the same source. Continual pre-training starts from CodeLlama 34B and adds The Stack to the corpus, and fine-tuning uses 2.5 million source–VM pairs. On HumanEval-compile, VM code generation reaches 26.95% Pass@1 at level L0 (GPT-4o: 22.58%) and 14.71% at L3. On BinaryCorp-VirtualAssembly similarity detection, Recall@1 for the O0+L1 setting is 0.488, against 0.333 for jTrans with a linear probe. The authors also run a manual reverse-engineering study and pattern-matching and angr attacks on the generated protection.

Scope and limitations

All data is x86-64, and every training pair is produced with one commercial VMP tool that the paper does not name, so results may not carry over to other architectures, protectors or virtual-instruction designs. Generated VM code is checked with HumanEval-compile test cases, not formal equivalence, and Pass@1 stays between 14.71% and 26.95% across protection levels. The similarity gain over jTrans holds only in the O0+L1 setting: in the other five BinaryCorp-VirtualAssembly settings the linear-probe jTrans has higher Recall@1 (for example 0.715 against 0.309 for O2+L1), and the paper's summaries of the comparison differ (a 10% gain in the abstract, 15.5 points in the introduction, competitive in the results). The ablation table reports scores for ContraBin, CLAP and CEBin that the paper says are estimated from their architectures rather than measured. Protection-strength claims rest on the authors' own attacks and manual study: 12 graduate students and 3 professional reverse engineers analyzing 20 functions for 30–45 minutes each, with 17% success on ShieldedCode output against 67% for VMProtect and 58% for Themida. ShieldedCode is not a devirtualizer or deobfuscator, and the paper links no code, models or generated training data.

Why it fits this collection

Adds protection-side research that uses learned models to generate VM-protected code and to measure how it resists reversing, complementing the BAR 2026 protection study and SRE-Bench, which measure how agents cope with protected binaries.

Publication and review details

Venue
ICLR 2026
Status
Conference paper
Publication / posting date
2026 (exact date not verified)
Date source
Publication year stated by the official ICLR proceedings; no finer publication date is asserted. The proceedings page's citation date of 2026-04-20 is not adopted, and the arXiv date is not substituted.
First arXiv submission
January 28, 2026
arXiv
2601.20679
Reviewed arXiv version
v1

The ICLR proceedings page lists the five authors in this order, pages 23529–23552 and no DOI; its PDF carries the header "Published as a conference paper at ICLR 2026". arXiv has only v1, dated 2026-01-28, with the comment "Accepted to ICLR 2026". The OpenReview forum 9F9UFVcDkV returned a browser challenge to automated requests, so its presentation type is not recorded. Neither the paper nor the proceedings page links code, models or data; the reproducibility statement only says the implementation uses PyTorch and open-source libraries, and code_url is null. A same-name GitHub repository, Clon5676/ShieldedCode, is an unrelated Unreal Engine project and is not linked. The commercial tool used to build the training data is unnamed; VMProtect and Themida appear only as comparisons in the resistance study. No code or experiments were run.

Sources reviewed

Source review only; experiments were not rerun for this collection. Cite the original authors using the linked paper or BibTeX.

Report an outdated entry Suggest a translation fix

Primary sources

  1. https://proceedings.iclr.cc/paper_files/paper/2026/hash/286976486c9bbfa2c2069b01b259b19d-Abstract-Conference.html
  2. https://proceedings.iclr.cc/paper_files/paper/2026/file/286976486c9bbfa2c2069b01b259b19d-Paper-Conference.pdf
  3. https://arxiv.org/abs/2601.20679
  4. https://arxiv.org/pdf/2601.20679v1
  5. https://openreview.net/forum?id=9F9UFVcDkV