← Back ◬ AI & Machine Learning Jun 01, 2026

A Core-Structure-Based Automated Analysis Tool for Commercial Virtualization Obfuscation Deobfuscation

arXiv Security Archived Jun 01, 2026 ✓ Full text saved

arXiv:2605.30902v1 Announce Type: new Abstract: Virtualization obfuscation is a more powerful obfuscation technique compared to other obfuscation methods, and as it is increasingly being applied to malware, it demands significant effort and time from analysts. This study analyzes virtualization obfuscation and proposes a tool called VMPredator that automatically extracts semantic units. The proposed tool performs various analyses including memory analysis and trace analysis, while minimizing dep

Full text archived locally

✦ AI Summary · Claude Sonnet

Computer Science > Cryptography and Security [Submitted on 29 May 2026] A Core-Structure-Based Automated Analysis Tool for Commercial Virtualization Obfuscation Deobfuscation Wanju Kim, Seoksu Lee, Eun-Sun Cho Virtualization obfuscation is a more powerful obfuscation technique compared to other obfuscation methods, and as it is increasingly being applied to malware, it demands significant effort and time from analysts. This study analyzes virtualization obfuscation and proposes a tool called VMPredator that automatically extracts semantic units. The proposed tool performs various analyses including memory analysis and trace analysis, while minimizing dependency on the specific internal structure of virtual machines in order to handle diverse forms of virtualization obfuscation that existing tools are unable to process. Experimental results demonstrate that the length of obfuscated programs was reduced by approximately 85%, and it was verified through validation that small-scale programs were fully restored to semantics identical to the original. Subjects: Cryptography and Security (cs.CR) Cite as: arXiv:2605.30902 [cs.CR] (or arXiv:2605.30902v1 [cs.CR] for this version) https://doi.org/10.48550/arXiv.2605.30902 Focus to learn more Submission history From: Seoksu Lee [view email] [v1] Fri, 29 May 2026 06:36:46 UTC (181 KB) Access Paper: HTML (experimental) view license Current browse context: cs.CR < prev | next > new | recent | 2026-05 Change to browse by: cs References & Citations NASA ADS Google Scholar Semantic Scholar Export BibTeX Citation Bookmark Bibliographic Tools Bibliographic and Citation Tools Bibliographic Explorer Toggle Bibliographic Explorer (What is the Explorer?) Connected Papers Toggle Connected Papers (What is Connected Papers?) Litmaps Toggle Litmaps (What is Litmaps?) scite.ai Toggle scite Smart Citations (What are Smart Citations?) Code, Data, Media Demos Related Papers About arXivLabs Which authors of this paper are endorsers? | Disable MathJax (What is MathJax?)

💬 Team Notes