Search papers, labs, and topics across Lattice.
This paper introduces a semantic validation framework for packer identification tools, leveraging unpackers as executable semantic contracts to determine if a predicted packer family leads to successful program content recovery. They systematically detect, localize, and repair semantic faults in existing tools by comparing packer predictions against unpacker execution. Empirical evaluation across eleven open-source and six VirusTotal tools reveals widespread semantic bugs stemming from incomplete signatures and unstable heuristics, with repairs leading to significant improvements in packer identification coverage and downstream malware classification.
Packer identification tools, a cornerstone of malware analysis, are riddled with semantic bugs that can be automatically detected and repaired using unpackers as executable contracts, leading to substantial improvements in malware analysis pipelines.
Packer identification tools are a critical foundation of malware analysis, directly affecting unpacking, behavioral analysis, malware classification, and threat attribution. However, their semantic correctness is rarely validated. In practice, a tool may return a plausible packer label that is nevertheless semantically wrong, leading to failed unpacking and unreliable downstream analysis. This paper presents a semantic validation framework for testing and repairing packer identification tools. Our key idea is to use unpackers as executable semantic contracts. If a tool predicts a packer family, the corresponding unpacker should recover analyzable program content. This enables automatic test oracles without requiring manually labeled ground truth. Building on this idea, we develop a systematic pipeline for detecting, localizing, and repairing semantic faults in existing packer identification tools. We then conduct the first large-scale empirical study of semantic bugs in eleven open-source packer identification tools and six proprietary VirusTotal tools. Our results reveal that semantic bugs are widespread and recurring, largely due to incomplete signatures and unstable heuristic logic. After repair, packer identification coverage improves by up to 58.6%, and downstream malware classification performance improves by more than 13.6% on average. These findings show that semantic validation of packer identification tools is essential for building trustworthy malware analysis pipelines.
Tsinghua AI