{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,11,18]],"date-time":"2025-11-18T11:48:25Z","timestamp":1763466505618},"publisher-location":"Cham","reference-count":37,"publisher":"Springer International Publishing","isbn-type":[{"type":"print","value":"9783319085081"},{"type":"electronic","value":"9783319085098"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2014]]},"DOI":"10.1007\/978-3-319-08509-8_1","type":"book-chapter","created":{"date-parts":[[2014,6,13]],"date-time":"2014-06-13T07:04:32Z","timestamp":1402643072000},"page":"1-20","source":"Crossref","is-referenced-by-count":1,"title":["Data Structure Archaeology: Scrape Away the Dirt and Glue Back the Pieces!"],"prefix":"10.1007","author":[{"given":"Asia","family":"Slowinska","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Istvan","family":"Haller","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Andrei","family":"Bacs","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Silviu","family":"Baranga","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Herbert","family":"Bos","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"297","reference":[{"key":"1_CR1","unstructured":"Codevirtualizer: Total obfuscations against reverse engineering (2008), http:\/\/oreans.com\/codevirtualizer.php"},{"key":"1_CR2","doi-asserted-by":"crossref","unstructured":"Anckaert, B., Madou, M., De Sutter, B., De Bus, B., De Bosschere, K., Preneel, B.: Program obfuscation: a quantitative approach. In: Proc. of the 2007 ACM Workshop on Quality of Protection, QoP 2007 (2007)","DOI":"10.1145\/1314257.1314263"},{"key":"1_CR3","doi-asserted-by":"crossref","unstructured":"Axelsson, S.: The base-rate fallacy and its implications for the difficulty of intrusion detection. In: Proc. of the 6th ACM Conference on Computer and Communications Security (1999)","DOI":"10.1145\/319709.319710"},{"key":"1_CR4","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1007\/3-540-44647-8_1","volume-title":"Advances in Cryptology - CRYPTO 2001","author":"B. Barak","year":"2001","unstructured":"Barak, B., Goldreich, O., Impagliazzo, R., Rudich, S., Sahai, A., Vadhan, S.P., Yang, K.: On the (Im)possibility of obfuscating programs. In: Kilian, J. (ed.) CRYPTO 2001. LNCS, vol.\u00a02139, pp. 1\u201318. Springer, Heidelberg (2001)"},{"key":"1_CR5","doi-asserted-by":"crossref","unstructured":"Ceccato, M., Di Penta, M., Nagra, J., Falcarin, P., Ricca, F., Torchiano, M., Tonella, P.: Towards experimental evaluation of code obfuscation techniques. In: Proc. of the 4th ACM Workshop on Quality of Protection (2008)","DOI":"10.1145\/1456362.1456371"},{"key":"1_CR6","doi-asserted-by":"crossref","unstructured":"Chipounov, V., Kuznetsov, V., Candea, G.: S2E: A platform for in vivo multi-path analysis of software systems. In: 16th Intl. Conference on Architectural Support for Programming Languages and Operating Systems, ASPLOS (2011)","DOI":"10.1145\/1950365.1950396"},{"key":"1_CR7","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"144","DOI":"10.1007\/3-540-45439-X_10","volume-title":"Information Security","author":"S. Chow","year":"2001","unstructured":"Chow, S., Gu, Y., Johnson, H., Zakharov, V.A.: An approach to the obfuscation of control-flow of sequential computer programs. In: Davida, G.I., Frankel, Y. (eds.) ISC 2001. LNCS, vol.\u00a02200, pp. 144\u2013155. Springer, Heidelberg (2001)"},{"key":"1_CR8","doi-asserted-by":"crossref","unstructured":"Collberg, C., Carter, E., Debray, S., Huntwork, A., Kececioglu, J., Linn, C., Stepp, M.: Dynamic path-based software watermarking. In: Proc. of the ACM SIGPLAN 2004 Conference on Programming Language Design and Implementation, PLDI 2004 (2004)","DOI":"10.1145\/996841.996856"},{"key":"1_CR9","unstructured":"Collberg, C., Nagra, J.: Surreptitious Software: Obfuscation, Watermarking, and Tamperproofing for Software Protection (2009)"},{"key":"1_CR10","unstructured":"Collberg, C., Thomborson, C., Low, D.: A taxonomy of obfuscating transformations. Technical report, Department of Computer Sciences, The University of Auckland, Auckland, New Zealand (1997)"},{"key":"1_CR11","unstructured":"Collberg, C., Thomborson, C., Low, D.: Breaking Abstractions and Unstructuring Data Structures. In: Proc. of IEEE International Conference on Computer Languages, ICCL 1998 (1998)"},{"key":"1_CR12","unstructured":"Collberg, C., Thomborson, C., Low, D.: Obfuscation techniques for enhancing software security (2003)"},{"key":"1_CR13","doi-asserted-by":"crossref","unstructured":"Coogan, K., Lu, G., Debray, S.: Deobfuscation of virtualization-obfuscated software: a semantics-based approach. In: Proc. of the 18th ACM Conference on Computer and Communications Security, CCS 2011 (2011)","DOI":"10.1145\/2046707.2046739"},{"key":"1_CR14","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"81","DOI":"10.1007\/11784180_9","volume-title":"Algebraic Methodology and Software Technology","author":"M.D. Preda","year":"2006","unstructured":"Preda, M.D., Madou, M., De Bosschere, K., Giacobazzi, R.: Opaque predicates detection by abstract interpretation. In: Johnson, M., Vene, V. (eds.) AMAST 2006. LNCS, vol.\u00a04019, pp. 81\u201395. Springer, Heidelberg (2006)"},{"key":"1_CR15","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"149","DOI":"10.1007\/3-540-44905-1_10","volume-title":"Languages and Compilers for Parallel Computing","author":"C. Ding","year":"2000","unstructured":"Ding, C., Kennedy, K.: Inter-array Data Regrouping. In: Carter, L., Ferrante, J. (eds.) LCPC 1999. LNCS, vol.\u00a01863, pp. 149\u2013163. Springer, Heidelberg (2000)"},{"key":"1_CR16","doi-asserted-by":"crossref","unstructured":"Ding, C., Zhong, Y.: Predicting whole-program locality through reuse distance analysis. In: Proc. of the ACM SIGPLAN 2003 Conference on Programming Language Design and Implementation, PLDI 2003 (2003)","DOI":"10.1145\/781158.781159"},{"key":"1_CR17","doi-asserted-by":"crossref","unstructured":"Guillot, Y., Gazet, A.: Automatic binary deobfuscation. Journal in Computer Virology (2010)","DOI":"10.1007\/s11416-009-0126-4"},{"key":"1_CR18","unstructured":"Intel. Pin - A Dynamic Binary Instrumentation Tool (2011), http:\/\/www.pintool.org\/"},{"key":"1_CR19","unstructured":"Irdeto. Application security, http:\/\/irdeto.com\/en\/application-security.html"},{"key":"1_CR20","doi-asserted-by":"crossref","unstructured":"Kemerlis, V.P., Portokalidis, G., Jee, K., Keromytis, A.D.: libdft: Practical Dynamic Data Flow Tracking for Commodity Systems. In: Proc. of the 8th Annual International Conference on Virtual Execution Environments, VEE 2012 (2012)","DOI":"10.1145\/2151024.2151042"},{"key":"1_CR21","unstructured":"Kruegel, C., Robertson, W., Valeur, F., Vigna, G.: Static disassembly of obfuscated binaries. In: Proc. of the 13th Conference on USENIX Security Symposium, SSYM 2004(2004)"},{"key":"1_CR22","doi-asserted-by":"crossref","unstructured":"Lakhotia, A., Uday, E.: Stack shape analysis to detect obfuscated calls in binaries. In: Proc. of 4th IEEE International Workshop on Source Code Analysis and Manipulation (2004)","DOI":"10.1109\/SCAM.2004.2"},{"key":"1_CR23","doi-asserted-by":"crossref","unstructured":"Linn, C., Debray, S.: Obfuscation of executable code to improve resistance to static disassembly. In: Proc. of the 10th ACM Conference on Computer and Communications Security, CCS 2003 (2003)","DOI":"10.1145\/948148.948149"},{"key":"1_CR24","doi-asserted-by":"crossref","unstructured":"Madou, M., Anckaert, B., De Sutter, B., De Bosschere, K.: Hybrid static-dynamic attacks against software protection mechanisms. In: Proc. of the 5th ACM Workshop on Digital Rights Management, DRM 2005 (2005)","DOI":"10.1145\/1102546.1102560"},{"key":"1_CR25","doi-asserted-by":"crossref","unstructured":"Majumdar, A., Drape, S.J., Thomborson, C.D.: Slicing obfuscations: design, correctness, and evaluation. In: In Proc. of the 2007 ACM workshop on Digital Rights Management, DRM 2007 (2007)","DOI":"10.1145\/1314276.1314290"},{"key":"1_CR26","unstructured":"Morpher. Software protection service, http:\/\/www.morpher.com\/"},{"key":"1_CR27","unstructured":"Saidi, H., Porrass, P., Yegneswaran, V.: Experiences in malware binary deobfuscation. In: The 20th Virus Bulletin International Conference (2010)"},{"key":"1_CR28","unstructured":"Semantic Designs. C source code obfuscator, http:\/\/www.semdesigns.com\/products\/obfuscators\/CObfuscator.html"},{"key":"1_CR29","doi-asserted-by":"crossref","unstructured":"Sharif, M., Lanzi, A., Giffin, J., Lee, W.: Automatic reverse engineering of malware emulators. In: Proc. of the 2009 30th IEEE Symposium on Security and Privacy (2009)","DOI":"10.1109\/SP.2009.27"},{"key":"1_CR30","unstructured":"Slowinska, A., Stancescu, T., Bos, H.: Howard: a dynamic excavator for reverse engineering data structures. In: Proc. of the 18th Annual Network & Distributed System Security Symposium, NDSS 2011 (2011)"},{"key":"1_CR31","unstructured":"SourceFormatX. Codemorph source code obfuscator, http:\/\/www.sourceformat.com\/code-obfuscator.htm"},{"key":"1_CR32","unstructured":"Stunnix, http:\/\/stunnix.com\/"},{"key":"1_CR33","unstructured":"Udupa, S.K., Debray, S.K., Madou, M.: Deobfuscation: Reverse engineering obfuscated code. In: Proc. of the 12th Working Conference on Reverse Engineering, WCRE 2005 (2005)"},{"key":"1_CR34","doi-asserted-by":"crossref","unstructured":"Wang, C., Hill, J., Knight, J.C., Davidson, J.W.: Protection of software-based survivability mechanisms. In: Proc. of the 2001 International Conference on Dependable Systems and Networks, DSN 2001 (2001)","DOI":"10.21236\/ADA466288"},{"key":"1_CR35","unstructured":"Wheeler, D.A.: Sloccount, http:\/\/www.dwheeler.com\/sloccount\/"},{"key":"1_CR36","doi-asserted-by":"crossref","unstructured":"Wu, Z., Gianvecchio, S., Xie, M., Wang, H.: Mimimorphism: a new approach to binary code obfuscation. In: Proc. of the 17th ACM Conference on Computer and Communications Security, CCS 2010 (2010)","DOI":"10.1145\/1866307.1866368"},{"key":"1_CR37","doi-asserted-by":"crossref","unstructured":"Zhong, Y., Orlovich, M., Shen, X., Ding, C.: Array regrouping and structure splitting using whole-program reference affinity. In: Proc. of the ACM SIGPLAN 2004 Conference on Programming Language Design and Implementation, PLDI 2004(2004)","DOI":"10.1145\/996841.996872"}],"container-title":["Lecture Notes in Computer Science","Detection of Intrusions and Malware, and Vulnerability Assessment"],"original-title":[],"link":[{"URL":"http:\/\/link.springer.com\/content\/pdf\/10.1007\/978-3-319-08509-8_1","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2020,8,20]],"date-time":"2020-08-20T23:37:36Z","timestamp":1597966656000},"score":1,"resource":{"primary":{"URL":"http:\/\/link.springer.com\/10.1007\/978-3-319-08509-8_1"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2014]]},"ISBN":["9783319085081","9783319085098"],"references-count":37,"URL":"https:\/\/doi.org\/10.1007\/978-3-319-08509-8_1","relation":{},"ISSN":["0302-9743","1611-3349"],"issn-type":[{"type":"print","value":"0302-9743"},{"type":"electronic","value":"1611-3349"}],"subject":[],"published":{"date-parts":[[2014]]}}}