{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,10,17]],"date-time":"2025-10-17T14:08:58Z","timestamp":1760710138894,"version":"3.37.3"},"reference-count":37,"publisher":"Springer Science and Business Media LLC","issue":"3","license":[{"start":{"date-parts":[[2020,2,13]],"date-time":"2020-02-13T00:00:00Z","timestamp":1581552000000},"content-version":"tdm","delay-in-days":0,"URL":"http:\/\/www.springer.com\/tdm"},{"start":{"date-parts":[[2020,2,13]],"date-time":"2020-02-13T00:00:00Z","timestamp":1581552000000},"content-version":"vor","delay-in-days":0,"URL":"http:\/\/www.springer.com\/tdm"}],"funder":[{"DOI":"10.13039\/501100002322","name":"Capes","doi-asserted-by":"crossref","award":["FORTE"],"award-info":[{"award-number":["FORTE"]}],"id":[{"id":"10.13039\/501100002322","id-type":"DOI","asserted-by":"crossref"}]},{"name":"CNPQ","award":["UNIVERSAL 2018"],"award-info":[{"award-number":["UNIVERSAL 2018"]}]},{"name":"Serrapilheira","award":["01\/2018"],"award-info":[{"award-number":["01\/2018"]}]}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["J Comput Virol Hack Tech"],"published-print":{"date-parts":[[2020,9]]},"DOI":"10.1007\/s11416-020-00348-w","type":"journal-article","created":{"date-parts":[[2020,2,13]],"date-time":"2020-02-13T08:02:58Z","timestamp":1581580978000},"page":"185-196","update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":6,"title":["The self modifying code (SMC)-aware processor (SAP): a security look on architectural impact and support"],"prefix":"10.1007","volume":"16","author":[{"given":"Marcus","family":"Botacin","sequence":"first","affiliation":[]},{"given":"Marco","family":"Zanata","sequence":"additional","affiliation":[]},{"given":"Andr\u00e9","family":"Gr\u00e9gio","sequence":"additional","affiliation":[]}],"member":"297","published-online":{"date-parts":[[2020,2,13]]},"reference":[{"key":"348_CR1","unstructured":"AMD: AMD Secure Virtual Machine Architecture Reference Manual (2008). https:\/\/www.mimuw.edu.pl\/~vincent\/lecture6\/sources\/amd-pacifica-specification.pdf"},{"key":"348_CR2","unstructured":"ARM: Smc (2013). https:\/\/community.arm.com\/processors\/b\/blog\/posts\/caches-and-self-modifying-code"},{"key":"348_CR3","doi-asserted-by":"crossref","unstructured":"Babar, K., Khalid, F.: Generic unpacking techniques. In: International Conference on Computer, Control and Communication, pp. 1\u20136 (2009)","DOI":"10.1109\/IC4.2009.4909168"},{"issue":"1","key":"348_CR4","doi-asserted-by":"publisher","first-page":"60","DOI":"10.1145\/1353534.1346290","volume":"36","author":"CS Ballapuram","year":"2008","unstructured":"Ballapuram, C.S., Sharif, A., Lee, H.H.S.: Exploiting access semantics and program behavior to reduce snoop power in chip multiprocessors. SIGARCH Comput. Archit. News 36(1), 60\u201369 (2008)","journal-title":"SIGARCH Comput. Archit. News"},{"key":"348_CR5","doi-asserted-by":"crossref","unstructured":"Bonfante, G., Fernandez, J., Marion, J.Y., Rouxel, B., Sabatier, F., Thierry, A.: Codisasm: Medium scale concatic disassembly of self-modifying binaries with overlapping instructions. In: ACM SIGSAC Conference on Computer and Communications Security, pp. 745\u2013756 (2015)","DOI":"10.1145\/2810103.2813627"},{"key":"348_CR6","first-page":"211","volume":"3","author":"JM Borello","year":"2008","unstructured":"Borello, J.M., M\u00e9, L.: Code obfuscation techniques for metamorphic viruses. JICVHT 3, 211\u2013220 (2008)","journal-title":"JICVHT"},{"issue":"1","key":"348_CR7","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1145\/3152162","volume":"21","author":"M Botacin","year":"2018","unstructured":"Botacin, M., de Geus, P., Gr\u00e9gio, A.: Enhancing branch monitoring for security purposes: from control flow integrity to malware analysis and debugging. ACM Trans. Priv. Secur. 21(1), 1\u201330 (2018)","journal-title":"ACM Trans. Priv. Secur."},{"issue":"6","key":"348_CR8","doi-asserted-by":"publisher","first-page":"66","DOI":"10.1145\/1273442.1250743","volume":"42","author":"H Cai","year":"2007","unstructured":"Cai, H., Shao, Z., Vaynberg, A.: Certified self-modifying code. SIGPLAN Not. 42(6), 66\u201377 (2007)","journal-title":"SIGPLAN Not."},{"key":"348_CR9","doi-asserted-by":"publisher","unstructured":"Caserta, P., Zendra, O.: A tracing technique using dynamic bytecode instrumentation of java applications and libraries at basic block level. In: Proceedings of the 6th Workshop on Implementation, Compilation, Optimization of Object-Oriented Languages, Programs and Systems, ICOOOLPS\u201911, pp. 6:1\u20136:4. ACM, New York, NY, USA (2011). https:\/\/doi.org\/10.1145\/2069172.2069178","DOI":"10.1145\/2069172.2069178"},{"issue":"12","key":"348_CR10","doi-asserted-by":"publisher","first-page":"1112","DOI":"10.1109\/TC.1978.1675013","volume":"C\u201327","author":"F Censier","year":"1978","unstructured":"Censier, F.: A new solution to coherence problems in multicache systems. IEEE Trans. Comput. C\u201327(12), 1112\u20131118 (1978). https:\/\/doi.org\/10.1109\/TC.1978.1675013","journal-title":"IEEE Trans. Comput."},{"key":"348_CR11","unstructured":"Coke, J., Baliga, H., Cooray, N., Gamsaragan, E., Smith, P., Yoon, K., Abel, J., Valles., A.: Improvements in the Intel\u2019s Core2 penryn processor family architecture and microarchitecture (2008)"},{"key":"348_CR12","doi-asserted-by":"crossref","unstructured":"Debray, S., Patel, J.: Reverse engineering self-modifying code: unpacker extraction. In: Working Conference on Reverse Engineering, pp. 131\u2013140 (2010)","DOI":"10.1109\/WCRE.2010.22"},{"key":"348_CR13","unstructured":"Dehnert, J., Grant, B., Banning, J., Johnson, R., Kistler, T., Klaiber, A., Mattson, J.: The transmeta code morphing trade; software: using speculation, recovery, and adaptive retranslation to address real-life challenges. In: International Symposium on Code Generation and Optimization: Feedback-Directed and Runtime Optimization, pp. 15\u201324. IEEE Computer Society (2003)"},{"key":"348_CR14","doi-asserted-by":"crossref","unstructured":"Dinaburg, A., Royal, P., Sharif, M., Lee, W.: Ether: malware analysis via hardware virtualization extensions. In: ACM Conference on Computer and Communications Security, pp. 51\u201362 (2008)","DOI":"10.1145\/1455770.1455779"},{"issue":"2","key":"348_CR15","doi-asserted-by":"publisher","first-page":"26:1","DOI":"10.1145\/3158644","volume":"51","author":"M Gebai","year":"2018","unstructured":"Gebai, M., Dagenais, M.R.: Survey and analysis of kernel and userspace tracers on linux: design, implementation, and overhead. ACM Comput. Surv. 51(2), 26:1\u201326:33 (2018). https:\/\/doi.org\/10.1145\/3158644","journal-title":"ACM Comput. Surv."},{"key":"348_CR16","doi-asserted-by":"crossref","unstructured":"Gruss, D., Maurice, C., Wagner, K., Mangard, S.: Flush+flush: a fast and stealthy cache attack. In: Interenational Conference on Detection of Intrusions and Malware, and Vulnerability Assessment, pp. 279\u2013299 (2016)","DOI":"10.1007\/978-3-319-40667-1_14"},{"key":"348_CR17","doi-asserted-by":"crossref","unstructured":"Gutierrez, A., Pusdesris, J., Dreslinski, R.G., Mudge, T.: Lazy cache invalidation for self-modifying codes. In: International Conference on Compilers, Architectures and Synthesis for Embedded Systems, pp. 151\u2013160 (2012)","DOI":"10.1145\/2380403.2380433"},{"key":"348_CR18","unstructured":"Intel: Intel 64 and IA-32 Architectures Software Developer\u2019s Manual. Intel (2013). https:\/\/www.intel.com.br\/content\/www\/br\/pt\/architecture-and-technology\/64-ia-32-architectures-software-developersystem-programming-manual-325384.html"},{"key":"348_CR19","first-page":"299","volume-title":"Wait a Minute! A Fast, Cross-VM Attack on AES","author":"MS Inci","year":"2014","unstructured":"Inci, M.S., Eisenbarth, T., Sunar, B.: Wait a Minute! A Fast, Cross-VM Attack on AES, pp. 299\u2013319. Springer, Springer (2014)"},{"key":"348_CR20","doi-asserted-by":"crossref","unstructured":"Korczynski, D.: Repeconstruct: reconstructing binaries with self-modifying code and import address table destruction. In: International Conference on Malicious and Unwanted Software, pp. 1\u20138 (2016)","DOI":"10.1109\/MALWARE.2016.7888727"},{"key":"348_CR21","doi-asserted-by":"crossref","unstructured":"Liu, A., Wang, W.: Ascms: an accurate self-modifying code cache management strategy in binary translation. In: International Conference on Information Science and Cloud Computing Companion, pp. 405\u2013410 (2013)","DOI":"10.1109\/ISCC-C.2013.52"},{"key":"348_CR22","doi-asserted-by":"publisher","unstructured":"Luk, C.K., Cohn, R., Muth, R., Patil, H., Klauser, A., Lowney, G., Wallace, S., Reddi, V.J., Hazelwood, K.: Pin: building customized program analysis tools with dynamic instrumentation. In: Proceedings of the 2005 ACM SIGPLAN Conference on Programming Language Design and Implementation, PLDI\u201905, pp. 190\u2013200. ACM, New York, NY, USA (2005). https:\/\/doi.org\/10.1145\/1065010.1065034","DOI":"10.1145\/1065010.1065034"},{"key":"348_CR23","unstructured":"Maebe, J., De\u00a0Bosschere, K.: Self-modifying Code (2003). arXiv:cs\/0309029"},{"key":"348_CR24","doi-asserted-by":"publisher","unstructured":"Martignoni, L., Christodorescu, M., Jha, S.: Omniunpack: fast, generic, and safe unpacking of malware. In: Twenty-Third Annual Computer Security Applications Conference (ACSAC 2007), pp. 431\u2013441 (2007). https:\/\/doi.org\/10.1109\/ACSAC.2007.15","DOI":"10.1109\/ACSAC.2007.15"},{"key":"348_CR25","unstructured":"Microsoft: x64 intrinsics. https:\/\/msdn.microsoft.com\/en-us\/library\/hh977022.aspx"},{"issue":"11","key":"348_CR26","doi-asserted-by":"publisher","first-page":"13","DOI":"10.1145\/141018.141021","volume":"27","author":"RP Mody","year":"1992","unstructured":"Mody, R.P.: Functional programming is not self-modifying code. SIGPLAN Not. 27(11), 13\u201314 (1992)","journal-title":"SIGPLAN Not."},{"key":"348_CR27","doi-asserted-by":"publisher","unstructured":"Moret, P., Binder, W., Tanter, E.: Polymorphic bytecode instrumentation. In: Proceedings of the Tenth International Conference on Aspect-oriented Software Development, AOSD\u201911, pp. 129\u2013140. ACM, New York, NY, USA (2011). https:\/\/doi.org\/10.1145\/1960275.1960292","DOI":"10.1145\/1960275.1960292"},{"key":"348_CR28","unstructured":"Neiger, G.,, Santoni, A., Leung, F., Rodgers, D., Uhlig, R.: Intel virtualization technology: hardware support for efficient processor virtualization (2006). https:\/\/www.ece.cmu.edu\/~ece845\/docs\/vt-overview-itj06.pdf. Accessed Jan 2019"},{"key":"348_CR29","unstructured":"Ray, K., Kramer, M., England, P., Field, S.: On-access scan of memory for malware, US Patent 7,836,504 (2010)"},{"issue":"1","key":"348_CR30","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1145\/2133375.2133377","volume":"15","author":"R Roemer","year":"2012","unstructured":"Roemer, R., Buchanan, E., Shacham, H., Savage, S.: Return-oriented programming: systems, languages, and applications. ACM Trans. Inf. Syst. Secur. 15(1), 1\u201334 (2012)","journal-title":"ACM Trans. Inf. Syst. Secur."},{"key":"348_CR31","unstructured":"Shar, L.E., Lawton, K.P.: Trace cache for efficient self-modifying code processing, US Patent 7,606,975 (2009)"},{"issue":"1","key":"348_CR32","doi-asserted-by":"publisher","first-page":"90","DOI":"10.1145\/1055626.1055639","volume":"33","author":"D Uluski","year":"2005","unstructured":"Uluski, D., Moffie, M., Kaeli, D.: Characterizing antivirus workload execution. SIGARCH Comput. Archit. News 33(1), 90\u201398 (2005). https:\/\/doi.org\/10.1145\/1055626.1055639","journal-title":"SIGARCH Comput. Archit. News"},{"key":"348_CR33","doi-asserted-by":"crossref","unstructured":"Willems, C., Hund, R., Fobian, A., Felsch, D., Holz, T., Vasudevan, A.: Down to the bare metal: using processor features for binary analysis. In: ACSAC, pp. 189\u2013198 (2012)","DOI":"10.1145\/2420950.2420980"},{"key":"348_CR34","doi-asserted-by":"crossref","unstructured":"Wu, M., Zhang, Y., Mi, X.: Binary protection using dynamic fine-grained code hiding and obfuscation. In: International Conference on Information and Network Security, pp. 1\u20138 (2016)","DOI":"10.1145\/3026724.3026726"},{"key":"348_CR35","doi-asserted-by":"crossref","unstructured":"Xianya, M., Yi, Z., Baosheng, W., Yong, T.: A survey of software protection methods based on self-modifying code. In: International Conference on Computational Intelligence and Communication Networks, pp. 589\u2013593 (2015)","DOI":"10.1109\/CICN.2015.121"},{"key":"348_CR36","unstructured":"Yarom, Y., Falkner, K.: Flush+reload: a high resolution, low noise, l3 cache side-channel attack. In: USENIX Security, pp. 719\u2013732 (2014)"},{"key":"348_CR37","unstructured":"Zaidi, N.: System and method for tracking in-flight instructions in a pipeline, US Patent 6,237,088 (2001)"}],"container-title":["Journal of Computer Virology and Hacking Techniques"],"original-title":[],"language":"en","link":[{"URL":"http:\/\/link.springer.com\/content\/pdf\/10.1007\/s11416-020-00348-w.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"http:\/\/link.springer.com\/article\/10.1007\/s11416-020-00348-w\/fulltext.html","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"http:\/\/link.springer.com\/content\/pdf\/10.1007\/s11416-020-00348-w.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2021,2,12]],"date-time":"2021-02-12T00:51:18Z","timestamp":1613091078000},"score":1,"resource":{"primary":{"URL":"http:\/\/link.springer.com\/10.1007\/s11416-020-00348-w"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2020,2,13]]},"references-count":37,"journal-issue":{"issue":"3","published-print":{"date-parts":[[2020,9]]}},"alternative-id":["348"],"URL":"https:\/\/doi.org\/10.1007\/s11416-020-00348-w","relation":{},"ISSN":["2263-8733"],"issn-type":[{"type":"electronic","value":"2263-8733"}],"subject":[],"published":{"date-parts":[[2020,2,13]]},"assertion":[{"value":"7 February 2019","order":1,"name":"received","label":"Received","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"4 February 2020","order":2,"name":"accepted","label":"Accepted","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"13 February 2020","order":3,"name":"first_online","label":"First Online","group":{"name":"ArticleHistory","label":"Article History"}}]}}