{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,6,25]],"date-time":"2025-06-25T13:50:59Z","timestamp":1750859459000,"version":"3.41.0"},"publisher-location":"New York, NY, USA","reference-count":36,"publisher":"ACM","license":[{"start":{"date-parts":[[2012,12,3]],"date-time":"2012-12-03T00:00:00Z","timestamp":1354492800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"funder":[{"DOI":"10.13039\/501100002347","name":"Bundesministerium f\u00fcr Bildung und Forschung","doi-asserted-by":"publisher","award":["01BY-1205A"],"award-info":[{"award-number":["01BY-1205A"]}],"id":[{"id":"10.13039\/501100002347","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2012,12,3]]},"DOI":"10.1145\/2420950.2420979","type":"proceedings-article","created":{"date-parts":[[2012,12,19]],"date-time":"2012-12-19T14:12:22Z","timestamp":1355926342000},"page":"179-188","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":8,"title":["Using memory management to detect and extract illegitimate code for malware analysis"],"prefix":"10.1145","author":[{"given":"Carsten","family":"Willems","sequence":"first","affiliation":[{"name":"Ruhr-University Bochum, Germany"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Felix C.","family":"Freiling","sequence":"additional","affiliation":[{"name":"Friedrich-Alexander University of Erlangen-Nuremberg, Germany"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Thorsten","family":"Holz","sequence":"additional","affiliation":[{"name":"Ruhr-University Bochum, Germany"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"320","published-online":{"date-parts":[[2012,12,3]]},"reference":[{"key":"e_1_3_2_1_1_1","doi-asserted-by":"publisher","DOI":"10.1145\/1102120.1102165"},{"key":"e_1_3_2_1_2_1","doi-asserted-by":"publisher","DOI":"10.1007\/0-387-25660-1_25"},{"key":"e_1_3_2_1_3_1","unstructured":"P. Baecher and M. Koetter. libemu - x86 shellcode detection and emulation 2007. http:\/\/libemu.carnivore.it\/.  P. Baecher and M. Koetter. libemu - x86 shellcode detection and emulation 2007. http:\/\/libemu.carnivore.it\/."},{"volume-title":"USENIX Workshop on Offensive Technologies (WOOT)","year":"2010","author":"Blazakis Dionysus","key":"e_1_3_2_1_4_1"},{"key":"e_1_3_2_1_5_1","unstructured":"contagio Website. Malware Sample Dump For CVE-2011-0611 Flash Player Zero day. http:\/\/contagiodump.blogspot.com\/2011\/04\/apr-8-cve-2011-0611-flash-player-zero.html.  contagio Website. Malware Sample Dump For CVE-2011-0611 Flash Player Zero day. http:\/\/contagiodump.blogspot.com\/2011\/04\/apr-8-cve-2011-0611-flash-player-zero.html."},{"key":"e_1_3_2_1_6_1","doi-asserted-by":"publisher","DOI":"10.1145\/1772690.1772720"},{"key":"e_1_3_2_1_7_1","doi-asserted-by":"publisher","DOI":"10.1145\/1774088.1774482"},{"key":"e_1_3_2_1_8_1","doi-asserted-by":"publisher","DOI":"10.1145\/1455770.1455779"},{"key":"e_1_3_2_1_9_1","unstructured":"Adobe Systems Incorporated. Document management portable document format part 1: Pdf 1.7 2008.  Adobe Systems Incorporated. Document management portable document format part 1: Pdf 1.7 2008."},{"volume-title":"Specification","year":"2007","author":"Intel Corporation","key":"e_1_3_2_1_10_1"},{"key":"e_1_3_2_1_11_1","unstructured":"Christopher Jordan. Writing detection signatures. USENIX; login: 30(6): 55--61 2005.  Christopher Jordan. Writing detection signatures. USENIX; login: 30(6): 55--61 2005."},{"key":"e_1_3_2_1_12_1","doi-asserted-by":"publisher","DOI":"10.1145\/1314389.1314399"},{"key":"e_1_3_2_1_13_1","doi-asserted-by":"publisher","DOI":"10.5555\/647253.720293"},{"volume-title":"USENIX Security Symposium","year":"2008","author":"Litty Lionel","key":"e_1_3_2_1_14_1"},{"key":"e_1_3_2_1_15_1","doi-asserted-by":"publisher","DOI":"10.1109\/ACSAC.2007.15"},{"key":"e_1_3_2_1_16_1","unstructured":"Microsoft. Enhanced mitigation experience toolkit (EMET). http:\/\/support.microsoft.com\/kb\/2458544\/de.  Microsoft. Enhanced mitigation experience toolkit (EMET). http:\/\/support.microsoft.com\/kb\/2458544\/de."},{"key":"e_1_3_2_1_17_1","unstructured":"MSDN. A detailed description of the data execution prevention (DEP) feature. http:\/\/support.microsoft.com\/kb\/875352\/en-us.  MSDN. A detailed description of the data execution prevention (DEP) feature. http:\/\/support.microsoft.com\/kb\/875352\/en-us."},{"key":"e_1_3_2_1_18_1","doi-asserted-by":"publisher","DOI":"10.1007\/11506881_2"},{"key":"e_1_3_2_1_19_1","doi-asserted-by":"publisher","DOI":"10.1007\/11790754_4"},{"key":"e_1_3_2_1_20_1","unstructured":"Sebastian Porst. Dumping shellcode with Pin. http:\/\/blog.zynamics.com\/2010\/07\/28\/dumping-shellcode-with-pin\/.  Sebastian Porst. Dumping shellcode with Pin. http:\/\/blog.zynamics.com\/2010\/07\/28\/dumping-shellcode-with-pin\/."},{"key":"e_1_3_2_1_21_1","unstructured":"Rapid7. The metasploit framework. http:\/\/metasploit.com\/.  Rapid7. The metasploit framework. http:\/\/metasploit.com\/."},{"key":"e_1_3_2_1_22_1","unstructured":"Karthik Selvaraj and Nino Fred Gutierrez. The rise of PDF malware. http:\/\/www.symantec.com\/content\/en\/us\/enterprise\/media\/security_response\/whitepapers\/the_rise_of_pdf_malware.pdf 2010.  Karthik Selvaraj and Nino Fred Gutierrez. The rise of PDF malware. http:\/\/www.symantec.com\/content\/en\/us\/enterprise\/media\/security_response\/whitepapers\/the_rise_of_pdf_malware.pdf 2010."},{"key":"e_1_3_2_1_23_1","doi-asserted-by":"publisher","DOI":"10.1145\/1294261.1294294"},{"key":"e_1_3_2_1_24_1","doi-asserted-by":"publisher","DOI":"10.1145\/1315245.1315313"},{"key":"e_1_3_2_1_25_1","unstructured":"Alexey Sintsov. Writing JIT-spray shellcode for fun and profit. http:\/\/dsecrg.com\/pages\/pub\/show.php?id=22.  Alexey Sintsov. Writing JIT-spray shellcode for fun and profit. http:\/\/dsecrg.com\/pages\/pub\/show.php?id=22."},{"key":"e_1_3_2_1_26_1","unstructured":"Hispasec Sistemas. Virus total. http:\/\/www.virustotal.com\/.  Hispasec Sistemas. Virus total. http:\/\/www.virustotal.com\/."},{"volume-title":"USENIX Security Symposium","year":"2011","author":"Snow Kevin Z.","key":"e_1_3_2_1_27_1"},{"key":"e_1_3_2_1_28_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-540-89862-7_1"},{"key":"e_1_3_2_1_29_1","unstructured":"Didier Stevens. http:\/\/blog.didierstevens.com\/2010\/03\/29\/escape-from-pdf\/ 2010.  Didier Stevens. http:\/\/blog.didierstevens.com\/2010\/03\/29\/escape-from-pdf\/ 2010."},{"key":"e_1_3_2_1_30_1","unstructured":"Didier Stevens. http:\/\/blog.didierstevens.com\/2010\/03\/31\/escape-from-foxit-reader\/ 2010.  Didier Stevens. http:\/\/blog.didierstevens.com\/2010\/03\/31\/escape-from-foxit-reader\/ 2010."},{"key":"e_1_3_2_1_31_1","first-page":"14","author":"Stewart Joe","year":"2006","journal-title":"Defcon"},{"key":"e_1_3_2_1_32_1","unstructured":"PaX Team. Documentation for the PaX project - overall description. http:\/\/pax.grsecurity.net\/docs\/pax.txt 2008.  PaX Team. Documentation for the PaX project - overall description. http:\/\/pax.grsecurity.net\/docs\/pax.txt 2008."},{"key":"e_1_3_2_1_33_1","unstructured":"The Pax team. PaX address space layout randomization (ASLR). http:\/\/pax.grsecurity.net\/docs\/aslr.txt 2003.  The Pax team. PaX address space layout randomization (ASLR). http:\/\/pax.grsecurity.net\/docs\/aslr.txt 2003."},{"key":"e_1_3_2_1_34_1","unstructured":"Malware Tracker. pdf examiner. http:\/\/www.malwaretracker.com\/pdf.php.  Malware Tracker. pdf examiner. http:\/\/www.malwaretracker.com\/pdf.php."},{"volume-title":"University of Mannheim","year":"2011","author":"Willems Carsten","key":"e_1_3_2_1_35_1"},{"volume-title":"University of Erlangen","year":"2012","author":"Willems Carsten","key":"e_1_3_2_1_36_1"}],"event":{"name":"ACSAC '12: Annual Computer Security Applications Conference","sponsor":["ACSA Applied Computing Security Assoc"],"location":"Orlando Florida USA","acronym":"ACSAC '12"},"container-title":["Proceedings of the 28th Annual Computer Security Applications Conference"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/2420950.2420979","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/2420950.2420979","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,18]],"date-time":"2025-06-18T09:33:57Z","timestamp":1750239237000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/2420950.2420979"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2012,12,3]]},"references-count":36,"alternative-id":["10.1145\/2420950.2420979","10.1145\/2420950"],"URL":"https:\/\/doi.org\/10.1145\/2420950.2420979","relation":{},"subject":[],"published":{"date-parts":[[2012,12,3]]},"assertion":[{"value":"2012-12-03","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}