{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,2,1]],"date-time":"2026-02-01T05:05:03Z","timestamp":1769922303869,"version":"3.49.0"},"publisher-location":"New York, NY, USA","reference-count":38,"publisher":"ACM","license":[{"start":{"date-parts":[[2016,5,30]],"date-time":"2016-05-30T00:00:00Z","timestamp":1464566400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"funder":[{"name":"National Science Foundation","award":["1054605"],"award-info":[{"award-number":["1054605"]}]},{"name":"Air Force Research Lab","award":["FA8750-15-2-0106"],"award-info":[{"award-number":["FA8750-15-2-0106"]}]},{"name":"DARPA CGC","award":["FA8750-14-C-0118"],"award-info":[{"award-number":["FA8750-14-C-0118"]}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2016,5,30]]},"DOI":"10.1145\/2897845.2897850","type":"proceedings-article","created":{"date-parts":[[2016,5,27]],"date-time":"2016-05-27T12:37:36Z","timestamp":1464352656000},"page":"11-22","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":8,"title":["ORIGEN"],"prefix":"10.1145","author":[{"given":"Qian","family":"Feng","sequence":"first","affiliation":[{"name":"Syracuse University, Syracuse, NY, USA"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Aravind","family":"Prakash","sequence":"additional","affiliation":[{"name":"Binghamton University, Binghamton, NY, USA"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Minghua","family":"Wang","sequence":"additional","affiliation":[{"name":"Baidu Inc., Beijing, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Curtis","family":"Carmony","sequence":"additional","affiliation":[{"name":"Syracuse University, Syracuse, NY, USA"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Heng","family":"Yin","sequence":"additional","affiliation":[{"name":"Syracuse University, Syracuse, NY, USA"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"320","published-online":{"date-parts":[[2016,5,30]]},"reference":[{"key":"e_1_3_2_1_1_1","unstructured":"Insight-VMI A semantic bridge for virtual machine introspection and forensic applications. https:\/\/code.google.com\/p\/insight-vmi\/wiki\/LinuxDebugSymbols.  Insight-VMI A semantic bridge for virtual machine introspection and forensic applications. https:\/\/code.google.com\/p\/insight-vmi\/wiki\/LinuxDebugSymbols."},{"key":"e_1_3_2_1_2_1","unstructured":"Linux memory forensics using Volatility -- Prerequisites. https:\/\/code.google.com\/p\/volatility\/wiki\/LinuxMemoryForensics.  Linux memory forensics using Volatility -- Prerequisites. https:\/\/code.google.com\/p\/volatility\/wiki\/LinuxMemoryForensics."},{"key":"e_1_3_2_1_3_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2011.28"},{"key":"e_1_3_2_1_4_1","unstructured":"F. Chagnon. IDA Decompiler. https:\/\/github.com\/EiNSTeiN-\/ida-decompiler.  F. Chagnon. IDA Decompiler. https:\/\/github.com\/EiNSTeiN-\/ida-decompiler."},{"key":"e_1_3_2_1_5_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2010.12"},{"key":"e_1_3_2_1_6_1","doi-asserted-by":"publisher","DOI":"10.1145\/2594291.2594343"},{"key":"e_1_3_2_1_7_1","doi-asserted-by":"publisher","DOI":"10.1145\/2666356.2594343"},{"key":"e_1_3_2_1_8_1","doi-asserted-by":"publisher","DOI":"10.1145\/1455770.1455779"},{"key":"e_1_3_2_1_9_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2011.11"},{"key":"e_1_3_2_1_10_1","first-page":"1","article-title":"Graph-based comparison of executable objects (english version)","volume":"5","author":"Dullien T.","year":"2005","unstructured":"T. Dullien and R. Rolles . Graph-based comparison of executable objects (english version) . SSTIC , 5 : 1 -- 3 , 2005 . T. Dullien and R. Rolles. Graph-based comparison of executable objects (english version). SSTIC, 5:1--3, 2005.","journal-title":"SSTIC"},{"key":"e_1_3_2_1_11_1","first-page":"303","volume-title":"23rd USENIX Security Symposium (USENIX Security 14)","author":"Egele M.","year":"2014","unstructured":"M. Egele , M. Woo , P. Chapman , and D. Brumley . Blanket execution: Dynamic similarity testing for program binaries and components . In 23rd USENIX Security Symposium (USENIX Security 14) , pages 303 -- 317 . USENIX Association , Aug. 2014 . M. Egele, M. Woo, P. Chapman, and D. Brumley. Blanket execution: Dynamic similarity testing for program binaries and components. In 23rd USENIX Security Symposium (USENIX Security 14), pages 303--317. USENIX Association, Aug. 2014."},{"key":"e_1_3_2_1_12_1","doi-asserted-by":"publisher","DOI":"10.1145\/2664243.2664248"},{"key":"e_1_3_2_1_13_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2012.40"},{"key":"e_1_3_2_1_14_1","doi-asserted-by":"publisher","DOI":"10.1145\/2786805.2786810"},{"key":"e_1_3_2_1_15_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-540-88625-9_16"},{"key":"e_1_3_2_1_16_1","first-page":"191","volume-title":"Proceedings of Network and Distributed Systems Security Symposium(NDSS'03)","volume":"3","author":"Garfinkel T.","year":"2003","unstructured":"T. Garfinkel and M. Rosenblum . A virtual machine introspection based architecture for intrusion detection . In Proceedings of Network and Distributed Systems Security Symposium(NDSS'03) , volume 3 , pages 191 -- 206 , 2003 . T. Garfinkel and M. Rosenblum. A virtual machine introspection based architecture for intrusion detection. In Proceedings of Network and Distributed Systems Security Symposium(NDSS'03), volume 3, pages 191--206, 2003."},{"key":"e_1_3_2_1_17_1","doi-asserted-by":"publisher","DOI":"10.1145\/1368506.1368517"},{"key":"e_1_3_2_1_18_1","doi-asserted-by":"publisher","DOI":"10.1145\/2610384.2610407"},{"key":"e_1_3_2_1_19_1","doi-asserted-by":"publisher","DOI":"10.1145\/1653662.1653736"},{"key":"e_1_3_2_1_20_1","doi-asserted-by":"publisher","DOI":"10.5555\/2534766.2534774"},{"key":"e_1_3_2_1_21_1","doi-asserted-by":"publisher","DOI":"10.1145\/1315245.1315262"},{"key":"e_1_3_2_1_22_1","doi-asserted-by":"publisher","DOI":"10.5555\/2487085.2487147"},{"key":"e_1_3_2_1_23_1","doi-asserted-by":"publisher","DOI":"10.1007\/11663812_11"},{"key":"e_1_3_2_1_24_1","doi-asserted-by":"publisher","DOI":"10.1145\/2430553.2430558"},{"key":"e_1_3_2_1_25_1","volume-title":"Proceedings of the 17th Annual Network and Distributed System Security Symposium(NDSS'10)","author":"Lin Z.","year":"2010","unstructured":"Z. Lin , X. Zhang , and D. Xu . Automatic reverse engineering of data structures from binary execution . In Proceedings of the 17th Annual Network and Distributed System Security Symposium(NDSS'10) , February 2010 . Z. Lin, X. Zhang, and D. Xu. Automatic reverse engineering of data structures from binary execution. In Proceedings of the 17th Annual Network and Distributed System Security Symposium(NDSS'10), February 2010."},{"key":"e_1_3_2_1_26_1","unstructured":"MANDIANT Memoryze. http:\/\/www.mandiant.com\/resources\/download\/memoryze.  MANDIANT Memoryze. http:\/\/www.mandiant.com\/resources\/download\/memoryze."},{"key":"e_1_3_2_1_27_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-37682-5_8"},{"key":"e_1_3_2_1_28_1","volume-title":"Morgan Kaufmann","author":"Muchnick S. S.","year":"1997","unstructured":"S. S. Muchnick . Advanced Compiler Design and Implementation . Morgan Kaufmann , 1997 . S. S. Muchnick. Advanced Compiler Design and Implementation. Morgan Kaufmann, 1997."},{"key":"e_1_3_2_1_29_1","doi-asserted-by":"publisher","DOI":"10.1109\/COMPSAC.2013.83"},{"key":"e_1_3_2_1_30_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2008.24"},{"key":"e_1_3_2_1_31_1","doi-asserted-by":"publisher","DOI":"10.1109\/ACSAC.2007.10"},{"key":"e_1_3_2_1_32_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.diin.2006.10.001"},{"key":"e_1_3_2_1_33_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2015.49"},{"key":"e_1_3_2_1_34_1","doi-asserted-by":"publisher","DOI":"10.1145\/2664243.2664269"},{"key":"e_1_3_2_1_35_1","doi-asserted-by":"publisher","DOI":"10.1145\/2810103.2813720"},{"key":"e_1_3_2_1_36_1","doi-asserted-by":"publisher","DOI":"10.1145\/2509136.2509509"},{"key":"e_1_3_2_1_37_1","volume-title":"Proceedings of the 18th Annual Network and Distributed System Security Symposium (NDSS'11)","author":"Slowinska A.","year":"2011","unstructured":"A. Slowinska , T. Stancescu , and H. Bos . Howard: a dynamic excavator for reverse engineering data structures . In Proceedings of the 18th Annual Network and Distributed System Security Symposium (NDSS'11) , 2011 . A. Slowinska, T. Stancescu, and H. Bos. Howard: a dynamic excavator for reverse engineering data structures. In Proceedings of the 18th Annual Network and Distributed System Security Symposium (NDSS'11), 2011."},{"key":"e_1_3_2_1_38_1","unstructured":"Volatility: Memory Forencis System. https:\/\/www.volatilesystems.com\/default\/volatility\/.  Volatility: Memory Forencis System. https:\/\/www.volatilesystems.com\/default\/volatility\/."}],"event":{"name":"ASIA CCS '16: ACM Asia Conference on Computer and Communications Security","location":"Xi'an China","acronym":"ASIA CCS '16","sponsor":["SIGSAC ACM Special Interest Group on Security, Audit, and Control"]},"container-title":["Proceedings of the 11th ACM on Asia Conference on Computer and Communications Security"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/2897845.2897850","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/2897845.2897850","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,18]],"date-time":"2025-06-18T05:07:01Z","timestamp":1750223221000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/2897845.2897850"}},"subtitle":["Automatic Extraction of Offset-Revealing Instructions for Cross-Version Memory Analysis"],"short-title":[],"issued":{"date-parts":[[2016,5,30]]},"references-count":38,"alternative-id":["10.1145\/2897845.2897850","10.1145\/2897845"],"URL":"https:\/\/doi.org\/10.1145\/2897845.2897850","relation":{},"subject":[],"published":{"date-parts":[[2016,5,30]]},"assertion":[{"value":"2016-05-30","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}