{"id":"https://openalex.org/W3180919983","doi":"https://doi.org/10.1145/3460319.3464839","title":"Parema: an unpacking framework for demystifying VM-based Android packers","display_name":"Parema: an unpacking framework for demystifying VM-based Android packers","publication_year":2021,"publication_date":"2021-07-08","ids":{"openalex":"https://openalex.org/W3180919983","doi":"https://doi.org/10.1145/3460319.3464839","mag":"3180919983"},"language":"en","primary_location":{"id":"doi:10.1145/3460319.3464839","is_oa":false,"landing_page_url":"https://doi.org/10.1145/3460319.3464839","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 30th ACM SIGSOFT International Symposium on Software Testing and Analysis","raw_type":"proceedings-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5071512410","display_name":"Lei Xue","orcid":"https://orcid.org/0000-0001-5321-5740"},"institutions":[{"id":"https://openalex.org/I14243506","display_name":"Hong Kong Polytechnic University","ror":"https://ror.org/0030zas98","country_code":"HK","type":"education","lineage":["https://openalex.org/I14243506"]}],"countries":["HK"],"is_corresponding":true,"raw_author_name":"Lei Xue","raw_affiliation_strings":["Hong Kong Polytechnic University, China"],"affiliations":[{"raw_affiliation_string":"Hong Kong Polytechnic University, China","institution_ids":["https://openalex.org/I14243506"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100531485","display_name":"Yuxiao Yan","orcid":null},"institutions":[{"id":"https://openalex.org/I87445476","display_name":"Xi'an Jiaotong University","ror":"https://ror.org/017zhmm22","country_code":"CN","type":"education","lineage":["https://openalex.org/I87445476"]},{"id":"https://openalex.org/I14243506","display_name":"Hong Kong Polytechnic University","ror":"https://ror.org/0030zas98","country_code":"HK","type":"education","lineage":["https://openalex.org/I14243506"]}],"countries":["CN","HK"],"is_corresponding":false,"raw_author_name":"Yuxiao Yan","raw_affiliation_strings":["Xi'an Jiaotong University, China / Hong Kong Polytechnic University, China"],"affiliations":[{"raw_affiliation_string":"Xi'an Jiaotong University, China / Hong Kong Polytechnic University, China","institution_ids":["https://openalex.org/I14243506","https://openalex.org/I87445476"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5044913537","display_name":"Luyi Yan","orcid":"https://orcid.org/0000-0001-8644-9770"},"institutions":[{"id":"https://openalex.org/I14243506","display_name":"Hong Kong Polytechnic University","ror":"https://ror.org/0030zas98","country_code":"HK","type":"education","lineage":["https://openalex.org/I14243506"]}],"countries":["HK"],"is_corresponding":false,"raw_author_name":"Luyi Yan","raw_affiliation_strings":["Hong Kong Polytechnic University, China"],"affiliations":[{"raw_affiliation_string":"Hong Kong Polytechnic University, China","institution_ids":["https://openalex.org/I14243506"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5067240337","display_name":"Muhui Jiang","orcid":"https://orcid.org/0000-0003-2196-6894"},"institutions":[{"id":"https://openalex.org/I14243506","display_name":"Hong Kong Polytechnic University","ror":"https://ror.org/0030zas98","country_code":"HK","type":"education","lineage":["https://openalex.org/I14243506"]}],"countries":["HK"],"is_corresponding":false,"raw_author_name":"Muhui Jiang","raw_affiliation_strings":["Hong Kong Polytechnic University, China"],"affiliations":[{"raw_affiliation_string":"Hong Kong Polytechnic University, China","institution_ids":["https://openalex.org/I14243506"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100400376","display_name":"Xiapu Luo","orcid":"https://orcid.org/0000-0002-9082-3208"},"institutions":[{"id":"https://openalex.org/I14243506","display_name":"Hong Kong Polytechnic University","ror":"https://ror.org/0030zas98","country_code":"HK","type":"education","lineage":["https://openalex.org/I14243506"]}],"countries":["HK"],"is_corresponding":false,"raw_author_name":"Xiapu Luo","raw_affiliation_strings":["Hong Kong Polytechnic University, China"],"affiliations":[{"raw_affiliation_string":"Hong Kong Polytechnic University, China","institution_ids":["https://openalex.org/I14243506"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5008435786","display_name":"Dinghao Wu","orcid":"https://orcid.org/0000-0002-0741-5511"},"institutions":[{"id":"https://openalex.org/I130769515","display_name":"Pennsylvania State University","ror":"https://ror.org/04p491231","country_code":"US","type":"education","lineage":["https://openalex.org/I130769515"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Dinghao Wu","raw_affiliation_strings":["Pennsylvania State University, USA"],"affiliations":[{"raw_affiliation_string":"Pennsylvania State University, USA","institution_ids":["https://openalex.org/I130769515"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5088790914","display_name":"Yajin Zhou","orcid":"https://orcid.org/0000-0001-7610-4736"},"institutions":[{"id":"https://openalex.org/I76130692","display_name":"Zhejiang University","ror":"https://ror.org/00a2xv884","country_code":"CN","type":"education","lineage":["https://openalex.org/I76130692"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Yajin Zhou","raw_affiliation_strings":["Zhejiang University, China"],"affiliations":[{"raw_affiliation_string":"Zhejiang University, China","institution_ids":["https://openalex.org/I76130692"]}]}],"institutions":[],"countries_distinct_count":3,"institutions_distinct_count":7,"corresponding_author_ids":["https://openalex.org/A5071512410"],"corresponding_institution_ids":["https://openalex.org/I14243506"],"apc_list":null,"apc_paid":null,"fwci":0.9233,"has_fulltext":false,"cited_by_count":11,"citation_normalized_percentile":{"value":0.74129253,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":89,"max":99},"biblio":{"volume":null,"issue":null,"first_page":"152","last_page":"164"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.9990000128746033,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10743","display_name":"Software Testing and Debugging Techniques","score":0.9943000078201294,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/unpacking","display_name":"Unpacking","score":0.9250606298446655},{"id":"https://openalex.org/keywords/bytecode","display_name":"Bytecode","score":0.9161649942398071},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.7506572008132935},{"id":"https://openalex.org/keywords/android","display_name":"Android (operating system)","score":0.6973022222518921},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.533024787902832},{"id":"https://openalex.org/keywords/operating-system","display_name":"Operating system","score":0.5053616166114807},{"id":"https://openalex.org/keywords/virtual-machine","display_name":"Virtual machine","score":0.42414456605911255},{"id":"https://openalex.org/keywords/android-application","display_name":"Android application","score":0.4159567952156067}],"concepts":[{"id":"https://openalex.org/C2777256151","wikidata":"https://www.wikidata.org/wiki/Q7897273","display_name":"Unpacking","level":2,"score":0.9250606298446655},{"id":"https://openalex.org/C2779818221","wikidata":"https://www.wikidata.org/wiki/Q837330","display_name":"Bytecode","level":3,"score":0.9161649942398071},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7506572008132935},{"id":"https://openalex.org/C557433098","wikidata":"https://www.wikidata.org/wiki/Q94","display_name":"Android (operating system)","level":2,"score":0.6973022222518921},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.533024787902832},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.5053616166114807},{"id":"https://openalex.org/C25344961","wikidata":"https://www.wikidata.org/wiki/Q192726","display_name":"Virtual machine","level":2,"score":0.42414456605911255},{"id":"https://openalex.org/C3017891749","wikidata":"https://www.wikidata.org/wiki/Q94","display_name":"Android application","level":3,"score":0.4159567952156067},{"id":"https://openalex.org/C41895202","wikidata":"https://www.wikidata.org/wiki/Q8162","display_name":"Linguistics","level":1,"score":0.0},{"id":"https://openalex.org/C138885662","wikidata":"https://www.wikidata.org/wiki/Q5891","display_name":"Philosophy","level":0,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1145/3460319.3464839","is_oa":false,"landing_page_url":"https://doi.org/10.1145/3460319.3464839","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 30th ACM SIGSOFT International Symposium on Software Testing and Analysis","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[{"score":0.47999998927116394,"id":"https://metadata.un.org/sdg/16","display_name":"Peace, Justice and strong institutions"}],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":31,"referenced_works":["https://openalex.org/W116627068","https://openalex.org/W119062149","https://openalex.org/W183494281","https://openalex.org/W1480157704","https://openalex.org/W1508225132","https://openalex.org/W1538186256","https://openalex.org/W1541744005","https://openalex.org/W1892063863","https://openalex.org/W2012737144","https://openalex.org/W2024385792","https://openalex.org/W2049629426","https://openalex.org/W2128389850","https://openalex.org/W2264131323","https://openalex.org/W2296128045","https://openalex.org/W2314464932","https://openalex.org/W2395278359","https://openalex.org/W2439280908","https://openalex.org/W2532962075","https://openalex.org/W2617476279","https://openalex.org/W2742249911","https://openalex.org/W2749008552","https://openalex.org/W2752052041","https://openalex.org/W2752859356","https://openalex.org/W2792393499","https://openalex.org/W2889233250","https://openalex.org/W2891539454","https://openalex.org/W2901689459","https://openalex.org/W2963856074","https://openalex.org/W2997915791","https://openalex.org/W3027862040","https://openalex.org/W3105926539"],"related_works":["https://openalex.org/W4295633626","https://openalex.org/W2616814339","https://openalex.org/W2399597187","https://openalex.org/W2052507375","https://openalex.org/W4211236094","https://openalex.org/W4285356403","https://openalex.org/W4285815317","https://openalex.org/W327645657","https://openalex.org/W4253505977","https://openalex.org/W2011124320"],"abstract_inverted_index":{"Android":[0,76,173],"packers":[1,32,70,117,180],"have":[2],"been":[3],"widely":[4],"adopted":[5],"by":[6,102],"developers":[7],"to":[8,34,75,83,99,112,158,169],"protect":[9],"apps":[10,20,101],"from":[11],"being":[12],"plagiarized.":[13],"Meanwhile,":[14],"various":[15],"unpacking":[16,30],"tools":[17],"unpack":[18],"the":[19,44,57,91,96,100,103,129,146,163,170],"through":[21],"direct":[22],"memory":[23,60],"dumping.":[24],"To":[25],"defend":[26],"against":[27],"these":[28,87],"off-the-shelf":[29],"tools,":[31],"start":[33],"adopt":[35],"virtual":[36],"machine":[37],"(VM)":[38],"based":[39],"protection":[40,74,185],"techniques,":[41],"which":[42],"replace":[43],"original":[45,136],"Dalvik":[46],"bytecode":[47,51],"(DCode)":[48],"with":[49,141],"customized":[50],"(PCode)":[52],"in":[53,132],"memory.":[54],"This":[55],"defeats":[56],"unpackers":[58],"using":[59],"dumping":[61],"mechanisms.":[62],"However,":[63],"little":[64],"is":[65],"known":[66],"about":[67],"whether":[68],"such":[69],"can":[71],"provide":[72,183],"enough":[73],"apps.":[77,150],"In":[78],"this":[79],"paper,":[80],"we":[81,175],"aim":[82,126],"shed":[84],"light":[85],"on":[86],"questions":[88],"and":[89,122,144,186],"take":[90],"first":[92],"step":[93],"towards":[94],"demystifying":[95],"protections":[97],"provided":[98],"VM-based":[104,116,172],"packers.":[105],"We":[106,151],"proposed":[107],"novel":[108],"program":[109],"analysis":[110],"techniques":[111],"investigate":[113],"existing":[114],"commercial":[115],"including":[118],"a":[119,123,154],"learning":[120],"phase":[121],"deobfuscation":[124,164],"phase.We":[125],"at":[127],"deobfuscating":[128],"VM-protection":[130],"DCode":[131,137],"three":[133],"scenarios,":[134],"recovering":[135],"or":[138],"its":[139],"semantics":[140,147],"training":[142,149],"apps,":[143],"restoring":[145],"without":[148],"also":[152],"develop":[153],"prototype":[155],"named":[156],"Parema":[157],"automate":[159],"much":[160],"work":[161],"of":[162],"procedure.":[165],"By":[166],"applying":[167],"it":[168],"online":[171],"packers,":[174],"reveal":[176],"that":[177],"all":[178],"evaluated":[179],"do":[181],"not":[182],"adequate":[184],"could":[187],"be":[188],"compromised.":[189]},"counts_by_year":[{"year":2026,"cited_by_count":1},{"year":2025,"cited_by_count":4},{"year":2024,"cited_by_count":2},{"year":2023,"cited_by_count":2},{"year":2022,"cited_by_count":1},{"year":2021,"cited_by_count":1}],"updated_date":"2026-03-27T14:29:43.386196","created_date":"2025-10-10T00:00:00"}