{"data":{"id":"10.48550/arxiv.2605.25923","type":"dois","attributes":{"doi":"10.48550/arxiv.2605.25923","prefix":"10.48550","suffix":"arxiv.2605.25923","identifiers":[{"identifier":"2605.25923","identifierType":"arXiv"}],"alternateIdentifiers":[{"alternateIdentifierType":"arXiv","alternateIdentifier":"2605.25923"}],"creators":[{"name":"Zhong, Fangtian","nameType":"Personal","givenName":"Fangtian","familyName":"Zhong","affiliation":[],"nameIdentifiers":[]},{"name":"Qian, Zhuoyun","nameType":"Personal","givenName":"Zhuoyun","familyName":"Qian","affiliation":[],"nameIdentifiers":[]},{"name":"Jiang, Yili","nameType":"Personal","givenName":"Yili","familyName":"Jiang","affiliation":[],"nameIdentifiers":[]},{"name":"Huang, Jiaqi","nameType":"Personal","givenName":"Jiaqi","familyName":"Huang","affiliation":[],"nameIdentifiers":[]},{"name":"Pang, Yunming","nameType":"Personal","givenName":"Yunming","familyName":"Pang","affiliation":[],"nameIdentifiers":[]},{"name":"Cheng, Xiuzhen","nameType":"Personal","givenName":"Xiuzhen","familyName":"Cheng","affiliation":[],"nameIdentifiers":[]}],"titles":[{"title":"Semantic Validation of Packer Identification Tools: Characterization, Repair, and Downstream Impact"}],"publisher":"arXiv","container":{},"publicationYear":2026,"subjects":[{"lang":"en","subject":"Cryptography and Security (cs.CR)","subjectScheme":"arXiv"},{"subject":"FOS: Computer and information sciences","subjectScheme":"Fields of Science and Technology (FOS)"}],"contributors":[],"dates":[{"date":"2026-05-25T15:00:30Z","dateType":"Submitted","dateInformation":"v1"},{"date":"2026-05-26T01:55:24Z","dateType":"Updated","dateInformation":"v1"},{"date":"2026-05-27T10:16:13Z","dateType":"Submitted","dateInformation":"v2"},{"date":"2026-05-28T00:55:05Z","dateType":"Updated","dateInformation":"v2"},{"date":"2026-10-19T17:47:41Z","dateType":"Submitted","dateInformation":"v3"},{"date":"2026-10-20T02:46:26Z","dateType":"Updated","dateInformation":"v3"},{"date":"2026-05","dateType":"Available","dateInformation":"v1"}],"language":null,"types":{"ris":"GEN","bibtex":"misc","citeproc":"article","schemaOrg":"CreativeWork","resourceType":"Article","resourceTypeGeneral":"Preprint"},"relatedIdentifiers":[],"relatedItems":[],"sizes":[],"formats":[],"version":"3","rightsList":[{"rights":"Creative Commons Attribution Share Alike 4.0 International","rightsUri":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","schemeUri":"https://spdx.org/licenses/","rightsIdentifier":"cc-by-sa-4.0","rightsIdentifierScheme":"SPDX"}],"descriptions":[{"description":"Packer identification tools are essential to malware analysis, yet their semantic correctness remains largely unverified. Incorrect packer labels can trigger inappropriate unpacking and degrade downstream malware classification. This paper presents a framework for systematically exposing, characterizing, and repairing semantic errors in packer identification tools. Our key insight is to leverage unpackers as executable semantic contracts, enabling automated validation of packer predictions without requiring manually labeled packer ground truth. We develop a pipeline that normalizes heterogeneous tool outputs, localizes faulty decision logic, and repairs identification errors through complementary signatures, heuristic rules, and static unpacker-derived detection predicates. Our empirical evaluation reveals widespread identification failures, with an average packer family identification recall of only 44.8% and an average packedness detection recall of only 63.6%. The proposed two-stage repairs achieve an approximately 100.2% relative improvement in average packer family identification recall, while increasing packedness detection recall to 99.0%-99.5%. We further demonstrate that semantic errors can propagate through unpacking failures and adversely affect downstream malware classification. Correcting these errors improves average classification precision by 13.6 percentage points.","descriptionType":"Abstract"}],"geoLocations":[],"fundingReferences":[],"xml":"PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz4KPHJlc291cmNlIHhtbG5zPSJodHRwOi8vZGF0YWNpdGUub3JnL3NjaGVtYS9rZXJuZWwtNCIgeG1sbnM6eHNpPSJodHRwOi8vd3d3LnczLm9yZy8yMDAxL1hNTFNjaGVtYS1pbnN0YW5jZSIgeHNpOnNjaGVtYUxvY2F0aW9uPSJodHRwOi8vZGF0YWNpdGUub3JnL3NjaGVtYS9rZXJuZWwtNCBodHRwOi8vc2NoZW1hLmRhdGFjaXRlLm9yZy9tZXRhL2tlcm5lbC00LjMvbWV0YWRhdGEueHNkIj4KICA8aWRlbnRpZmllciBpZGVudGlmaWVyVHlwZT0iRE9JIj4xMC40ODU1MC9BUlhJVi4yNjA1LjI1OTIzPC9pZGVudGlmaWVyPgogIDxhbHRlcm5hdGVJZGVudGlmaWVycz4KICAgIDxhbHRlcm5hdGVJZGVudGlmaWVyIGFsdGVybmF0ZUlkZW50aWZpZXJUeXBlPSJhclhpdiI+MjYwNS4yNTkyMzwvYWx0ZXJuYXRlSWRlbnRpZmllcj4KICA8L2FsdGVybmF0ZUlkZW50aWZpZXJzPgogIDxjcmVhdG9ycz4KICAgIDxjcmVhdG9yPgogICAgICA8Y3JlYXRvck5hbWUgbmFtZVR5cGU9IlBlcnNvbmFsIj5aaG9uZywgRmFuZ3RpYW48L2NyZWF0b3JOYW1lPgogICAgICA8Z2l2ZW5OYW1lPkZhbmd0aWFuPC9naXZlbk5hbWU+CiAgICAgIDxmYW1pbHlOYW1lPlpob25nPC9mYW1pbHlOYW1lPgogICAgPC9jcmVhdG9yPgogICAgPGNyZWF0b3I+CiAgICAgIDxjcmVhdG9yTmFtZSBuYW1lVHlwZT0iUGVyc29uYWwiPlFpYW4sIFpodW95dW48L2NyZWF0b3JOYW1lPgogICAgICA8Z2l2ZW5OYW1lPlpodW95dW48L2dpdmVuTmFtZT4KICAgICAgPGZhbWlseU5hbWU+UWlhbjwvZmFtaWx5TmFtZT4KICAgIDwvY3JlYXRvcj4KICAgIDxjcmVhdG9yPgogICAgICA8Y3JlYXRvck5hbWUgbmFtZVR5cGU9IlBlcnNvbmFsIj5KaWFuZywgWWlsaTwvY3JlYXRvck5hbWU+CiAgICAgIDxnaXZlbk5hbWU+WWlsaTwvZ2l2ZW5OYW1lPgogICAgICA8ZmFtaWx5TmFtZT5KaWFuZzwvZmFtaWx5TmFtZT4KICAgIDwvY3JlYXRvcj4KICAgIDxjcmVhdG9yPgogICAgICA8Y3JlYXRvck5hbWUgbmFtZVR5cGU9IlBlcnNvbmFsIj5IdWFuZywgSmlhcWk8L2NyZWF0b3JOYW1lPgogICAgICA8Z2l2ZW5OYW1lPkppYXFpPC9naXZlbk5hbWU+CiAgICAgIDxmYW1pbHlOYW1lPkh1YW5nPC9mYW1pbHlOYW1lPgogICAgPC9jcmVhdG9yPgogICAgPGNyZWF0b3I+CiAgICAgIDxjcmVhdG9yTmFtZSBuYW1lVHlwZT0iUGVyc29uYWwiPlBhbmcsIFl1bm1pbmc8L2NyZWF0b3JOYW1lPgogICAgICA8Z2l2ZW5OYW1lPll1bm1pbmc8L2dpdmVuTmFtZT4KICAgICAgPGZhbWlseU5hbWU+UGFuZzwvZmFtaWx5TmFtZT4KICAgIDwvY3JlYXRvcj4KICAgIDxjcmVhdG9yPgogICAgICA8Y3JlYXRvck5hbWUgbmFtZVR5cGU9IlBlcnNvbmFsIj5DaGVuZywgWGl1emhlbjwvY3JlYXRvck5hbWU+CiAgICAgIDxnaXZlbk5hbWU+WGl1emhlbjwvZ2l2ZW5OYW1lPgogICAgICA8ZmFtaWx5TmFtZT5DaGVuZzwvZmFtaWx5TmFtZT4KICAgIDwvY3JlYXRvcj4KICA8L2NyZWF0b3JzPgogIDx0aXRsZXM+CiAgICA8dGl0bGU+U2VtYW50aWMgVmFsaWRhdGlvbiBvZiBQYWNrZXIgSWRlbnRpZmljYXRpb24gVG9vbHM6IENoYXJhY3Rlcml6YXRpb24sIFJlcGFpciwgYW5kIERvd25zdHJlYW0gSW1wYWN0PC90aXRsZT4KICA8L3RpdGxlcz4KICA8cHVibGlzaGVyPmFyWGl2PC9wdWJsaXNoZXI+CiAgPHB1YmxpY2F0aW9uWWVhcj4yMDI2PC9wdWJsaWNhdGlvblllYXI+CiAgPHN1YmplY3RzPgogICAgPHN1YmplY3QgeG1sOmxhbmc9ImVuIiBzdWJqZWN0U2NoZW1lPSJhclhpdiI+Q3J5cHRvZ3JhcGh5IGFuZCBTZWN1cml0eSAoY3MuQ1IpPC9zdWJqZWN0PgogICAgPHN1YmplY3Qgc3ViamVjdFNjaGVtZT0iRmllbGRzIG9mIFNjaWVuY2UgYW5kIFRlY2hub2xvZ3kgKEZPUykiPkZPUzogQ29tcHV0ZXIgYW5kIGluZm9ybWF0aW9uIHNjaWVuY2VzPC9zdWJqZWN0PgogIDwvc3ViamVjdHM+CiAgPGRhdGVzPgogICAgPGRhdGUgZGF0ZVR5cGU9IlN1Ym1pdHRlZCIgZGF0ZUluZm9ybWF0aW9uPSJ2MSI+MjAyNi0wNS0yNVQxNTowMDozMFo8L2RhdGU+CiAgICA8ZGF0ZSBkYXRlVHlwZT0iVXBkYXRlZCIgZGF0ZUluZm9ybWF0aW9uPSJ2MSI+MjAyNi0wNS0yNlQwMTo1NToyNFo8L2RhdGU+CiAgICA8ZGF0ZSBkYXRlVHlwZT0iU3VibWl0dGVkIiBkYXRlSW5mb3JtYXRpb249InYyIj4yMDI2LTA1LTI3VDEwOjE2OjEzWjwvZGF0ZT4KICAgIDxkYXRlIGRhdGVUeXBlPSJVcGRhdGVkIiBkYXRlSW5mb3JtYXRpb249InYyIj4yMDI2LTA1LTI4VDAwOjU1OjA1WjwvZGF0ZT4KICAgIDxkYXRlIGRhdGVUeXBlPSJTdWJtaXR0ZWQiIGRhdGVJbmZvcm1hdGlvbj0idjMiPjIwMjYtMTAtMTlUMTc6NDc6NDFaPC9kYXRlPgogICAgPGRhdGUgZGF0ZVR5cGU9IlVwZGF0ZWQiIGRhdGVJbmZvcm1hdGlvbj0idjMiPjIwMjYtMTAtMjBUMDI6NDY6MjZaPC9kYXRlPgogICAgPGRhdGUgZGF0ZVR5cGU9IkF2YWlsYWJsZSIgZGF0ZUluZm9ybWF0aW9uPSJ2MSI+MjAyNi0wNTwvZGF0ZT4KICA8L2RhdGVzPgogIDxyZXNvdXJjZVR5cGUgcmVzb3VyY2VUeXBlR2VuZXJhbD0iUHJlcHJpbnQiPkFydGljbGU8L3Jlc291cmNlVHlwZT4KICA8dmVyc2lvbj4zPC92ZXJzaW9uPgogIDxyaWdodHNMaXN0PgogICAgPHJpZ2h0cyByaWdodHNVUkk9Imh0dHA6Ly9jcmVhdGl2ZWNvbW1vbnMub3JnL2xpY2Vuc2VzL2J5LXNhLzQuMC8iIHJpZ2h0c0lkZW50aWZpZXJTY2hlbWU9IlNQRFgiIHJpZ2h0c0lkZW50aWZpZXI9IkNDLUJZLVNBLTQuMCI+Q3JlYXRpdmUgQ29tbW9ucyBBdHRyaWJ1dGlvbiBTaGFyZSBBbGlrZSA0LjAgSW50ZXJuYXRpb25hbDwvcmlnaHRzPgogIDwvcmlnaHRzTGlzdD4KICA8ZGVzY3JpcHRpb25zPgogICAgPGRlc2NyaXB0aW9uIGRlc2NyaXB0aW9uVHlwZT0iQWJzdHJhY3QiPlBhY2tlciBpZGVudGlmaWNhdGlvbiB0b29scyBhcmUgZXNzZW50aWFsIHRvIG1hbHdhcmUgYW5hbHlzaXMsIHlldCB0aGVpciBzZW1hbnRpYyBjb3JyZWN0bmVzcyByZW1haW5zIGxhcmdlbHkgdW52ZXJpZmllZC4gSW5jb3JyZWN0IHBhY2tlciBsYWJlbHMgY2FuIHRyaWdnZXIgaW5hcHByb3ByaWF0ZSB1bnBhY2tpbmcgYW5kIGRlZ3JhZGUgZG93bnN0cmVhbSBtYWx3YXJlIGNsYXNzaWZpY2F0aW9uLiBUaGlzIHBhcGVyIHByZXNlbnRzIGEgZnJhbWV3b3JrIGZvciBzeXN0ZW1hdGljYWxseSBleHBvc2luZywgY2hhcmFjdGVyaXppbmcsIGFuZCByZXBhaXJpbmcgc2VtYW50aWMgZXJyb3JzIGluIHBhY2tlciBpZGVudGlmaWNhdGlvbiB0b29scy4gT3VyIGtleSBpbnNpZ2h0IGlzIHRvIGxldmVyYWdlIHVucGFja2VycyBhcyBleGVjdXRhYmxlIHNlbWFudGljIGNvbnRyYWN0cywgZW5hYmxpbmcgYXV0b21hdGVkIHZhbGlkYXRpb24gb2YgcGFja2VyIHByZWRpY3Rpb25zIHdpdGhvdXQgcmVxdWlyaW5nIG1hbnVhbGx5IGxhYmVsZWQgcGFja2VyIGdyb3VuZCB0cnV0aC4gV2UgZGV2ZWxvcCBhIHBpcGVsaW5lIHRoYXQgbm9ybWFsaXplcyBoZXRlcm9nZW5lb3VzIHRvb2wgb3V0cHV0cywgbG9jYWxpemVzIGZhdWx0eSBkZWNpc2lvbiBsb2dpYywgYW5kIHJlcGFpcnMgaWRlbnRpZmljYXRpb24gZXJyb3JzIHRocm91Z2ggY29tcGxlbWVudGFyeSBzaWduYXR1cmVzLCBoZXVyaXN0aWMgcnVsZXMsIGFuZCBzdGF0aWMgdW5wYWNrZXItZGVyaXZlZCBkZXRlY3Rpb24gcHJlZGljYXRlcy4gT3VyIGVtcGlyaWNhbCBldmFsdWF0aW9uIHJldmVhbHMgd2lkZXNwcmVhZCBpZGVudGlmaWNhdGlvbiBmYWlsdXJlcywgd2l0aCBhbiBhdmVyYWdlIHBhY2tlciBmYW1pbHkgaWRlbnRpZmljYXRpb24gcmVjYWxsIG9mIG9ubHkgNDQuOCUgYW5kIGFuIGF2ZXJhZ2UgcGFja2VkbmVzcyBkZXRlY3Rpb24gcmVjYWxsIG9mIG9ubHkgNjMuNiUuIFRoZSBwcm9wb3NlZCB0d28tc3RhZ2UgcmVwYWlycyBhY2hpZXZlIGFuIGFwcHJveGltYXRlbHkgMTAwLjIlIHJlbGF0aXZlIGltcHJvdmVtZW50IGluIGF2ZXJhZ2UgcGFja2VyIGZhbWlseSBpZGVudGlmaWNhdGlvbiByZWNhbGwsIHdoaWxlIGluY3JlYXNpbmcgcGFja2VkbmVzcyBkZXRlY3Rpb24gcmVjYWxsIHRvIDk5LjAlLTk5LjUlLiBXZSBmdXJ0aGVyIGRlbW9uc3RyYXRlIHRoYXQgc2VtYW50aWMgZXJyb3JzIGNhbiBwcm9wYWdhdGUgdGhyb3VnaCB1bnBhY2tpbmcgZmFpbHVyZXMgYW5kIGFkdmVyc2VseSBhZmZlY3QgZG93bnN0cmVhbSBtYWx3YXJlIGNsYXNzaWZpY2F0aW9uLiBDb3JyZWN0aW5nIHRoZXNlIGVycm9ycyBpbXByb3ZlcyBhdmVyYWdlIGNsYXNzaWZpY2F0aW9uIHByZWNpc2lvbiBieSAxMy42IHBlcmNlbnRhZ2UgcG9pbnRzLjwvZGVzY3JpcHRpb24+CiAgPC9kZXNjcmlwdGlvbnM+CjwvcmVzb3VyY2U+","url":"https://arxiv.org/abs/2605.25923","contentUrl":null,"metadataVersion":2,"schemaVersion":"http://datacite.org/schema/kernel-4","source":"mds","isActive":true,"state":"findable","reason":null,"viewCount":0,"viewsOverTime":[],"downloadCount":0,"downloadsOverTime":[],"referenceCount":0,"citationCount":0,"citationsOverTime":[],"partCount":0,"partOfCount":0,"versionCount":0,"versionOfCount":0,"created":"2026-05-26T03:50:29.000Z","registered":"2026-05-26T03:50:30.000Z","published":"2026","updated":"2026-10-20T05:23:47.000Z"},"relationships":{"client":{"data":{"id":"arxiv.content","type":"clients"}},"provider":{"data":{"id":"arxiv","type":"providers"}},"media":{"data":{"id":"10.48550/arxiv.2605.25923","type":"media"}},"references":{"data":[]},"citations":{"data":[]},"parts":{"data":[]},"partOf":{"data":[]},"versions":{"data":[]},"versionOf":{"data":[]}}}}