ACM SURE Workshop

CCS has come to a close, and so has the first-ever SURE Workshop. We want to thank the authors, the PC, @moyix, our panel, and CCS for making SURE a success. We felt the support for this research area (the room was packed out for more than half the day). See you all next year!

Also, go read some of the papers: sure-workshop.org/pa... Keep, a lookout for our executive summary of papers/discussions/conclusions at SURE 2025 for those who could not attend IRL. We will post it in the coming days.

On our last presented work at SURE, we have Noriki Sakamoto presenting "Toward Inferring Structural Semantics from Binary Code Using Graph Neural Networks"

In the special sub-area of type inferencing on binary code, Noriki's work explores the recovery of structs and how different GNN architectures may have better performance.

We're so back, and on our last session: Applications & Future Work. Changyu "Thomason" Zhao is presenting "LibIHT: A Hardware-Based Approach to Efficient and Evasion-Resistant Dynamic Binary Analysis". He is presenting virtually.

Indeed, LibIHT is more robust. They achieve better results on binaries that attempt to evade their analysis.

We're so back, and on our last session: Applications & Future Work. Changyu "Thomason" Zhao is presenting "LibIHT: A Hardware-Based Approach to Efficient and Evasion-Resistant Dynamic Binary Analysis". He is presenting virtually.

Often, when static analysis tools do not work, you need to get down in the weeds of a program and start dynamically analyzing it. In Thomason's work, he explores a way to be more robust and efficient by utilizing hardware features for dynamic analysis.

We're on our last talk of the session, remaining with the obfuscation topic. Dongpeng Xu is presenting "DEBRA: A Real-World Benchmark For Evaluating Deobfuscation Methods" in the place of Zheyun Feng.

Now, you got your crazy code, how do you select which functions in the code to obfuscate and evaluate on? Functions must be "sensitive" and "central". Sensitive: has sensitive info like a uid or gid or a password. Central: many other functions should depend on it (calls).

We're on our last talk of the session, remaining with the obfuscation topic. Dongpeng Xu is presenting "DEBRA: A Real-World Benchmark For Evaluating Deobfuscation Methods" in the place of Zheyun Feng.

An interesting observation: obfuscation is really expensive on the CPU. Real programs don't obfuscate the entire program; they only obfuscate critical code locations like license checks. So they construct their dataset with that in mind.

We're on our last talk of the session, remaining with the obfuscation topic. Dongpeng Xu is presenting "DEBRA: A Real-World Benchmark For Evaluating Deobfuscation Methods" in the place of Zheyun Feng.

Next up is "On the Learnability, Robustness, and Adaptability of Deep Learning Models for Obfuscation-applied Code," presented by Jiyong Uhm of Sungkyunkwan University.

Takeaways: - Training on obfuscation does help models, but it is not a silver bullet. This solution does not work well on obfuscation tech it has never seen before. Check out the work: sure-workshop.org/ac...

Next up is "On the Learnability, Robustness, and Adaptability of Deep Learning Models for Obfuscation-applied Code," presented by Jiyong Uhm of Sungkyunkwan University.

The reasoning task: binary code similarity detection. Do these two code snippets come from an identical source, and does obfuscation stop it?

Next up is "On the Learnability, Robustness, and Adaptability of Deep Learning Models for Obfuscation-applied Code," presented by Jiyong Uhm of Sungkyunkwan University.

When reasoning on code, does it matter if it is obfuscated? The answer feels like a strong YES; however, how much does it matter for AI? Jiyong's work explores this idea in a measurable way.

Speaking of evaluating things, how do you evaluate if your decompilation (or other tool) is actually helping you more in understanding software? Florian Magin is back to present: "Towards Scalable Evaluation of Software Understanding: A Methodology Proposal"

Decoys are wrong answers on a test that could be reasonably guessed more closely. Instead of just having random answers, have highly guessed answers as decoys. See if things still work the same.

Speaking of evaluating things, how do you evaluate if your decompilation (or other tool) is actually helping you more in understanding software? Florian Magin is back to present: "Towards Scalable Evaluation of Software Understanding: A Methodology Proposal"

Florian's work argues that we need to start integrated work in natural sciences, like multiple-choice tests that evaluate how good your data is at helping people on the test.

Speaking of evaluating things, how do you evaluate if your decompilation (or other tool) is actually helping you more in understanding software? Florian Magin is back to present: "Towards Scalable Evaluation of Software Understanding: A Methodology Proposal"

New session, who this? In this session, we are talking about benchmarking! We start with "Benchmarking Binary Type Inference Techniques in Decompilers," presented by Vedant Soni.

While evaluating, they focus on a few essential types: Primitives: -> Char, int, lono long... -> Pointers Complex Types: -> Structs -> Arrays They find that complex types is where much work still exists.

New session, who this? In this session, we are talking about benchmarking! We start with "Benchmarking Binary Type Inference Techniques in Decompilers," presented by Vedant Soni.

Type inference research focuses on recovering high-level types in binary code that humans often find useful. However, there is not much work exploring whether our current approaches are effective and on what data we should test them.

So you are thinking about approaching decompilation in the non-C sense, but you are not sure if it is impactful? Well, Florian Magin, is presenting "Measuring While Playing Fair: An Empirical Analysis of Language and Framework Usage in the iOS App Store" to answer that!

Interesting question from the session: "I thought Apple did not allow interpreted languages?", yet their analysis showed that some languages that are interpreted are used in actual applications.

So you are thinking about approaching decompilation in the non-C sense, but you are not sure if it is impactful? Well, Florian Magin, is presenting "Measuring While Playing Fair: An Empirical Analysis of Language and Framework Usage in the iOS App Store" to answer that!

Speaking of decompilation, that is not just C; we are now on "ideco: A Framework for Improving Non-C Decompilation," presented by Sam Lerner, an independent researcher.

But how usable is the recovered Swift (or other language) code? You can get a good guess by asking LLMs to do tasks with the decompilation.

Speaking of decompilation, that is not just C; we are now on "ideco: A Framework for Improving Non-C Decompilation," presented by Sam Lerner, an independent researcher.

Well, ideco creates a framework for describing the language you actually want to decompile to (like Swift) and attempts to turn the decompilation into that! How is it done? With a Domain Specific Language (DSL)!

Speaking of decompilation, that is not just C; we are now on "ideco: A Framework for Improving Non-C Decompilation," presented by Sam Lerner, an independent researcher.