Padding Matters -- Exploring Function Detection in PE Files

TL;DR

This work addresses the challenge of detecting function starts in Windows PE binaries by introducing FuncPEval, a large PE-focused ground-truth dataset based on Chromium and Conti. It systematically benchmarks eight detectors (five heuristic-based and three ML-based), revealing that IDA typically offers the best precision, while DeepDi provides the best speed with competitive accuracy; learning-based methods, however, are highly sensitive to toolchain quirks such as function padding. A key contribution is showing that randomized padding between functions can severely degrade ML-based detectors, exposing generalization gaps and potential security implications for adversarial obfuscation; the study also demonstrates substantial gains by refining RNN encoding and XDA training. The results highlight the practical trade-offs between accuracy and speed for real-world malware analysis pipelines and call for robust, reproducible evaluation data across PE toolchains and obfuscation techniques. Overall, the paper provides important insights into PE-specific function-start detection and introduces a valuable benchmark for future research.

Abstract

Function detection is a well-known problem in binary analysis. While previous research has primarily focused on Linux/ELF, Windows/PE binaries have been overlooked or only partially considered. This paper introduces FuncPEval, a new dataset for Windows x86 and x64 PE files, featuring Chromium and the Conti ransomware, along with ground truth data for 1,092,820 function starts. Utilizing FuncPEval, we evaluate five heuristics-based (Ghidra, IDA, Nucleus, rev.ng, SMDA) and three machine-learning-based (DeepDi, RNN, XDA) function start detection tools. Among the tested tools, IDA achieves the highest F1-score (98.44%) for Chromium x64, while DeepDi closely follows (97%) but stands out as the fastest by a significant margin. Working towards explainability, we examine the impact of padding between functions on the detection results. Our analysis shows that all tested tools, except rev.ng, are susceptible to randomized padding. The randomized padding significantly diminishes the effectiveness for the RNN, XDA, and Nucleus. Among the learning-based tools, DeepDi exhibits the least sensitivity and demonstrates overall the fastest performance, while Nucleus is the most adversely affected among non-learning-based tools. In addition, we improve the recurrent neural network (RNN) proposed by Shin et al. and enhance the XDA tool, increasing the F1-score by approximately 10%.

Figures (5)

• Figure 1: Comparison of code, data, and unexplored areas in memory-mapped views of a Urausy malware sample.
• Figure 2: Schematic of function start detection
• Figure 3: Comparison of the original and the modified RNN pipelines
• Figure 4: Labeling of Functions in XDA. For two adjacent functions, XDA would need to assign two labels for one byte. That is impossible, and a new encoding is required.
• Figure 5: Precision, recall, and F1-score when predicting function starts in Chromium and Conti samples. Each cell is shaded in red, with the intensity of the red color increasing as the value deviates further from 100%. INT3-Padding in tool names indicates training on samples with INT3 instruction as padding between functions, while RND-Padding indicates training on samples with random byte values as padding. RND-padding in sample names denotes the replacement of compiler-generated padding with random byte values.