ACM SURE Workshop

We are excited to announce that the 1st Workshop on Software Understanding and Reverse Engineering (SURE) will be co-located at ACM CCS 2025 in Taiwan! We invite the community to submit their awesome research sure-workshop.org. So, what is SURE? More in the 🧵

Reflecting on the success of our first SURE and beginning the planning for the next year!

@moyix Finally, stay in touch. We have an associated Discord (unorthodox, we know) to connect academics and practitioners: discord.gg/eVySXH7ZQ8 In fact, some of the attendees this year only made it due to the outreach on Discord. Come and chat!

@moyix Also, go read some of the papers: sure-workshop.org/papers/ Keep, a lookout for our executive summary of papers/discussions/conclusions at SURE 2025 for those who could not attend IRL. We will post it in the coming days.

CCS has come to a close, and so has the first-ever SURE Workshop. We want to thank the authors, the PC, @moyix, our panel, and CCS for making SURE a success. We felt the support for this research area (the room was packed out for more than half the day). See you all next year!

Check out the paper: sure-workshop.org/accepted-paper…

In the special sub-area of type inferencing on binary code, Noriki's work explores the recovery of structs and how different GNN architectures may have better performance.

On our last presented work at SURE, we have Noriki Sakamoto presenting "Toward Inferring Structural Semantics from Binary Code Using Graph Neural Networks"

Check out the paper: sure-workshop.org/accepted-paper…

Indeed, LibIHT is more robust. They achieve better results on binaries that attempt to evade their analysis.

We're so back, and on our last session: Applications & Future Work. Changyu "Thomason" Zhao is presenting "LibIHT: A Hardware-Based Approach to Efficient and Evasion-Resistant Dynamic Binary Analysis". He is presenting virtually.

Find the paper here: sure-workshop.org/accepted-paper…

Now, you got your crazy code, how do you select which functions in the code to obfuscate and evaluate on? Functions must be "sensitive" and "central". Sensitive: has sensitive info like a uid or gid or a password. Central: many other functions should depend on it (calls).

We're on our last talk of the session, remaining with the obfuscation topic. Dongpeng Xu is presenting "DEBRA: A Real-World Benchmark For Evaluating Deobfuscation Methods" in the place of Zheyun Feng.

Interesting question: do specific features seem to matter more for the models? Example: constants. So far, the answer is unclear. These models are very black-box and require more explainability.

Takeaways: - Training on obfuscation does help models, but it is not a silver bullet. This solution does not work well on obfuscation tech it has never seen before. Check out the work: sure-workshop.org/accepted-paper…

Next up is "On the Learnability, Robustness, and Adaptability of Deep Learning Models for Obfuscation-applied Code," presented by Jiyong Uhm of Sungkyunkwan University.