Search

Original Entry Point (OEP) and API obfuscation techniques greatly hinder the analysis of malware. Contemporary packers, employing these sophisticated obfuscation strategies, continue to pose unresolved challenges, despite extensive research efforts. Recent studies, like API-Xray, have mainly concentrated on rebuilding obfuscated import tables in malware, but research into OEP obfuscation is still limited. As a solution, we present Pinicorn, an automated dynamic de-obfuscation system designed to tackle these complexities. Pinicorn bypasses packers' anti-analysis techniques and retrieves the original program from memory. It is specifically designed to detect and analyze trampoline codes within both OEP and the import table. Our evaluation shows that Pinicorn successfully deobfuscates programs hidden by three different packers, confirming its effectiveness through a comparative analysis with their original versions. Furthermore, we conducted experiments on malware obfuscated by Themida and VMProtect, analyzing the obfuscation techniques and successfully de-obfuscating them to validate the effectiveness of our approach. [ABSTRACT FROM AUTHOR]

During the operation of pressurised pipelines transporting compressible fluids, line packing is employed as an effective method that uses the pipeline itself as a buffer storage, compensating for fluctuations in the fluid supply or demand. While in large-capacity natural gas transmission systems, reaching maximum operating pressures during line packing is usually not of practical concern, in small capacity pipelines transporting low-compressibility fluids, such as liquid or dense-phase CO2, line packing can occur quickly, and therefore, estimating the line packing times becomes important to ensure avoiding exceeding the pipeline maximum allowable operating pressure. In this study, a correlation for estimating the line packing time is derived from the transient mass balance in the pipeline. The proposed correlation accounts for the pipeline overall dimensions, operating pressure and temperature, and the fluid properties, namely density and the expansion coefficient. The correlation is also adopted for the calculation of pipeline unpacking times caused by unbalanced discharge from a pipeline. A verification study on line packing in a dense-phase CO2 pipeline shows that within the ranges tested, the proposed correlation estimates conservatively the line packing times with ca. 15 % deviation from the results of simulations obtained using a rigorous transient pipeline flow model. The proposed correlation is also verified against predictions obtained using a parabolic flow model and is recommended for estimating line packing times for both dense-phase and gas-phase CO2 at pressures and temperatures in the ranges 2 - 12 MPa and 280 – 330 K, respectively. The limitations of the proposed line packing time correlation are discussed.

Introduction: To investigate how the provision of additional information about the health events and procedures covered by a healthcare plan affect the level of coverage chosen by young adults taking their first full time job. Methods: University students were recruited for a study at two behavioral laboratories (one located at the University of Toronto and the other located at INSEAD-Sorbonne University in Paris) in which they imagine they are making choices about the healthcare coverage associated with the taking a new job in Chicago, Illinois. Every participant made choices in four categories: Physician Care, Clinical Care, Hospital Care, and Dental Care. Participants were randomly assigned to one of two conditions: Low Detail or High Detail coverage information and they chose between three levels of coverage: Basic, Enhanced, and Superior. The study took place in March 2017 with 120 students in Toronto and 121 students in Paris. Results: The provision of more detailed information about the health events and procedures covered by a healthcare plan leads to a compromise effect in which participants shift their choices significantly towards Enhanced (moderate coverage) from Basic (low coverage) and Superior (high coverage). The compromise effect was observed at both locations; however, Paris participants choose significantly higher levels of coverage than Toronto participants. Discussion: Providing more detail to employees about the health events and procedures covered by a healthcare plan will increase the fraction of employees who choose the intermediate level of coverage. It is beyond the scope of this study to conclude whether this is good or bad; however, in a context where employees gravitate to either insufficient or excessive coverage, providing additional detail may reduce these tendencies. [ABSTRACT FROM AUTHOR]

Synthetic Aperture Radar (SAR) data processing evolving from level-0 raw data is complicated, especially in data decoding, manifesting in obtaining a well-focused SAR image. This paper is intended to present a complete MATLAB-based SAR data processing tool, which helps the end-user to treat simply the steps of image generation. This paper would enrich the research community in the field of SAR processors, especially in the area of understanding, handling, and developing a SAR processor based on space packet protocol standard (STD 01) used in many SAR systems such as Sentinel-1, ERS-1, CubeL, JPSS-2, 3, and 4. Also, this work opens the door for researchers to decode other space packet protocol standards and even to create an algorithm based on fully understanding the image formation algorithm from its roots. Moreover, the work in this paper could be a stepping-stone for the beginner in the field of SAR signal processing to become familiarized with SAR image generation procedures. The level-0 raw data used in this paper is based on Sentinel 1 SAR satellite obtained from the European Space Agency Copernicus website, a free open-source for level-0 and level-1 data types. The MATLAB program allows users to compare their generated image with the level-1 single-look complex (S1-L1-SLC) image utilizing entropy, contrast, and sharpness image quality metrics.The results showed that the images produced by the proposed algorithm are comparable to Sentinel-1 level-1 SAR images for the same scene and achieved satisfactory accuracy under the requirements for image quality.

IntroductionTo investigate how the provision of additional information about the health events and procedures covered by a healthcare plan affect the level of coverage chosen by young adults taking their first full time job.MethodsUniversity students were recruited for a study at two behavioral laboratories (one located at the University of Toronto and the other located at INSEAD-Sorbonne University in Paris) in which they imagine they are making choices about the healthcare coverage associated with the taking a new job in Chicago, Illinois. Every participant made choices in four categories: Physician Care, Clinical Care, Hospital Care, and Dental Care. Participants were randomly assigned to one of two conditions: Low Detail or High Detail coverage information and they chose between three levels of coverage: Basic, Enhanced, and Superior. The study took place in March 2017 with 120 students in Toronto and 121 students in Paris.ResultsThe provision of more detailed information about the health events and procedures covered by a healthcare plan leads to a compromise effect in which participants shift their choices significantly towards Enhanced (moderate coverage) from Basic (low coverage) and Superior (high coverage). The compromise effect was observed at both locations; however, Paris participants choose significantly higher levels of coverage than Toronto participants.DiscussionProviding more detail to employees about the health events and procedures covered by a healthcare plan will increase the fraction of employees who choose the intermediate level of coverage. It is beyond the scope of this study to conclude whether this is good or bad; however, in a context where employees gravitate to either insufficient or excessive coverage, providing additional detail may reduce these tendencies.

Synthetic Aperture Radar (SAR) data processing evolving from level-0 raw data is complicated, especially in data decoding, manifesting in obtaining a well-focused SAR image. This paper is intended to present a complete MATLAB-based SAR data processing tool, which helps the end-user to treat simply the steps of image generation. This paper would enrich the research community in the field of SAR processors, especially in the area of understanding, handling, and developing a SAR processor based on space packet protocol standard (STD 01) used in many SAR systems such as Sentinel-1, ERS-1, CubeL, JPSS-2, 3, and 4. Also, this work opens the door for researchers to decode other space packet protocol standards and even to create an algorithm based on fully understanding the image formation algorithm from its roots. Moreover, the work in this paper could be a stepping-stone for the beginner in the field of SAR signal processing to become familiarized with SAR image generation procedures. The level-0 raw data used in this paper is based on Sentinel 1 SAR satellite obtained from the European Space Agency Copernicus website, a free open-source for level-0 and level-1 data types. The MATLAB program allows users to compare their generated image with the level-1 single-look complex (S1-L1-SLC) image utilizing entropy, contrast, and sharpness image quality metrics. The results showed that the images produced by the proposed algorithm are comparable to Sentinel-1 level-1 SAR images for the same scene and achieved satisfactory accuracy under the requirements for image quality. [ABSTRACT FROM AUTHOR]

This paper presents two multi-objective models that integrate packaging size and production scheduling problems for a flexible flow shop system. The main objective is to find the packaging size of finished product per item and the production schedule that would minimise cost of lost units, unpacking cost, inventory cost, earliness/tardiness penalties and kilograms of carbon dioxide emitted by resources operation. Since the complexity of the proposed models, a Pareto-based hybrid genetic algorithm (HGA) is also developed. A case study was developed to analyse the performance of both models using different instances. Numerical results indicate that the outperformance of one model over the other depends on the demand and the packaging size. [ABSTRACT FROM AUTHOR]

Copyright of Ciencia Jurídica is the property of Universidad de Guanajuato and its content may not be copied or emailed to multiple sites or posted to a listserv without the copyright holder's express written permission. However, users may print, download, or email articles for individual use. This abstract may be abridged. No warranty is given about the accuracy of the copy. Users should refer to the original published version of the material for the full abstract. (Copyright applies to all Abstracts.)

Kemampuan unpacking dan konstruksi negasi dari pernyataan matematika merupakan hal penting dalam pemahaman mengenai pernyataan matematika, pembuktian bahkan memahami konsep matematika dibaliknya. Kemampuan unpacking diasumsikan berhubungan dengan kemampuan konstruksi negasi. Penelitian ini bertujuan untuk menguji hubungan antara kemampuan unpacking dan konstruksi negasi dari pernyataan matematika. Penelitian ini merupakan penelitian kuantitatif dengan metode survey terhadap 35 calon guru matematika. Penelitian ini menggunakan tes yang memuat delapan pernyataan yang diminta untuk di-unpacking dan dikonstruksi negasinya. Data hasil tes dianalisis secara kuantitatif menggunakan statistik deskriptif dan inferensial. Statistik deskriptif menggunakan rata-rata, maksimum, minimum dan standar deviasi. Statistik inferensial menggunakan korelasi product-moment. Hasil penelitian menunjukkan tingkat kemampuan unpacking calon guru matematika berada pada kategori sedang dan kemampuan konstruksi negasi pada kategori sedang. Hasil penelitian juga menunjukkan tidak adanya hubungan signifikan antara kemampuan unpacking dengan kemampuan konstruksi negasi pernyataan matematika. Temuan penelitian mengimplikasikan pentingnya mengembangkan proses dimana calon guru matematika didorong untuk melakukan evaluasi mengenai pernyataan matematika. Abstract The ability to unpack and construct the negation of mathematical statements is important in understanding mathematical statements, proving and even understanding the mathematical concepts behind them. The unpacking ability is assumed to be related to the negation construction capability. This study aims to examine the relationship between unpacking abilities and the negation construction of mathematical statements. This research is a quantitative study with a survey method of 35 pre-service mathematics teachers. This study uses a test that contains eight statements which are asked to be unpacked and constructed for negation. Data were analyzed quantitatively using descriptive and inferential statistics. Descriptive statistics use mean, maximum, minimum and standard deviation. Inferential statistics use product-moment correlation. The results showed the level of unpacking ability of prospective mathematics teachers was in the medium category and the negation construction ability was in the medium category. The results also showed that there was no significant relationship between unpacking ability and the negation construction ability of mathematical statements. The research findings imply the importance of developing a process by which pre-service mathematics teachers are encouraged to evaluate mathematics statements.

Pharmacology education currently lacks a research‐based consensus on which core concepts all graduates should know and understand, as well as a valid and reliable means to assess core conceptual learning. The Core Concepts in Pharmacology Expert Group (CC‐PEG) from Australia and New Zealand recently identified a set of core concepts of pharmacology education as a first step toward developing a concept inventory—a valid and reliable tool to assess learner attainment of concepts. In the current study, CC‐PEG used established methodologies to define each concept and then unpack its key components. Expert working groups of three to seven educators were formed to unpack concepts within specific conceptual groupings: what the body does to the drug (pharmacokinetics); what the drug does to the body (pharmacodynamics); and system integration and modification of drug–response. First, a one‐sentence definition was developed for each core concept. Next, sub‐concepts were established for each core concept. These twenty core concepts, along with their respective definitions and sub‐concepts, can provide pharmacology educators with a resource to guide the development of new curricula and the evaluation of existing curricula. The unpacking and articulation of these core concepts will also inform the development of a pharmacology concept inventory. We anticipate that these resources will advance further collaboration across the international pharmacology education community to improve curricula, teaching, assessment, and learning.The second stage of development of core concepts of pharmacology education; defining each concept, and unpacking the concept by articulation of sub‐concepts. [ABSTRACT FROM AUTHOR]

Since visual representations play a particularly important role in the teaching and learning of chemistry, the exploration described in this article focuses on them. This is an explorative study of the qualitatively different ways that visual representations can be unpacked by Swedish upper secondary school chemistry teachers dealing with intermolecular forces. Unpacking is characterized as the ways that visual representations get used to open up the possibility of having the critical aspects and features of an intended object of learning being brought into focal awareness, initially on their own and then simultaneously. The analysis, which combines a phenomenographic and a social semiotic approach, leads to the characterizations of five qualitatively different ways that visual representations may be unpacked. These outcome categories are presented in terms of a conceptual hierarchy, where two of these ways of unpacking are characterized as being teacher‐centered and the other three as student‐centered. This leads to a case being made that if teachers use student‐centered ways of unpacking visual representations, then their students will be more likely to gain greater access to critical aspects and features of the enacted object of learning. We argue that in terms of making theoretical and practical contributions to the phenomenographic perspective on learning, the results can be used as a tool for researchers wishing to explore how visual representations can be used effectively in science education and also provide a useful basis for discussion in teacher education and in teacher professional development programs. [ABSTRACT FROM AUTHOR]

Obfuscation is rampant in both benign and malicious JavaScript (JS) codes. It generates an obscure and undetectable code that hinders comprehension and analysis. Therefore, accurate detection of JS codes that masquerade as innocuous scripts is vital. The existing deobfuscation methods assume that a specific tool can recover an original JS code entirely. For a multi-layer obfuscation, general tools realize a formatted JS code, but some sections remain encoded. For the detection of such codes, this study performs Deobfuscation, Unpacking, and Decoding (DUD-preprocessing) by function redefinition using a Virtual Machine (VM), a JS code editor, and a python int_to_str() function to facilitate feature learning by the FastText model. The learned feature vectors are passed to a classifier model that judges the maliciousness of a JS code. In performance evaluation, the authors use the Hynek Petrak's dataset for obfuscated malicious JS codes and the SRILAB dataset and the Majestic Million service top 10,000 websites for obfuscated benign JS codes. They then compare the performance to other models on the detection of DUD-preprocessed obfuscated malicious JS codes. Their experimental results show that the proposed approach enhances feature learning and provides improved accuracy in the detection of obfuscated malicious JS codes.

Obfuscation is rampant in both benign and malicious JavaScript (JS) codes. It generates an obscure and undetectable code that hinders comprehension and analysis. Therefore, accurate detection of JS codes that masquerade as innocuous scripts is vital. The existing deobfuscation methods assume that a specific tool can recover an original JS code entirely. For a multi‐layer obfuscation, general tools realize a formatted JS code, but some sections remain encoded. For the detection of such codes, this study performs Deobfuscation, Unpacking, and Decoding (DUD‐preprocessing) by function redefinition using a Virtual Machine (VM), a JS code editor, and a python int_to_str() function to facilitate feature learning by the FastText model. The learned feature vectors are passed to a classifier model that judges the maliciousness of a JS code. In performance evaluation, the authors use the Hynek Petrak's dataset for obfuscated malicious JS codes and the SRILAB dataset and the Majestic Million service top 10,000 websites for obfuscated benign JS codes. They then compare the performance to other models on the detection of DUD‐preprocessed obfuscated malicious JS codes. Their experimental results show that the proposed approach enhances feature learning and provides improved accuracy in the detection of obfuscated malicious JS codes. [ABSTRACT FROM AUTHOR]

The present study sought to determine whether witness memory for duration could be improved. In three studies, we examined the effects of unpacking (breaking an event into its component parts), anchoring (supplying participants with a reference duration), and summation (summing component estimates). Participants watched a video-recorded mock crime and provided duration estimates for components of the crime (e.g., casing the car, unlocking the door, etc.) and for the total crime. Results indicate that bias in estimated duration was less for the sum of the parts than it was for the overall duration estimate. Further, the sum of the individual parts did not equal the total estimate, even though all estimates were given in sequence. Summing the component parts could be a more successful intervention than anchoring or unpacking and is easy to employ with witnesses.

The present study sought to determine whether witness memory for duration could be improved. In three studies, we examined the effects of unpacking (breaking an event into its component parts), anchoring (supplying participants with a reference duration), and summation (summing component estimates). Participants watched a video-recorded mock crime and provided duration estimates for components of the crime (e.g., casing the car, unlocking the door, etc.) and for the total crime. Results indicate that bias in estimated duration was less for the sum of the parts than it was for the overall duration estimate. Further, the sum of the individual parts did not equal the total estimate, even though all estimates were given in sequence. Summing the component parts could be a more successful intervention than anchoring or unpacking and is easy to employ with witnesses. [ABSTRACT FROM AUTHOR]

Abstract We examined whether or not interventions that have been used to try to influence predictions of future task duration – unpacking, summing and anchoring – had a similar effect on retrospective estimations of duration. In three studies, participants experienced a number of short stimuli, such as watching videos, before estimating the duration for each of the stimuli and the overall duration. The first estimation given served as an anchor for all following estimates. If the first estimation was highly biased in one direction, then subsequent estimates were more likely to also be biased in the same direction. Additionally, separate estimates for a number of individual tasks differed from the estimates for all of the tasks combined. This incongruity happened even though all estimates were given in sequence. Overall, results indicated that memories of past task duration could be influenced by the manner in which they were elicited. Highlights • Unpacking, summing and anchoring influenced retrospective estimations of duration. • The first estimation given served as an anchor for following estimates. • The sum of individual duration estimates did not equal the total duration estimate. • Memory of past duration can be influenced by how it was elicited. [ABSTRACT FROM AUTHOR]