Windows 10/11 System Binary Corpus: Derived PE Metadata (builds 19045 and 26200)
收藏资源简介:
The dataset is a fixed snapshot of the parser output used in the accompanying papers. The parser is proprietary and is not released, and its output schema has since changed, so the published files are the authoritative version and cannot be regenerated with the current parser. The underlying binaries can be re-collected from Windows installations at the stated builds (10.0.19045 and 10.0.26200). The values described here (headers, sections, imports, exports, security flags, signatures) are standard PE properties, so they can be re-derived independently with any PE parser. The primary per-binary file (schema axis.binary.meta.v1) records the Windows build and file path of the binary, its format, architecture, bitness, endianness and entry point, the section and file-region layout (names, RVAs, sizes, alignment, permissions), boolean analysis flags covering structural features and security mitigations (ASLR, high-entropy ASLR, DEP, CFG, XFG, SafeSEH, hotpatch, security cookie and related tables), summaries of the export, import, TLS, relocation and unwind tables, and Authenticode signature status including signer and whether the signer is Microsoft. Large tables are written to separate fragment files, each holding at most 10,000 entries: exports, imports, TLS callbacks, base relocations and unwind records. The main file records only a manifest for each table (total count, fragment count, maximum entries per fragment, and the list of fragment file names). Binaries without a given table have an empty manifest and no fragment files for it. Fields are semantic interpretations produced by the parser, not raw byte dumps. WinSxS and DriverStore contents are excluded because they are not universal across installations. The original binaries are Microsoft's and are not redistributed. The dataset accompanies the papers "A Corpus-Scale Static Analysis of Windows 10/11 System Binaries: Characterization and Cross-Build Differences" and "Structural Anomalies in a Windows 10/11 System Binary Corpus: Cross-Build Outliers and an inpoutx64.sys Case Study."



