一句话：提出 CADscanner，无需上云或人工逆向即可本地恢复 FAS/VLX 编译脚本的行为内容并自动检测恶意脚本。
针对 AutoCAD 编译脚本格式（FAS、VLX）缺乏公开分析工具、成为工程环境安全盲点的问题，本文提出 CADscanner：无需安装 AutoCAD、无需上云、无需人工逆向，即可本地恢复脚本行为内容。作者刻画了 FAS4 的滚动 XOR 加密与 VLX（VRTLIB-1）归档容器，构建恢复流水线，将两者提升为归一化中间表示以支持自动规则匹配与分析师审阅。在 201 个脚本的一致性基准上，行为 API 恢复达 79.3% 召回率与 97.8% 精确率，持久化、网络、传播等安全关键指标保留率为 85–94%；规则检测器在家族不相交留出集上取得 95.8% TPR 与 2.2% FPR，单文件处理低于 15 ms。论文并报告了在安全厂商 OT 分析流程中的部署经验与工程权衡。
For architecture, engineering, and manufacturing organizations, the inability to inspect AutoCAD's compiled script formats (FAS and VLX) has become a consequential security blind spot: every publicly available analysis tool fails on them, while threat actors have repeatedly used them to weaponize shared drawing files in documented industrial espionage campaigns. Today, when a security analyst encounters a suspicious FAS or VLX file, the manual practice is either to upload it to a cloud service (often prohibited by confidentiality policies), to attempt ad hoc byte-level inspection (ineffective due to per-file encryption), or to simply skip the file. This paper reports on CADscanner, a tool that automates the analysis of compiled AutoCAD scripts by recovering their behavioral content locally, without requiring AutoCAD installation, cloud submission, or manual reverse engineering. We describe the engineering of a recovery pipeline that handles two proprietary formats: the FAS4 binary, which is protected by rolling-XOR encryption, and the VLX (VRTLIB-1) archive container. The pipeline lifts both into a normalized intermediate representation suitable for automated rule matching and analyst review. On a 201-script consistency benchmark, behavioral API recovery reaches 79.3% recall at 97.8% precision, with security-critical indicators (persistence, network, propagation) preserved at 85--94%. A rule-based detector over the recovered surface achieves 95.8% TPR at 2.2% FPR on a family-disjoint held-out set, processing files in under 15,ms each. We report deployment experience integrating CADscanner into a security vendor's OT analysis workflow, discuss the engineering trade-offs encountered, and distill lessons learned for practitioners building format-recovery tooling in industrial contexts.
@inproceedings{paperbot12184,
title = {CADscanner: Automating Malware Analysis for Compiled AutoCAD Scripts in Engineering Environments},
author = {Luxing Yin and Chang Sun and Chenghui Liang and Chu Wang and Shufu Zhi and Tianshi Zheng and Ziang Liu and Xin Liu and Qingguo Zhou},
booktitle = {ASE},
year = {2026},
doi = {10.1145/3832783.3834495}
}