Automatic reverse engineering of malware emulators

Proceedings - IEEE Symposium on Security and Privacy

Volumn , Issue , 2009, Pages 94-109

  Sharif, Monirul ^a   Lanzi, Andrea ^a   Giffin, Jonathon ^a   Lee, Wenke ^a  

^a Georgia Institute of Technology   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

BYTECODE PROGRAMS; BYTECODE REPRESENTATION; BYTECODES; CONTROL-FLOW GRAPHS; DATA BUFFERS; DYNAMIC DATA; EMULATION TECHNOLOGY; EXECUTION PATHS; INSTRUCTION SET; MALWARES; ON DYNAMICS; PROOF OF CONCEPT; SEMANTIC INFORMATION;

COMPUTER CRIME; DATA STRUCTURES; DYNAMIC ANALYSIS; NETWORK SECURITY; REENGINEERING; REVERSE ENGINEERING; SEMANTICS; SYNTACTICS; TRACE ANALYSIS;

DATA FLOW ANALYSIS;

EID: 70449644479     PISSN: 10816011     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/SP.2009.27     Document Type: Conference Paper

References (38)

1. A. Aho, M. Lam, R. Sethi, and J. Ullman. Compilers- Principles, Techniques, & Tools. Addison Wesley, 2006.
2. Avira Antivirus. http://www.free-av.com. Last accessed Mar. 6, 2009.
3. G. Balakrishnan and T. Reps. Recovery of variables and heap structure in x86 executables. Technical Report 1533, Computer Sciences Department, University of Wisconsin-Madison, 2005.
4. E. G. Barrantes, D. H. Ackley, S. Forrest, T. S. Palmer, D. Stefanovic, and D. D. Zovi. Randomized instruction set emulation to disrupt binary code injection attacks. In Proceedings of the ACM Conference on Computer and Communications Security (CCS), 2003.
5. J. R. Bell. Threaded code. Communications of the ACM, 16(6), June 1973.
6. F. Bellard. QEMU, a fast and portable dynamic translator. In USENIX Annual Technical Conference, 2005.
7. J. Caballero, H. Yin, Z. Liang, and D. Song. Polyglot: Automatic extraction of protocol format using dynamic binary analysis. In Proceedings of the ACM Conference on Computer and Communications Security (CCS), 2007.
8. C. Collberg, C. Thomborson, and D. Low. Manufacturing cheap, resilient, and stealthy opaque constructs. In Proceedings of the ACM Symposium on Principles of Programming Languages (POPL), 1998.
9. J. J. Cook. Reverse execution of Java bytecode. The Computer Journal, 45(6), 2002.
10. W. Cui, M. Peinado, K. Chen, H. Wang, and L. Irun-Briz. Tupni: Automatic reverse engineering of input formats. In Proceedings of the ACM Conference on Computer and Communications Security, 2008.
11. E. H. Debaere and J. M. V. Campenhout. Interpretation and Instruction Path Coprocessing. MIT Press, Cambridge, MA, 1990.
12. A. Dinaburg, P. Royal, M. Sharif, and W. Lee. Ether: Malware analysis via hardware virtualization extensions. In Proceedings of the ACM Conference on Computer and Communications Security (CCS), 2008.
13. The IDA Pro Disassembler and Debugger. http://www.hex-rays.com/idapro/. Last accessed Mar. 6, 2009.
14. M. G. Kang, P. Poosankam, and H. Yin. Renovo: a hidden code extractor for packed executables. In Proceedings of the ACM Workshop on Recurring Malcode (WORM), 2007.
15. G. S. Kc, A. D. Keromytis, and V. Prevelakis. Countering code-injection attacks with instruction-set randomization. In Proceedings of the ACM Conference on Computer and Communications Security (CCS), 2003.
16. P. Klint. Interpretation techniques. Software Pratice and Experience, 11(9), Sept. 1981.
17. Z. Lin, D. Xu, and X. Zhang. Automatic protocol format reverse engineering through context-aware monitored execution. In Proceeding of the Annual Network and Distributed System Security Symposium (NDSS), 2008.
18. C. Linn and S. Debray. Obfuscation of executable code to improve resistance to static disassembly. In Proceedings of the ACM Conference on Computer and Communications Security (CCS), 2003.
19. P. S. Magnusson and D. Samuelsson. A compact intermediate format for SimICS. Technical report, Swedish Institute of Computer Science, 1994.
20. L. Martignoni, M. Christodorescu, and S. Jha. OmniUnpack: Fast, generic, and safe unpacking of malware. In Proceedings of the Annual Computer Security Applications Conference (ACSAC), 2007.
21. A. Moser, C. Kruegel, and E. Kirda. Exploring multiple execution paths for malware analysis. In Proceedings of the IEEE Symposium of Security and Privacy, 2007.
22. Oreans Technologies. http://www.oreans.com/. Last accessed Mar. 6, 2009.
23. Oreans Technologies: Code Virtualizer. http://www.oreans.com/ codevirtualizer.php. Last accessed Mar. 6, 2009.
24. Oreans Technologies: Themida. http://www.oreans.com/. Last accessed Mar. 6, 2009.
25. S. Pearce. Viral polymorphism. Technical report, VX Heavens, 2003.
26. I. V. Popov, S. K. Debray, and G. R. Andrews. Binary obfuscation using signals. In Proceedings of the USENIX Security Symposium, 2007.
27. P. Royal, M. Halpin, D. Dagon, R. Edmonds, and W. Lee. PolyUnpack: Automating the hidden-code extraction of unpack-executing malware. In Proceedings of the Annual Computer Security Applications Conference (ACSAC), 2006.
28. M. Sharif, A. Lanzi, J. Giffin, and W. Lee. Rotaluḿe: A tool for automatically reverse engineering malware emulators. Technical Report GT-CS-09-105, School of Computer Science, Georgia Institute of Technology, 2009. http://www.cc.gatech.edu/research/reports/GT-CS-09-05.pdf.
29. Silicon Realms. Armadillo/software passport professional. http://siliconrealms.com/. Last accessed Mar. 6, 2009.
30. R. L. Sites, A. Chernoff, M. B. Kerk, M. P. Marks, and S. G. Robinson. Binary translation. Communication of the ACM, 36(2), Feb. 1993.
31. J. E. Smith and R. Nair. Virtual Machines: Versatile platforms for systems and processes. Morgan Kaufmann, 2005.
32. A. N. Sovarel, D. Evans, and N. Paul. Where's the FEEB? the effectiveness of instruction set randomization. In Proceedings of the USENIX Security Symposium, 2005.
33. R. Stata and M. Abadi. A type system for Java bytecode subroutines. ACM Transactions on Programming Languages and Systems (TOPLAS), 21(1), Jan. 1999.
34. Virus Total. http://www.virustotal.com/. Last accessed Mar. 6, 2009.
35. VMPsoft VMProtect. http://www.vmprotect.ru/. Last accessed Mar. 6, 2009.
36. J. Wilhelm and T.-c. Chiueh. A forced sampled execution approach to kernel rootkit identification. In Proceedings of the International Symposium on Recent Advances in Intrusion Detection (RAID), 2007.
37. G. Wondracek, C. Kruegel, and E. Kirda. Automatic network protocol analysis. In Proceeding of the Annual Network and Distributed System Security Symposium (NDSS), 2008.
38. H. Yin, D. Song, M. Egele, C. Kruegel, and E. Kirda. Panorama: Capturing system-wide information flow for malware detection and analysis. In Proceedings of the ACM Conference on Computer and Communications Security (CCS), 2007.