Deobfuscation of virtualization-obfuscated software: A semantics-based approach

Proceedings of the ACM Conference on Computer and Communications Security

Volumn , Issue , 2011, Pages 275-284

  Coogan, Kevin ^a   Lu, Gen ^a   Debray, Saumya ^a  

^a Gould Simpson Building   (United States)

Author keywords

Deobfuscation; Dynamic analysis; Virtualization

Indexed keywords

AUTOMATED ANALYSIS; BYTECODES; DEOBFUSCATION; MALICIOUS CODES; MALWARES; OBSERVABLE BEHAVIOR; PROTOTYPE TOOLS; REVERSE ENGINEERS; STATIC AND DYNAMIC ANALYSIS; VIRTUALIZATIONS;

COMPUTER CRIME; DYNAMIC ANALYSIS; ENGINEERS; PROGRAM INTERPRETERS; SECURITY OF DATA; SEMANTICS;

VIRTUAL REALITY;

EID: 80755169494     PISSN: 15437221     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1145/2046707.2046739     Document Type: Conference Paper

References (17)

1. VX Heavens, 2011. http://vx.netlux.org/.
2. A. V. Aho, R. Sethi, and J. D. Ullman. Compilers - Principles, Techniques, and Tools. Addison-Wesley, Reading, Mass., 1985.
3. F. Bellard. QEMU, a fast and portable dynamic translator. In USENIX Annual Technical Conference, FREENIX Track, pages 41-46. USENIX, 2005.
4. K. Coogan and S. Debray. Equational reasoning on x86 assembly code. Source Code Analysis and Manipulation, IEEE International Workshop on, 2011.
5. A. Dinaburg, P. Royal, M. I. Sharif, and W. Lee. Ether: malware analysis via hardware virtualization extensions. In Proceedings of the 2008 ACM Conference on Computer and Communications Security, CCS 2008, Alexandria, Virginia, USA, October 27-31, 2008, pages 51-62, 2008.
6. N. Falliere. Inside the jaws of Trojan. Clampi. Technical report, Symantec Corp., Nov. 2009.
7. N. D. Jones, C. K. Gomard, and P. Sestoft. Partial Evaluation and Automatic Program Generation. Prentice Hall, 1993.
8. A. Lakhotia, E. U. Kumar, and M. Venable. A method for detecting obfuscated calls in malicious binaries. IEEE Transactions on Software Engineering, 31(11):955-968, 2005.
9. B. Lau. Dealing with virtualization packer. In Second CARO Workshop on Packers, Decryptors, and Obfuscators, May 2008.
10. A. Moser, C. Kruegel, and E. Kirda. Exploring multiple execution paths for malware analysis. In SP '07: Proceedings of the 2007 IEEE Symposium on Security and Privacy, pages 231-245, 2007. (Pubitemid 47432530)
11. Oreans Technologies. Code virtualizer: Total obfuscation against reverse engineering, Dec. 2008. http://www.oreans.com/codevirtualizer.php.
12. R. Rolles. Unpacking virtualization obfuscators. In Proc. 3rd USENIX Workshop on Offensive Technologies (WOOT '09), Aug. 2009.
13. M. Sharif, A. Lanzi, J. Giffin, and W. Lee. Automatic reverse engineering of malware emulators. In Proc. 2009 IEEE Symposium on Security and Privacy, May 2009.
14. F. Tip. A survey of program slicing techniques. Journal of Programming Languages, 3:121-189, 1995.
15. S. K. Udupa, S. K. Debray, and M. Madou. Deobfuscation: Reverse engineering obfuscated code. In Proc. 12th IEEE Working Conference on Reverse Engineering, pages 45-54, Nov. 2005.
16. VMProtect Software. Vmprotect software protection, 2008. http://vmpsoft.com/.
17. C. Wang, J. Davidson, J. Hill, and J. Knight. Protection of software-based survivability mechanisms. In Proc. International Conference of Dependable Systems and Networks, July 2001.