UnThemida: Commercial obfuscation technique analysis with a fully obfuscated program

Abstract

The main goal of code obfuscation is to make software more difficult to reverse engineer. These techniques modify data structures and control flow while retaining the functionality of the original program. Although obfuscation is a useful method for protecting programs, it can also be used to protect malware. This raises concerns that malware could use code obfuscation to avoid detection by antivirus software. It is very difficult to analyze the functionality of obfuscated malware before it has been deobfuscated. Furthermore, commercial obfuscation tools allow malware authors to apply multiple obfuscation options simultaneously, and current deobfuscation techniques cannot handle this situation. In this study, we analyzed a well-known commercial obfuscation tool called Themida. We applied its many obfuscation options to a program and implemented a tool to recover the original code and data. We extracted features from obfuscated programs and analyzed their control flow. Our tool is based on these features and the control flow patterns and can identify whether Themida has been applied to the program and which obfuscation options have been used. Finally, we suggested a method for recovering the import address table of programs by using dynamic binary instrumentation. The proposed rules and algorithms can almost completely recover the APIs of programs even though they are hidden by obfuscation options provided by Themida.

Bypassing Anti-Analysis of Commercial Protector Methods Using DBI Tools

“…In this paper, since only anti-VM and anti-DBI techniques were analyzed, it is difficult to present experimental results on whether the proposed bypass algorithm works properly even when other obfuscation options are applied. However, in the case of Themida, it is a structure in which unpacking is executed if it is not detected after the anti-analysis technique is performed, and these two parts can be considered to be separate [19]. Even when other protection techniques are applied, anti-analysis techniques are performed first and followed by other techniques.…”

“…Even when other protection techniques are applied, anti-analysis techniques are performed first and followed by other techniques. Therefore, even if other options are applied, deobfuscation should be applied after bypassing the anti-analysis technique, according to Suk et al [19]. Since other commercial protectors have a similar structure, the bypass algorithm presented in this paper can work normally even when other obfuscation options are applied.…”

“…Suk et al [19] used PIN to analyze Themida. Based on the analysis results, Themida's unpacking method was implemented by the algorithm, and the unpacking results were verified using a large data set.…”

“…Packing is a technique that changes the control flow of program execution, making it difficult to analyze. As such, many analysts use dynamic binary instrumentation (DBI) tools to analyze the packing of commercial protectors [11], [17], [19]. DBI tools insert executable code at run time to help dynamically analyze program behavior and make it possible to effectively assess obfuscation and packing techniques.…”

x64Unpack: Hybrid Emulation Unpacker for 64-bit Windows Environments and Detailed Analysis Results on VMProtect 3.4

“…To the best of our knowledge, it cannot unpack recent version of sophisticated (commercial) packers, including VMProtect, Themida, and Safengine. Recently, UnThemida [36] was developed as a plug-in for the Pin tool to analyze and to unpack the structure of files packed with Themida 2.4.5. Unlike previous tools including UnThemida or UPX unpacker, x64Unpack is designed to cope with diverse packers: it can handle both finding general unpacking routines and evading various anti-reverse engineering techniques.…”