Obfuscation of executable code to improve resistance to static disassembly

Linn, Cullen; Debray, Saumya

doi:10.1145/948148.948149

Cited by 264 publications

(201 citation statements)

References 0 publications

Supporting

Mentioning

194

Contrasting

Unclassified

Order By: Relevance

“…Note that the techniques presented here are rather trivial, compared to elaborate binary code obfuscation methods [30][31][32], but powerful enough to illustrate the limitations of detection methods based on static analysis. Advanced techniques for complicating static analysis have also been extensively used for tamper-resistant software and for preventing the reverse engineering of executables, as a defense against software piracy [33][34][35].…”

Section: Static Analysis Resistant Polymorphic Shellcodementioning

confidence: 99%

Network-level polymorphic shellcode detection using emulation

2006

View full text Add to dashboard Cite

Significant progress has been made in recent years towards preventing code injection attacks at the network level. However, as state-of-the-art attack detection technology becomes more prevalent, attackers are likely to evolve, employing techniques such as polymorphism and metamorphism to defeat these defenses. A major outstanding question in security research and engineering is thus whether we can proactively develop the tools needed to contain advanced polymorphic and metamorphic attacks. While recent results have been promising, most of the existing proposals can be defeated using only minor enhancements to the attack vector. In fact, some publicly-available polymorphic shellcode engines are currently one step ahead of the most advanced publicly-documented network-level detectors. In this paper, we present a heuristic detection method that scans network traffic streams for the presence of previously unknown polymorphic shellcode. In contrast to previous work, our approach relies on a NIDSembedded CPU emulator that executes every potential instruction sequence in the inspected traffic, aiming to identify the execution behavior of polymorphic shellcode. Our analysis demonstrates that the proposed

show abstract

Section: Static Analysis Resistant Polymorphic Shellcodementioning

confidence: 99%

Network-level polymorphic shellcode detection using emulation

2006

View full text Add to dashboard Cite

show abstract

“…In the context of disassembly, obfuscation refers to transformations of the binary such that the parsing of instructions becomes difficult. In [9], Linn and Debray introduced novel obfuscation techniques that exploit the fact that the Intel x86 instruction set architecture contains variable length instructions that can start at arbitrary memory address. By inserting padding bytes at locations that cannot be reached during run-time, disassemblers can be confused to misinterpret large parts of the binary.…”

Section: Static Analysis Techniquesmentioning

confidence: 99%

Dynamic Analysis of Malicious Code

Bayer¹,

Moser²,

Kruegel³

et al. 2006

J Comput Virol

244

143

View full text Add to dashboard Cite

Malware analysis is the process of determining the purpose and functionality of a given malware sample (such as a virus, worm, or Trojan horse). This process is a necessary step to be able to develop effective detection techniques for malicious code. In addition, it is an important prerequisite for the development of removal tools that can thoroughly delete malware from an infected machine. Traditionally, malware analysis has been a manual process that is tedious and timeintensive. Unfortunately, the number of samples that need to be analyzed by security vendors on a daily basis is constantly increasing. This clearly reveals the need for tools that automate and simplify parts of the analysis process. In this paper, we present TTAnalyze, a tool for dynamically analyzing the behavior of Windows executables. To this end, the binary is run in an emulated operating system environment and its (security-relevant) actions are monitored. In particular, we record the Windows native system calls and Windows API functions that the program invokes. One important feature of our system is that it does not modify the program that it executes (e.g., through API call hooking or breakpoints), making it more difficult to detect by malicious code. Also, our tool runs binaries in an unmodified Windows environment, which leads to excellent emulation accuracy. These factors make TTAnalyze an ideal tool for quickly understanding the behavior of an unknown malware.

show abstract

“…These techniques usually do not require disassembling binary code. This is appealing, since malicious coders can employ a number of techniques to thwart disassembly [14]. However, they are susceptible to certain types of obfuscation such as the substitution of semantically equivalent instruction sequences.…”

Section: Related Workmentioning

confidence: 99%

A boosting ensemble for the recognition of code sharing in malware

2008

View full text Add to dashboard Cite

Research and development efforts have recently started to compare malware variants, as it is believed that malware authors are reusing code. A number of these projects have focused on identifying functions through the use of signature-based classifiers. We introduce three new classifiers that characterize a function's use of global data. Experiments on malware show that we can meaningfully correlate functions on the basis of their global data references even when their functions share little code. We also present an algorithm that combines existing classifiers and our new ones into an ensemble for correlating functions in two binary programs. For testing, we developed a model for comparing our work to previous signature based classifiers. We then used that model to show how our new combined ensemble classifier dominates the previously reported classifiers. The resulting ensemble can be used by malware analysts when they are comparing two binaries. This technique will allow them to correlate both functions and global data references between the two and will lead to a quick identification of any sharing that is occurring.

show abstract

Obfuscation of executable code to improve resistance to static disassembly

Cited by 264 publications

References 0 publications

Network-level polymorphic shellcode detection using emulation

Network-level polymorphic shellcode detection using emulation

Dynamic Analysis of Malicious Code

A boosting ensemble for the recognition of code sharing in malware

Contact Info

Product

Resources

About