Malware authors have recently begun using emulation technology to obfuscate their code. They convert native malware binaries into bytecode programs written in a randomly generated instruction set and paired with a native binary emulator that interprets the bytecode. No existing malware analysis can reliably reverse this obfuscation technique. In this paper, we present the first work in automatic reverse engineering of malware emulators. Our algorithms are based on dynamic analysis. We execute the emulated malware in a protected environment and record the entire x86 instruction trace generated by the emulator. We then use dynamic data-flow and taint analysis over the trace to identify data buffers containing the bytecode program and extract the syntactic and semantic information about the bytecode instruction set. With these analysis outputs, we are able to generate data structures, such as control-flow graphs, that provide the foundation for subsequent malware analysis. We implemented a proof-of-concept system called Rotalume and evaluated it using both legitimate programs and malware emulated by VMProtect and code virtualizer. The results show that Rotalume accurately reveals the syntax and semantics of emulated instruction sets and reconstructs execution paths of original programs from their bytecode representations.
Automatic reverse engineering of malware emulators / M. Sharif, A. Lanzi, J. Giffin, W. Lee - In: Proceedings of the 2009 30th IEEE Symposium on security and privacy : 17-20 may 2009, Berkeley, CA, USALos Alamitos : Institute of electrical and electronics engineers, 2009 May. - ISBN 9780769536330. - pp. 94-109 (( Intervento presentato al 30. convegno IEEE Symposium on Security and Privacy tenutosi a Berkeley nel 2009.
|Titolo:||Automatic reverse engineering of malware emulators|
LANZI, ANDREA (Secondo)
|Settore Scientifico Disciplinare:||Settore INF/01 - Informatica|
|Data di pubblicazione:||mag-2009|
|Digital Object Identifier (DOI):||http://dx.doi.org/10.1109/SP.2009.27|
|Tipologia:||Book Part (author)|
|Appare nelle tipologie:||03 - Contributo in volume|