역난독화를 위한 바이너리 프로그램 슬라이싱
Program Slicing for Binary code Deobfuscation
0
조회
0
다운로드
5
인용
0
참고문헌
키워드
초록
해커들이 자신들이 만든 악성코드의 분석을 어렵게 하기 위하여 코드 난독화 기법을 적용하고 있다. 최근의 난독화 기법은 가상화 난독화 기법을 통해 원래의 코드를 바이트코드로 만들고 가상머신이 이를 실행시키는 방식으로, 실행시키기전에는 원래의 코드를 알 수가 없다. 프로그램 슬라이싱은 프로그램 분석기술 중 하나로 슬라이싱 기준을 정하고 그와관련된 문장을 추출해내는 기술이다. 본 논문에서는 슬라이싱 기법을 사용하여 난독화를 해제하는 방법을 제시한다.
Abstract
Hackers have obfuscated their malware to avoid being analyzed. Recently, obfuscation tools translate original codes into bytecodes to use virtualized-obfuscation, so that bytecodes are executed by virtual machines. In such cases, malware analysts fail to know about the malware before execution of the codes. We found that program slicing is one of promising program analysis techniques to solve this problem. The main concepts of program slice include slicing criteria given by analysts and sliced statements according to the slicing criteria. This paper proposes a deobfuscation method based on program slicing technique.
참고문헌 (15)
- K. Coogan, "Deobfuscation of Virtualization-Obfuscated Software", Proceedings of the 18th ACM Conference on Computer and Communications Security, pp.275~284 (2011)
- B. Yadegari, "Bit-level Taint Analysis", 14th IEEE International Working Conference on Source Code Analysis and Manipulation, pp.255~264 (2014)
- N. Sasirekha, "Program slicing techniques and its applications", International Journal of Software Engineering and Applications, 2(3), pp.50~64 (2011)
- X. Zhang, "Precise Dynamic Slicing Algorithms", Proceedings of the 25th International Conference on Software Engineering, pp.319~329 (2003)
- T. Dullien, "REIL : A platform-independent intermediate representation of dissassembled code for static code analysis", CanSecWest 2009 (2009)
- "Pin"[URL]
- "CodeVirualizer"[URL]
- H. Agrawal, "Dynamic Program Slicing", Proceedings of the ACM SIGPLAN'90 Conference on Programming Language Design and Implementation, pp.246~256 (1990)
- "VMware"[URL]
- "UPX"[URL]
- "VDT"[URL]
- D. Kim, "Triaging Crashes with Backward Taint Analysis for ARM Architecture", Black Hat EUROPE 2015 (2015)
- M. Sharif, "Automatic Reverse Engineering of Malware Emulators", 30th IEEE Symposium on Security and Privacy, pp.94~109 (2009)
- "midgetpack"[URL]