Graduate School and Research Center in Digital Sciences

SoK: Deep packer inspection: A longitudinal study of the complexity of run-time packers

Ugarte-Pedrero, Xabier; Balzarotti, Davide; Santos, Igor; Bringas, Pablo G

SSP 2015, IEEE Symposium on Security and Privacy, May 18-20, 2015, San Jose, CA, USA

Run-time packers are often used by malware-writers to obfuscate their code and hinder static analysis. The packer problem has been widely studied, and several solutions have been proposed in order to generically unpack protected binaries. Nevertheless, these solutions commonly rely on a number of assumptions that may not necessarily reflect the reality of the packers used in the wild. Moreover, previous solutions fail to provide useful information about the structure of the packer or its complexity. In this paper, we describe a framework for packer analysis and we propose a taxonomy to measure the runtime complexity of packers. We evaluated our dynamic analysis system on two datasets, composed of both off-the-shelf packers and custom packed binaries. Based on the results of our experiments, we present several statistics about the packers complexity and their evolution over time. 

Document Doi Bibtex

Title:SoK: Deep packer inspection: A longitudinal study of the complexity of run-time packers
City:San Jose
Department:Digital Security
Eurecom ref:4521
Copyright: © 2015 IEEE. Personal use of this material is permitted. However, permission to reprint/republish this material for advertising or promotional purposes or for creating new collective works for resale or redistribution to servers or lists, or to reuse any copyrighted component of this work in other works must be obtained from the IEEE.
Bibtex: @inproceedings{EURECOM+4521, doi = {}, year = {2015}, title = {{S}o{K}: {D}eep packer inspection: {A} longitudinal study of the complexity of run-time packers}, author = {{U}garte-{P}edrero, {X}abier and {B}alzarotti, {D}avide and {S}antos, {I}gor and {B}ringas, {P}ablo {G}}, booktitle = {{SSP} 2015, {IEEE} {S}ymposium on {S}ecurity and {P}rivacy, {M}ay 18-20, 2015, {S}an {J}ose, {CA}, {USA}}, address = {{S}an {J}ose, {UNITED} {STATES}}, month = {05}, url = {} }
See also: