Ecole d'ingénieur et centre de recherche en Sciences du numérique

Automatic reverse engineering of malware emulators

Sharif, Monirul; Lanzi, Andrea; Giffin, Jonathon; Lee, Wenke

SP 2009, 30th IEEE Symposium on Security and Privacy, May 17-20, 2009, Oakland, California

Best Student Paper Award

            Malware authors have recently begun using emulation technology to obfuscate their code. They convert native malware binaries into bytecode programs written in a randomly generated instruction set and paired with a native binary emulator that interprets the bytecode. No existing malware analysis can reliably reverse this obfuscation technique. In this paper, we present the first work in automatic reverse engineering of malware emulators. Our algorithms are based on dynamic analysis. We execute the emulated malware in a protected environment and record the entire x86 instruction trace generated by the emulator. We then use dynamic data-flow and taint analysis over the trace to identify data buffers containing the bytecode program and extract the syntactic and semantic information about the bytecode instruction set. With these analysis outputs, we are able to generate data structures, such as control-flow graphs, that provide the foundation for subsequent malware analysis. We implemented a proof-of-concept system called Rotalum´e and evaluated it using both legitimate programs and malware emulated by VMProtect and Code Virtualizer. The results show that Rotalum´e accurately reveals the syntax and semantics of emulated instruction sets and reconstructs execution paths of original programs from their bytecode representations.

Doi Bibtex

Titre:Automatic reverse engineering of malware emulators
Mots Clés:Emulation , Malware Analysis , Obfuscation , Reverse-engineering
Département:Sécurité numérique
Eurecom ref:3105
Copyright: © 2009 IEEE. Personal use of this material is permitted. However, permission to reprint/republish this material for advertising or promotional purposes or for creating new collective works for resale or redistribution to servers or lists, or to reuse any copyrighted component of this work in other works must be obtained from the IEEE.
Bibtex: @inproceedings{EURECOM+3105, doi = { }, year = {2009}, title = {{A}utomatic reverse engineering of malware emulators}, author = {{S}harif, {M}onirul and {L}anzi, {A}ndrea and {G}iffin, {J}onathon and {L}ee, {W}enke}, booktitle = {{SP} 2009, 30th {IEEE} {S}ymposium on {S}ecurity and {P}rivacy, {M}ay 17-20, 2009, {O}akland, {C}alifornia}, address = {{O}akland, {\'{E}}{TATS}-{UNIS}}, month = {05}, url = {} }
Voir aussi: