Abstract:Static analysis is often impeded by malware obfuscation techniques, such as encryption and packing, whereas dynamic analysis tends to be more resistant to obfuscation by leveraging concrete execution information. Unfortunately, malware can employ evasive techniques to detect the analysis environment and alter its behavior accordingly. While known evasive techniques can be explicitly dismantled, the challenge lies in generically dismantling evasions without full knowledge of their conditions or implementations, such as logic bombs that rely on uncertain conditions, let alone unsupported evasive techniques, which contain evasions without corresponding dismantling strategies and those leveraging unknown implementations. In this paper, we present Antitoxin, a prototype for automatically exploring evasive malware. Antitoxin utilizes multi-path exploration guided by taint analysis and probability calculations to effectively dismantle evasive techniques. The probabilities of branch execution are derived from dynamic coverage, while taint analysis helps identify paths associated with evasive techniques that rely on uncertain conditions. Subsequently, Antitoxin prioritizes branches with lower execution probabilities and those influenced by taint analysis for multi-path exploration. This is achieved through forced execution, which forcefully sets the outcomes of branches on selected paths. Additionally, Antitoxin employs active anti-evasion countermeasures to dismantle known evasive techniques, thereby reducing exploration overhead. Furthermore, Antitoxin provides valuable insights into sensitive behaviors, facilitating deeper manual analysis. Our experiments on a set of highly evasive samples demonstrate that Antitoxin can effectively dismantle evasive techniques in a generic manner. The probability calculations guide the multi-path exploration of evasions without requiring prior knowledge of their conditions or implementations, enabling the dismantling of unsupported techniques such as C2 and significantly improving efficiency compared to linear exploration when dealing with complex control flows. Additionally, taint analysis can accurately identify branches related to logic bombs, facilitating preferential exploration.

Targeting Infeasibility Questions on Obfuscated Codes

How to Kill Symbolic Deobfuscation for Free; or Unleashing the Potential of Path-Oriented Protections

Extended Report on the Obfuscated Integration of Software Protections

SEEAD: A Semantic-Based Approach for Automatic Binary Code De-obfuscation

Semantics-based binary code automated de-obfuscation approach

Towards Extracting Control Flow Abstraction with Static Disassembly for Binary Code

Binary Obfuscation Based Reassemble

deRop: removing return-oriented programming from malware

Malicious cryptography techniques for unreversable (malicious or not) binaries

Deobfuscate Non-Returning Calls and Call-Stack Tampering in Instruction Traces

Drndalo: Lightweight Control Flow Obfuscation Through Minimal Processor/Compiler Co-Design

Input-Output Example-Guided Data Deobfuscation on Binary

Reverse Technique Of Malicious Obfuscated Binary Code Based On Control Flow Graph

Multi-path Exploration Guided by Taint and Probability Against Evasive Malware

Eliminate Evading Analysis Tricks In Malware Using Dynamic Slicing

Exploit Dynamic Data Flows to Protect Software Against Semantic Attacks

In-depth Testing of X86 Instruction Disassemblers with Feedback Controlled DFS Algorithm

Pinicorn: Towards Automated Dynamic Analysis for Unpacking 32-Bit PE Malware

SoK: All You Ever Wanted to Know About x86/x64 Binary Disassembly But Were Afraid to Ask

Obfuscation resilient binary code reuse through trace-oriented programming

A Smart Obfuscation Approach to Protect Software in Cloud