Abstract:Software deobfuscation is a crucial activity in security analysis and especially, in malware analysis. While standard static and dynamic approaches suffer from well-known shortcomings, Dynamic Symbolic Execution (DSE) has recently been proposed has an interesting alternative, more robust than static analysis and more complete than dynamic analysis. Yet, DSE addresses certain kinds of questions encountered by a reverser namely feasibility questions. Many issues arising during reverse, e.g. detecting protection schemes such as opaque predicates fall into the category of infeasibility questions. In this article, we present the Backward-Bounded DSE, a generic, precise, efficient and robust method for solving infeasibility questions. We demonstrate the benefit of the method for opaque predicates and call stack tampering, and give some insight for its usage for some other protection schemes. Especially, the technique has successfully been used on state-of-the-art packers as well as on the government-grade X-Tunnel malware -- allowing its entire deobfuscation. Backward-Bounded DSE does not supersede existing DSE approaches, but rather complements them by addressing infeasibility questions in a scalable and precise manner. Following this line, we propose sparse disassembly, a combination of Backward-Bounded DSE and static disassembly able to enlarge dynamic disassembly in a guaranteed way, hence getting the best of dynamic and static disassembly. This work paves the way for robust, efficient and precise disassembly tools for heavily-obfuscated binaries.

Identification of Exception Return in Subroutine of Executable File

Analysis of Abnormity Return in Subprogram from Malicious Executables

FMDiv: Functional Module Division on Binary Malware for Accurate Malicious Code Localization.

Happer - Unpacking Android Apps via a Hardware-Assisted Approach.

Method of Malware Behavior Analysis in Disassembly Level

Misleading Malware Similarities Analysis By Automatic Data Structure Obfuscation

Disassembling Obfuscated Executables with LLM

Efficient Detection Of The Return-Oriented Programming Malicious Code

A Method and Implementation of Control Flow Obfuscation Using SEH

deRop: removing return-oriented programming from malware

Targeting Infeasibility Questions on Obfuscated Codes

Structural Feature Based Anomaly Detection for Packed Executable Identification

DeepReturn: A Deep Neural Network Can Learn How to Detect Previously-Unseen ROP Payloads Without Using Any Heuristics

Malicious cryptography techniques for unreversable (malicious or not) binaries

DROP: Detecting Return-Oriented Programming Malicious Code

ROPNN: Detection of ROP Payloads Using Deep Neural Networks

A fine-grained classification approach for the packed malicious code

Obfuscated Malware Detection: Investigating Real-world Scenarios through Memory Analysis

2-SPIFF: a 2-stage packer identification method based on function call graph and file attributes

Malicious code detection in android: the role of sequence characteristics and disassembling methods

Pinicorn: Towards Automated Dynamic Analysis for Unpacking 32-Bit PE Malware