NDLI: Secure and advanced unpacking using computer emulation

Please wait, while we are loading the content...

Secure and advanced unpacking using computer emulation

Content Provider	Springer Nature Link
Author	Josse, Sébastien
Copyright Year	2007
Abstract	The purpose of this article is firstly to present a secure unpacker which is specifically designed for a security analyst when studying viruses but also any anti-virus scanner. Such a tool is in fact required when assessing security requirements of an anti-virus scanner through a black box approach. During testing of anti-virus software, a security analyst needs to build virus populations required for several penetration tests. Virus unpacking is a first mandatory step before gaining the ability to apply obfuscation transformation or any information extraction algorithm on a viral set. A secure unpacker is also useful when checking security robustness against reverse engineering of any packed or protected security product. Several static and dynamic analysis tools already implement unpacking algorithms, but these often require human intervention and are not well designed to automatically unpack such a dangerous program as a virus. A new algorithm for automatically unpacking encrypted viruses is presented in this paper. Forensics techniques to reconstruct an unpacked executable and advanced heuristics are also presented in order to decrypt more sophisticated self-protected Malwares. We present several detection techniques which are specifically designed to deceive virtual machine monitors and discuss the security of our tool against these low-level viral attacks. Our secure unpacker figures among a set of several tools. We then present in this paper a proof-of-concept human analysis framework which implements most standard components of an anti-virus scanner (real-time scanner, emulator engine) and in addition proposes a reliable system for automatically gaining information about a virus and its interaction with the OS executive (stealth native API hooking), but focuses on human decision as a detection process without the same resource limitation constraint as product oriented anti-virus scanners. This framework is used as a basis/reference for the comparative analysis of security aspects of anti-virus scanners and deals with the robustness of their driver stack and the efficiency of their de-obfuscation and unpacking algorithms.
Starting Page	221
Ending Page	236
Page Count	16
File Format	PDF
ISSN	17729890
Journal	Journal in Computer Virology
Volume Number	3
Issue Number	3
e-ISSN	17729904
Language	English
Publisher	Springer-Verlag
Publisher Date	2007-05-04
Publisher Place	Paris
Access Restriction	Subscribed
Subject Keyword	Malware analysis Anti-virus testing Forensics Software protection Fault injection Human driven analysis Computer Science
Content Type	Text
Resource Type	Article
Subject	1700/1701 Hardware and Architecture

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in

Generic unpacking techniques

Software testing and software fault injection

Ether: malware analysis via hardware virtualization extensions

CriticalFault: Amplifying Soft Error Effect Using Vulnerability-Driven Injection

A PIN-Based Dynamic Software Fault Injection System

On the emulation of software faults by software fault injection

Transparent and extensible malware analysis by combining hardware virtualization and software emulation.

Speeding Up Emulation-Based Diagnosis Techniques for Logic Cores

Software Faults Emulation by Software Fault Injection

Secure and advanced unpacking using computer emulation

Similar Documents

Generic unpacking techniques

Software testing and software fault injection

Ether: malware analysis via hardware virtualization extensions

CriticalFault: Amplifying Soft Error Effect Using Vulnerability-Driven Injection

A PIN-Based Dynamic Software Fault Injection System

On the emulation of software faults by software fault injection

Transparent and extensible malware analysis by combining hardware virtualization and software emulation.

Speeding Up Emulation-Based Diagnosis Techniques for Logic Cores

Software Faults Emulation by Software Fault Injection

Secure and advanced unpacking using computer emulation