Generic Unpacking of Self-modifying, Aggressive, Packed Binary Programs

Details Generic Unpacking of Self-modifying, Aggressive, Packed Binary Programs Generic Unpacking of Self-modifying, Aggressive, Packed Binary Programs

2009-05-28

arxiv.org/abs/0905.4581v1

Computer Science

Cryptography and Security

10 pages

Scientific paper

Nowadays most of the malware applications are either packed or protected. This techniques are applied especially to evade signature based detectors and also to complicate the job of reverse engineers or security analysts. The time one must spend on unpacking or decrypting malware layers is often very long and in fact remains the most complicated task in the overall process of malware analysis. In this report author proposes MmmBop as a relatively new concept of using dynamic binary instrumentation techniques for unpacking and bypassing detection by self-modifying and highly aggressive packed binary code. MmmBop is able to deal with most of the known and unknown packing algorithms and it is also suitable to successfully bypass most of currently used anti-reversing tricks. This framework does not depend on any other 3rd party software and it is developed entirely in user mode (ring3). MmmBop supports the IA-32 architecture and it is targeted for Microsoft Windows XP, some of the further deliberations will be referring directly to this operating system.

Affiliated with

Also associated with

No associations

Rating

Generic Unpacking of Self-modifying, Aggressive, Packed Binary Programs does not yet have a rating. At this time, there are no reviews or comments for this scientific paper.

If you have personal experience with Generic Unpacking of Self-modifying, Aggressive, Packed Binary Programs, we encourage you to share that experience with our LandOfFree.com community. Your opinion is very important and Generic Unpacking of Self-modifying, Aggressive, Packed Binary Programs will most certainly appreciate the feedback.

Rate now

Comments { 0 }

Profile ID: LFWR-SCP-O-293461