ReconBin: Reconstructing Binary File from Ezecution for Software Analysis
Static analysis is one of the most popular approaches of software analysis. As more and more software protects their code by transformation or encryption, then releases them at runtime dynamically, it is hard to statically analyze these protected executables because of the failure of disassembling. In this paper, we propose a novel and general technique to reconstruct binary files for static analysis by monitoring the executions of protected executables. Our approach can identify and extract the dynamically released code at runtime, and at the same time record the control transfers information, and then reconstruct a binary file based on the original executable. The whole process does not depend on any prior knowledge on the protection methods. Experiments on our prototype ReconBin show that our approach can properly reconstruct the executables protected by SMC and packers, and the reconstructed binary files can be successfully analyzed by static analysis tools such as IDA Pro. We show that it also can be used to analyze the code dynamically generated by virtual machines, emulators, and buffer overflow attacks, which also dynamically inject attack code into stack and direct execution flow to it.
ezecution monitoring software security analysis malware analysis binary analysis
Lingyun YING Purui SU Dengguo FENG Xianggen WANG Yi YANG Yu LIU
State Key Lab of Information Security Institute of Software,Chinese Academy of Sciences Beijing, Chi State Key Lab of Information Security Institute of Software, Chinese Academy of Sciences Beijing, Ch National Engineering Research Center for Information Security Beijing, China National Engineering Research Center for Information Security Beijing,China
国际会议
上海
英文
222-229
2009-07-08（万方平台首次上网日期，不代表论文的发表时间）