[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Full-disclosure] PAPER: Generic Unpacking of Self-modifying, Aggressive, Packed Binary Programs
- To: "FULLDISC" <full-disclosure@xxxxxxxxxxxxxxxxx>
- Subject: [Full-disclosure] PAPER: Generic Unpacking of Self-modifying, Aggressive, Packed Binary Programs
- From: "Piotr Bania" <bania.piotr@xxxxxxxxx>
- Date: Mon, 25 May 2009 18:18:32 +0200
ABSTRACT
Nowadays most of the malware applications are either packed or protected.
This techniques are applied especially to evade signature based detectors
and also to complicate the job of reverse engineers or security analysts.
The time one must spend on unpacking or decrypting malware layers is often
very long and in fact remains the most complicated task in the overall
process of malware analysis. In this report author proposes MmmBop as a
relatively new concept of using dynamic binary instrumentation techniques
for unpacking and bypassing detection by self-modifying and highly
aggressive packed binary code. MmmBop is able to deal with most of the known
and unknown packing algorithms and it is also suitable to successfully
bypass most of currently used anti-reversing tricks. [...]
Paper can be found at:
http://piotrbania.com/all/articles/pbania-dbi-unpacking2009.pdf
best regards,
pb
--
--------------------------------------------------------------------
Piotr Bania - <bania.piotr@xxxxxxxxx> - 0xCD, 0x19
Fingerprint: 413E 51C7 912E 3D4E A62A BFA4 1FF6 689F BE43 AC33
http://www.piotrbania.com - Key ID: 0xBE43AC33
--------------------------------------------------------------------
- "The more I learn about men, the more I love dogs."
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/