Name
Abstract | ||
|---|---|---|
Packing is a very popular technique for obfuscating programs, and malware in particular. In order to successfully detect packed malware, dynamic unpacking techniques have been proposed in literature. Dynamic unpackers execute and monitor a packed program, and try to guess when the original code of the program is available unprotected in memory. The major drawback of dynamic unpackers is the performance overhead they introduce. To reduce the overhead and make it possible to perform dynamic unpacking at end-hosts, researches have proposed real-time unpackers that operate at a coarser granularity, namely OmniUnpack and Justin. In this paper, we present a simple compile-time packing algorithm that maximizes the cost of unpacking and minimizes the amount of program code that can be automatically recovered by real-time coarse grained unpackers. The evaluation shows that the real-time dynamic unpackers are totally ineffective against this algorithm. |
Year | DOI | Venue |
|---|---|---|
2011 | 10.1145/1972551.1972556 | EUROSEC |
Keywords | Field | DocType |
dynamic unpacking technique,real-time dynamic unpacking,real-time coarse grained unpackers,real-time unpackers,dynamic unpacking,original code,real-time dynamic unpackers,program code,obfuscating program,dynamic unpackers,packed program,real time,virtualization | Drawback,Virtualization,Program code,Computer security,Computer science,Granularity,Malware,Unpacking,Malware analysis | Conference |
Citations | PageRank | References |
2 | 0.41 | 11 |
Authors | ||
3 | ||
Name | Order | Citations | PageRank |
|---|---|---|---|
| Leyla Bilge | 1 | 911 | 43.78 |
| Andrea Lanzi | 2 | 845 | 40.99 |
| Davide Balzarotti | 3 | 2040 | 113.64 |