SymSem: Symbolic Execution with Time Stamps for Deobfuscation
H Li, Y Zhan, W Jianqiang, D Gu - … 2019, Nanjing, China, December 6–8 …, 2020 - Springer
H Li, Y Zhan, W Jianqiang, D Gu
Information Security and Cryptology: 15th International Conference, Inscrypt …, 2020•SpringerCode virtualization technique obfuscates programs by transforming original code to self-
defined bytecode in a different instruction architecture. It is widely used in obfuscating
malware for its ability to render normal analysis ineffective. Using symbolic execution to
assist in deobfuscating such programs turned to be a trend in recent research. However, we
found many challenges that may lead to semantic confusion in previous symbolic execution
technique, and proposed a novel symbolic execution technique enhanced by time stamps to …
defined bytecode in a different instruction architecture. It is widely used in obfuscating
malware for its ability to render normal analysis ineffective. Using symbolic execution to
assist in deobfuscating such programs turned to be a trend in recent research. However, we
found many challenges that may lead to semantic confusion in previous symbolic execution
technique, and proposed a novel symbolic execution technique enhanced by time stamps to …
Abstract
Code virtualization technique obfuscates programs by transforming original code to self-defined bytecode in a different instruction architecture. It is widely used in obfuscating malware for its ability to render normal analysis ineffective. Using symbolic execution to assist in deobfuscating such programs turned to be a trend in recent research. However, we found many challenges that may lead to semantic confusion in previous symbolic execution technique, and proposed a novel symbolic execution technique enhanced by time stamps to tackle these issues. For evaluation, we implemented it as a prototype of SymSem and deobfuscated programs protected by popular virtual machines. The results indicate that our method is able to accurately recover the semantics of obfuscated function trace.
Springer
Showing the best result for this search. See all results