Skip to Main content Skip to Navigation
New interface
Conference papers

Analysis and Diversion of Duqu's Driver

Guillaume Bonfante 1 Jean-Yves Marion 1 Fabrice Sabatier 1 Aurélien Thierry 1 
1 CARTE - Theoretical adverse computations, and safety
Inria Nancy - Grand Est, LORIA - FM - Department of Formal Methods
Abstract : The propagation techniques and the payload of Duqu have been closely studied over the past year and it has been said that Duqu shared functionalities with Stuxnet. We focused on the driver used by Duqu during the infection, our contribution consists in reverse-engineering the driver: we rebuilt its source code and analyzed the mechanisms it uses to execute the payload while avoiding detection. Then we diverted the driver into a defensive version capable of detecting injections in Windows binaries, thus preventing further attacks. We specifically show how Duqu's modified driver would have detected Duqu.
Document type :
Conference papers
Complete list of metadata

Cited literature [4 references]  Display  Hide  Download
Contributor : Aurélien Thierry Connect in order to contact the contributor
Submitted on : Wednesday, January 8, 2014 - 10:56:48 AM
Last modification on : Saturday, June 25, 2022 - 7:43:29 PM
Long-term archiving on: : Tuesday, April 8, 2014 - 10:31:36 PM


Files produced by the author(s)


  • HAL Id : hal-00925517, version 1
  • ARXIV : 1401.6120



Guillaume Bonfante, Jean-Yves Marion, Fabrice Sabatier, Aurélien Thierry. Analysis and Diversion of Duqu's Driver. Malware 2013 - 8th International Conference on Malicious and Unwanted Software, Oct 2013, Fajardo, Puerto Rico. ⟨hal-00925517⟩



Record views


Files downloads