Service interruption on Monday 11 July from 12:30 to 13:00: all the sites of the CCSD (HAL, Epiciences, SciencesConf, AureHAL) will be inaccessible (network hardware connection).
Skip to Main content Skip to Navigation
Conference papers

Gorille sniffs code similarities, the case study of Qwerty versus Regin

Guillaume Bonfante 1 Jean-yves Marion 1 Fabrice Sabatier 1 
1 CARTE - Theoretical adverse computations, and safety
Inria Nancy - Grand Est, LORIA - FM - Department of Formal Methods
Abstract : In the last decade, our group has developed a tool called Gorille which implements morphological analysis, roughly speaking control graph comparison of malware. Our first intention was to use it for malware detection, and this works quite well as already presented in [2]. However , morphological analysis outputs a more refine output than 'yes' or 'no'. In the current contribution, we show that it can be used in several ways for retro-engineering. First, we describe a rapid triggering process that enlighten code similarities. Second, we present a function identification mechanism which aim is to reveal some key code in a malware. Finally, we supply a procedure which separate different families of code given some samples. All these tasks are done (almost) automatically seen from a retro-engineering perspective.
Document type :
Conference papers
Complete list of metadata

Cited literature [7 references]  Display  Hide  Download
Contributor : Guillaume Bonfante Connect in order to contact the contributor
Submitted on : Wednesday, January 27, 2016 - 1:58:25 PM
Last modification on : Saturday, June 25, 2022 - 7:41:06 PM
Long-term archiving on: : Thursday, April 28, 2016 - 11:22:05 AM


Files produced by the author(s)


  • HAL Id : hal-01263123, version 1



Guillaume Bonfante, Jean-yves Marion, Fabrice Sabatier. Gorille sniffs code similarities, the case study of Qwerty versus Regin. Malware Conference, Oct 2015, Fajardo, Puerto Rico. pp.8. ⟨hal-01263123⟩



Record views


Files downloads