Unconditional self-modifying code elimination with dynamic compiler optimizations

Isabelle Gnaedig 1, * Matthieu Kaczmarek 1 Daniel Reynaud 1 Stéphane Wloka 1
* Auteur correspondant
1 CARTE - Theoretical adverse computations, and safety
Inria Nancy - Grand Est, LORIA - FM - Department of Formal Methods
Abstract : This paper deals with the issue of self-modifying code and packed programs, a long-standing problem commonly addressed by emulation techniques and memory dumps. We propose an original semantics-based approach to simplify dynamic code analysis, by using compiler optimization techniques to get rid of code-generating instructions. For this, we use classic slicing techniques to identify code dependencies. As it is semantics-based, our approach allows us to rely on strongly established formal methods and is a promising approach for handling packed programs.
Type de document :
Communication dans un congrès
Fernando C. Colón Osorio. 5th International Conference on Malicious and Unwanted Software, Oct 2010, Nancy, France. IEEE, CFP1059F-PRT, 2010, Proceedings of the 5th International Conference on Malicious and Unwanted Software
Liste complète des métadonnées

Littérature citée [24 références]  Voir  Masquer  Télécharger

https://hal.inria.fr/inria-00538376
Contributeur : Isabelle Gnaedig <>
Soumis le : lundi 22 novembre 2010 - 13:51:54
Dernière modification le : jeudi 11 janvier 2018 - 06:21:25
Document(s) archivé(s) le : vendredi 26 octobre 2012 - 16:20:19

Fichier

packer.pdf
Fichiers produits par l'(les) auteur(s)

Identifiants

  • HAL Id : inria-00538376, version 1

Collections

Citation

Isabelle Gnaedig, Matthieu Kaczmarek, Daniel Reynaud, Stéphane Wloka. Unconditional self-modifying code elimination with dynamic compiler optimizations. Fernando C. Colón Osorio. 5th International Conference on Malicious and Unwanted Software, Oct 2010, Nancy, France. IEEE, CFP1059F-PRT, 2010, Proceedings of the 5th International Conference on Malicious and Unwanted Software. 〈inria-00538376〉

Partager

Métriques

Consultations de la notice

200

Téléchargements de fichiers

356