SEEAD:A Semantic-based Approach for Automatic Binary Code De-obfuscation

Tang, Zhanyong and Wang, Lei and Kuang, Kaiyuan and Xue, Chao and Gong, Xiaoqing and Chen, Xiaojiang and Fang, Dingyi and Wang, Zheng (2017) SEEAD:A Semantic-based Approach for Automatic Binary Code De-obfuscation. In: 16th IEEE International Conference on Trust, Security and Privacy in Computing and Communications (IEEE TrustCom-17). IEEE, pp. 261-268. ISBN 9781509049073

[img]
Preview
PDF (SeeAD)
SeeAD.pdf - Accepted Version
Available under License Creative Commons Attribution-NonCommercial.

Download (300kB)

Abstract

Increasingly sophisticated code obfuscation techniques are quickly adopted by malware developers to escape from malware detection and to thwart the reverse engineering effort of security analysts. State-of-the-art de-obfuscation approaches rely on dynamic analysis, but face the challenge of low code coverage as not all software execution paths and behavior will be exposed at specific profiling runs. As a result, these approaches often fail to discover hidden malicious patterns. This paper introduces SEEAD, a novel and generic semantic-based de-obfuscation system. When building SEEAD, we try to rely on as few assumptions about the structure of the obfuscation tool as possible, so that the system can keep pace with the fast evolving code obfuscation techniques. To increase the code coverage, SEEAD dynamically directs the target program to execute different paths across different runs. This dynamic profiling scheme is rife with taint and control dependence analysis to reduce the search overhead, and a carefully designed protection scheme to bring the program to an error free status should any error happens during dynamic profile runs. As a result, the increased code coverage enables us to uncover hidden malicious behaviors that are not detected by traditional dynamic analysis based de-obfuscation approaches. We evaluate SEEAD on a range of benign and malicious obfuscated programs. Our experimental results show that SEEAD is able to successfully recover the original logic from obfuscated binaries.

Item Type:
Contribution in Book/Report/Proceedings
Additional Information:
©2017 IEEE. Personal use of this material is permitted. However, permission to reprint/republish this material for advertising or promotional purposes or for creating new collective works for resale or redistribution to servers or lists, or to reuse any copyrighted component of this work in other works must be obtained from the IEEE.
ID Code:
86315
Deposited By:
Deposited On:
15 May 2017 08:14
Refereed?:
Yes
Published?:
Published
Last Modified:
20 Sep 2020 06:34