Detail publikace

Generic detection of register realignment

Originální název

Generic detection of register realignment

Anglický název

Generic detection of register realignment

Jazyk

en

Originální abstrakt

The register realignment is a method of binary obfuscation and it is used by malware writers. The paper introduces the method how register realignment can be recognized by analysis based on the scattered context grammars. Such an analysis includes exploration of bytes affected by realignment, finding new valid values for them, building the scattered context grammar and parse an obfuscated code by this grammar. The created grammar has LL property - an ability for parsing by this type of grammar.

Anglický abstrakt

The register realignment is a method of binary obfuscation and it is used by malware writers. The paper introduces the method how register realignment can be recognized by analysis based on the scattered context grammars. Such an analysis includes exploration of bytes affected by realignment, finding new valid values for them, building the scattered context grammar and parse an obfuscated code by this grammar. The created grammar has LL property - an ability for parsing by this type of grammar.

BibTex


@inproceedings{BUT76294,
  author="Lukáš {Ďurfina} and Dušan {Kolář}",
  title="Generic detection of register realignment",
  annote="The register realignment is a method of binary obfuscation and it is used by
malware writers. The paper introduces the method how register realignment can be
recognized by analysis based on the scattered context grammars. Such an analysis
includes exploration of bytes affected by realignment, finding new valid values
for them, building the scattered context grammar and parse an obfuscated code by
this grammar. The created grammar has LL property - an ability for parsing by
this type of grammar.",
  address="American Institute of Physics",
  booktitle="AIP Conference Proceedings",
  chapter="76294",
  edition="NEUVEDEN",
  howpublished="print",
  institution="American Institute of Physics",
  number="1",
  year="2011",
  month="september",
  pages="806--809",
  publisher="American Institute of Physics",
  type="conference paper"
}