full-disclosure - PAPER: Generic Unpacking of Self-modifying, Aggressive, Packed Binary Programs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <C27C7C74DC944F639243FA91F5792010@DIED>
Date: Mon, 25 May 2009 18:18:32 +0200
From: "Piotr Bania" <bania.piotr@...il.com>
To: "FULLDISC" <full-disclosure@...ts.grok.org.uk>
Cc: SBUGTRAQ <bugtraq@...urityfocus.com>
Subject: PAPER: Generic Unpacking of Self-modifying,
	Aggressive, Packed Binary Programs

ABSTRACT

Nowadays most of the malware applications are either packed or protected. 
This techniques are applied especially to evade signature based detectors 
and also to complicate the job of reverse engineers or security analysts. 
The time one must spend on unpacking or decrypting malware layers is often 
very long and in fact remains the most complicated task in the overall 
process of malware analysis. In this report author proposes MmmBop as a 
relatively new concept of using dynamic binary instrumentation techniques 
for unpacking and bypassing detection by self-modifying and highly 
aggressive packed binary code. MmmBop is able to deal with most of the known 
and unknown packing algorithms and it is also suitable to successfully 
bypass most of currently used anti-reversing tricks.  [...]

Paper can be found at:
http://piotrbania.com/all/articles/pbania-dbi-unpacking2009.pdf

best regards,
pb

-- 
--------------------------------------------------------------------
Piotr Bania - <bania.piotr@...il.com> - 0xCD, 0x19
Fingerprint: 413E 51C7 912E 3D4E A62A  BFA4 1FF6 689F BE43 AC33
http://www.piotrbania.com  - Key ID: 0xBE43AC33
--------------------------------------------------------------------

               - "The more I learn about men, the more I love dogs."

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/