Rotalumè: A Tool for Automatic Reverse Engineering of Malware Emulators
Author(s)
Advisor(s)
Editor(s)
Collections
Supplementary to:
Permanent Link
Abstract
Malware authors have recently begun using emulation technology to obfuscate their code. They convert native
malware binaries into bytecode programs written in a randomly generated instruction set and paired with a native
binary emulator that interprets the bytecode. No existing malware analysis can reliably reverse this obfuscation
technique. In this paper, we present the first work in automatic reverse engineering of malware emulators. Our
algorithms are based on dynamic analysis. We execute the emulated malware in a protected environment and record
the entire x86 instruction trace generated by the emulator. We then use dynamic data-flow and taint analysis over the
trace to identify data buffers containing the bytecode program and extract the syntactic and semantic information
about the bytecode instruction set. With these analysis outputs, we are able to generate data structures, such
as control-flow graphs, that provide the foundation for subsequent malware analysis. We implemented a proof-of-concept system called Rotalumè and evaluated it using both legitimate programs and malware emulated by
VMProtect and Code Virtualizer. The results show that Rotalumè accurately reveals the syntax and semantics of
emulated instruction sets and reconstructs execution paths of original programs from their bytecode representations.
Sponsor
Date
2009
Extent
Resource Type
Text
Resource Subtype
Technical Report