deRop: Removing Return-Oriented Programming from Malware
Conference Proceeding Article
Over the last few years, malware analysis has been one of the hottest areas in security research. Many techniques and tools have been developed to assist in automatic analysis of malware. This ranges from basic tools like disassemblers and decompilers, to static and dynamic tools that analyze malware behaviors, to automatic malware clustering and classification techniques, to virtualization technologies to assist malware analysis, to signature- and anomaly-based malware detection, and many others. However, most of these techniques and tools would not work on new attacking techniques, e.g., attacks that use return-oriented programming (ROP). In this paper, we look into the possibility of enabling existing defense technologies designed for normal malware to cope with malware using return-oriented programming. We discuss difficulties in removing ROP from malware, and design and implement an automatic converter, called deRop, that converts an ROP exploit into shell code that is semantically equivalent with the original ROP exploit but does not use ROP, which could then be analyzed by existing malware defense technologies. We apply deRop on four real ROP malwares and demonstrate success in using deRop for the automatic conversion. We further discuss applicability and limitations of deRop.
return-oriented programming, malware analysis
Information Security and Trust
27th Annual Computer Security Applications Conference (ACSAC 2011)
City or Country
LU, Kangjie; ZOU, Dabi; Weng, Weiping; and GAO, Debin.
deRop: Removing Return-Oriented Programming from Malware. (2011). 27th Annual Computer Security Applications Conference (ACSAC 2011). Research Collection School Of Information Systems.
Available at: http://ink.library.smu.edu.sg/sis_research/1425