Conference Proceeding Article
Trigger-based code (malicious in many cases, but not necessarily) only executes when specific inputs are received. Symbolic execution has been one of the most powerful techniques in discovering such malicious code and analyzing the trigger condition. We propose a novel automatic malware obfuscation technique to make analysis based on symbolic execution difficult. Unlike previously proposed techniques, the obfuscated code from our tool does not use any cryptographic operations and makes use of only linear operations which symbolic execution is believed to be good in analyzing. The obfuscated code incorporates unsolved conjectures and adds a simple loop to the original code, making it less than one hundred bytes longer and hard to be differentiated from normal programs. Evaluation shows that applying symbolic execution to the obfuscated code is inefficient in finding the trigger condition. We discuss strengths and weaknesses of the proposed technique.
Software obfuscation, symbolic execution, malware analysis
Information Security and Trust
Computer Security - ESORICS 2011: 16th European Symposium on Research in Computer Security, Leuven, Belgium, September 12-14: Proceedings
City or Country
WANG, Zhi; Ming, Jiang; Jia, Chunfu; and GAO, Debin.
Linear Obfuscation to Combat Symbolic Execution. (2011). Computer Security - ESORICS 2011: 16th European Symposium on Research in Computer Security, Leuven, Belgium, September 12-14: Proceedings. 6879, 210-226. Research Collection School Of Information Systems.
Available at: http://ink.library.smu.edu.sg/sis_research/2005
Creative Commons License
This work is licensed under a Creative Commons Attribution-Noncommercial-No Derivative Works 4.0 License.