deRop: Removing Return-Oriented Programming from Malware

Publication Type

Conference Proceeding Article

Publication Date

12-2011

Abstract

Over the last few years, malware analysis has been one of the hottest areas in security research. Many techniques and tools have been developed to assist in automatic analysis of malware. This ranges from basic tools like disassemblers and decompilers, to static and dynamic tools that analyze malware behaviors, to automatic malware clustering and classification techniques, to virtualization technologies to assist malware analysis, to signature- and anomaly-based malware detection, and many others. However, most of these techniques and tools would not work on new attacking techniques, e.g., attacks that use return-oriented programming (ROP). In this paper, we look into the possibility of enabling existing defense technologies designed for normal malware to cope with malware using return-oriented programming. We discuss difficulties in removing ROP from malware, and design and implement an automatic converter, called deRop, that converts an ROP exploit into shell code that is semantically equivalent with the original ROP exploit but does not use ROP, which could then be analyzed by existing malware defense technologies. We apply deRop on four real ROP malwares and demonstrate success in using deRop for the automatic conversion. We further discuss applicability and limitations of deRop.

Keywords

return-oriented programming, malware analysis

Discipline

Information Security

Research Areas

Information Security and Trust

Publication

27th Annual Computer Security Applications Conference (ACSAC 2011)

ISBN

9781450306720

Identifier

10.1145/2076732.2076784

Publisher

ACM

City or Country

Orlando, FL

Additional URL

http://dx.doi.org/10.1145/2076732.2076784

Link to Full Text

Share

COinS