Publication Type
Conference Proceeding Article
Version
acceptedVersion
Publication Date
4-2022
Abstract
—Code virtualization is a well-known sophisticated obfuscation technique that uses custom virtual machines (VM) to emulate the semantics of original native instructions. Commercial VM-based obfuscators (e.g., Themida and VMProtect) are often abused by malware developers to conceal malicious behaviors. Since the internal mechanism of commercial obfuscators is a black box, it is a daunting challenge for the analyst to understand the behavior of virtualized programs. To figure out the code virtualization mechanism and design deobfuscation techniques, the analyst has to perform reverse-engineering on large-scale highly obfuscated programs. This knowledge learning process suffers from painful cost and imprecision. In this project, we study how to automatically extract knowledge from the commercial VM-based obfuscator via a novel chosen-instruction attack (CIA) technique. Our idea is inspired by chosen-plaintext attack, which is a cryptanalysis attack model to gain information that reduces the security of the encryption scheme. Given a commercial VM-based obfuscator, we carefully construct input programs, proactively interact with the obfuscator, and extract knowledge from virtualized output programs. We propose using the anchor instruction and the guided simplification technique to efficiently locate and extract knowledge-related instructions from output programs, respectively. Our experimental results demonstrate that the modern commercial VM-based obfuscators are under the threat of CIA. We have discovered 760 anchor instructions and extracted 1,915 verified instruction mapping rules from the four most widely used commercial obfuscators. The extracted knowledge enables security analysts to understand virtualized malware and improve deobfuscation techniques. Besides, we also contributed the first fine-grained benchmark suite for systematically evaluating the deobfuscation techniques. The evaluation result shows that three state-of-the-art deobfuscation techniques are insufficient to defeat modern commercial VM-based obfuscators and can be improved by our extracted knowledge.
Discipline
Information Security | OS and Networks
Research Areas
Information Systems and Management
Publication
Proceedings of the 2022 Network and Distributed System Security Symposium, San Diego, California, April 24-28
First Page
1
Last Page
17
Publisher
Internet Society
City or Country
San Diego, California
Citation
LI, Shijia; JIA, Chunfu; QIU, Pengda; CHEN, Qiyuan; MING, Jiang; and GAO, Debin.
Chosen-instruction attack against commercial code virtualization obfuscators. (2022). Proceedings of the 2022 Network and Distributed System Security Symposium, San Diego, California, April 24-28. 1-17.
Available at: https://ink.library.smu.edu.sg/sis_research/7354
Creative Commons License
This work is licensed under a Creative Commons Attribution-NonCommercial-No Derivative Works 4.0 International License.
Additional URL
https://www.ndss-symposium.org/ndss-paper/auto-draft-210/
