Codescanner: Detecting (Hidden) x86/x64 code in arbitrary files | IEEE Conference Publication | IEEE Xplore

Codescanner: Detecting (Hidden) x86/x64 code in arbitrary files


Abstract:

Disassembly is indispensable for the proper analysis of malware. However, a common problem concerning the x86/x64 architecture is that disassemblers produce partially inc...Show More

Abstract:

Disassembly is indispensable for the proper analysis of malware. However, a common problem concerning the x86/x64 architecture is that disassemblers produce partially incorrect results. This is used by malware authors who nowadays routinely generate binaries with anti-disassembly measures. In this paper, we derive general constraints on x86 code which are not based on disassembly but on byte level. Based on these constraints we develop a set of classifiers able to locate code in any kind of files. Operating on byte level, our approach is independent of assembly semantics. Our evaluation shows that we are able to precisely locate code and provide anti-disassembly resistance independent of the operating system or compiler. Our tool can be used to detect the code sections of malware, improve code coverage for disassemblers, detect hidden code in files and in memory, or identify malware with anti-disassembly techniques.
Date of Conference: 28-30 October 2014
Date Added to IEEE Xplore: 15 January 2015
ISBN Information:
Conference Location: Fajardo, PR, USA

Contact IEEE to Subscribe

References

References is not available for this document.