Renovo: a hidden code extractor for packed executables

By M. Kang, Pongsin Poosankam, Heng Yin. 2007

322 citations recorded by the source corpus.

Subfields: Artificial Intelligence, Biomedical Engineering, Signal Processing

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

1. Engin Kirda
2. Christopher Krügel
3. David Brumley
4. Dawn Song
5. Heng Yin
6. Yang Xiang
7. Silvio Cesare
8. D. Adjeroh

In Biomedical Engineering

1. Yang Xiang
2. Silvio Cesare

In Signal Processing

1. Engin Kirda
2. Christopher Krügel
3. David Brumley
4. Heng Yin
5. Dawn Song
6. Yanfang Ye
7. Tao Li
8. D. Adjeroh

Citations in the corpus

• Classification of malware using structured control flow (2010, methodology): “Automated unpacking employing whole system emulation was proposed in Renovo (Kang et al. 2007) and Pandora's Bochs (Boehne 2008).”
• AVATAR: A Framework to Support Dynamic Security Analysis of Embedded Systems' Firmwares (2014, background): “Therefore, it is very important to develop the tools and techniques that would make easier to analyze the security of embedded systems.”
• A survey on automated dynamic malware-analysis techniques and tools (2012, background): “Kang et al. [2007] propose Renovo as a dynamic solution to the packer problem that automatically extracts the hidden code of a packed executable.”
• AppSpear: Bytecode Decrypting and DEX Reassembling for Packed Android Malware (2015, methodology): “Renovo[15] also uses the written-then-execute pattern to perform the unpacking.”
• Opcode sequences as representation of executables for data-mining-based unknown malware detection (2013, methodology): “One solution to solve this obvious limitation of our malware detection method is the use of a generic dynamic unpacking schema such as PolyUnpack [63], Renovo [32], OmniUnpack [47] and Eureka [72].”
• BitBlaze: A New Approach to Computer Security via Binary Analysis (2008, methodology): “We have designed and developed Renovo [25], as a fully dynamic approach for hidden code extraction, capturing an intrinsic characteristic of hidden code execution.”
• A Survey on Malware Detection Using Data Mining Techniques (2017, methodology): “A number of specialized analysis tools [Caballero et al. 2007; Kang et al. 2007; Yin et al. 2007] have been built on top of TEMU.”
• Malware Obfuscation Techniques: A Brief Survey (2010, background): “This means that a thorough dynamic analysis on the dedicated memory region can give hints to understanding the body [18][19].”