Static Disassembly of Obfuscated Binaries

By Christopher Krügel, William K. Robertson, Fredrik Valeur, Giovanni Vigna. USENIX Security Symposium, 2004

358 citations recorded by the source corpus.

View Paper: https://www.semanticscholar.org/paper/d295c2b25d8c0526884802fe39a72137303df3a0

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

Citations in the corpus

Smashing the Gadgets: Hindering Return-Oriented Programming Using In-place Code Randomization (2012, methodology): “…x86 binaries is not possible, state-of-the-art disassemblers achieve decent coverage for code generated by the most commonly used compilers, using a combination of different disassembly algorithms [40], the identification of specific code constructs [45], and simple data flow analysis [46].”
PolyUnpack: Automating the Hidden-Code Extraction of Unpack-Executing Malware (2006, methodology): “Although recent approaches have been proposed to significantly enhance the accuracy of disassembling x86 binaries [11], incorrect disassembly of even one instruction could cause EXTRACTUNPACKEDCODE to falsely report the existence of unpack-execute behavior.”
Firmalice - Automatic Detection of Authentication Bypass Vulnerabilities in Binary Firmware (2015, background): “Disassembling binary code without this knowledge has been well explored by existing work [19].”
DUET: integration of dynamic and static analyses for malware clustering with cluster ensembles (2013, methodology): “…used to create syntactically distinct but semantically similar variants, bypassing DUET ’s similarity comparison, Although the current DUET prototype does not handle these types of obfuscation for simplicity, advanced de-obfuscation and normalization [22, 30] can be used to mitigate the problems.”
ROPecker: A Generic and Practical Approach For Defending Against ROP Attacks (2014, methodology): “, IDA Pro or the tool in [22]) to verify the alignment information.”
discovRE: Efficient Cross-Architecture Identification of Bugs in Binary Code (2016, methodology): “Hence, we start by describing the data set that was used to derive robust features and several key parameters.”
Semantics-aware malware detection (2005, unknown): “[20] present techniques for disassembling obfuscated executables.”
Classification of malware using structured control flow (2010, methodology): “To initiate the static analysis process, the memory image of the binary is disassembled using speculative disassembly (Kruegel et al. 2004).”
Towards automatic generation of vulnerability-based signatures (2006, unknown): “[34].”
BitBlaze: A New Approach to Computer Security via Binary Analysis (2008, background): “[26] that can disassemble x86 obfuscated code, and our own linear-sweep disassembler built on top of GNU libopcodes.”
SOK: (State of) The Art of War: Offensive Techniques in Binary Analysis (2016, background): “5) No two functions overlap (in other words, they cannot share basic blocks [34].”
Towards an understanding of anti-virtualization and anti-debugging behavior in modern malware (2008, background): “Compared to static malware analysis [22], dynamic analysis of malware programs gives rich information about runtime behaviors.”
Renovo: a hidden code extractor for packed executables (2007, background): “In response, Kruegel et al. [21] presented a defense against these techniques.”