CoDisasm

Abstract

Fighting malware involves analyzing large numbers of suspicious binary files. In this context, disassembly is a crucial task in malware analysis and reverse engineering. It involves the recovery of assembly instructions from binary machine code. Correct disassembly of binaries is necessary to produce a higher level representation of the code and thus allow the analysis to develop high-level understanding of its behavior and purpose. Nonetheless, it can be problematic in the case of malicious code, as malware writers often employ techniques to thwart correct disassembly by standard tools.In this paper, we focus on the disassembly of x86 selfmodifying binaries with overlapping instructions. Current state-of-the-art disassemblers fail to interpret these two common forms of obfuscation, causing an incorrect disassembly of large parts of the input. We introduce a novel disassembly method, called concatic disassembly, that combines CONCrete path execution with stATIC disassembly. We have developed a standalone disassembler called CoDisasm that implements this approach. Our approach substantially improves the success of disassembly when confronted with both self-modification and code overlap in analyzed binaries. To our knowledge, no other disassembler thwarts both of these obfuscations methods together.

BareUnpack: Generic Unpacking on the Bare-Metal Operating System

“…We also compare BareUnpack's result with other representative generic unpacking tools: PolyUnpack [3], Renovo [4], OmniUnpack [5], CoDisasm [17] and PINdemonium [18]. All of them are relying on some simulated environments.…”

“…PolyUnpack [3], Renovo [4], OmniUnpack [5] CoDisasm [17] and PINdemonium [18] are the most notably generic unpacking approaches. Table 6 illustrates the various simulated environments applied by these approaches.…”

“…CoDisasm [17] developed Pin tracer to collects an execution trace of a stripped binary, which is based on Pin tool [19] and recovers each unpacking layer by taking a memory snapshot at the beginning of the layer. Similarly, PinDemonium [18] also relies on the Pin tool to "identify written and then executed memory regions".…”