Towards Transparent Control-Flow Integrity in Safety-Critical Systems

Kuzhiyelil, Don; Zieris, Philipp; Kadar, Marine; Tverdyshev, Sergey; Fohler, Gerhard

doi:10.1007/978-3-030-62974-8_17

Cited by 4 publications

(1 citation statement)

References 38 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Diverse research efforts have been made to analyze crashes and bugs [15][16][17][18][19][20] . For control flow integrity, some approaches [21][22][23] rely on Arm Coresight ETM whereas the others [24][25][26] are based on Intel's processor trace (PT). In this section, we focus on related work using hardware tracing for security, mainly for Arm-Linux systems.…”

Section: Related Workmentioning

confidence: 99%

A practical approach for finding anti-debugging routines in the Arm-Linux using hardware tracing

Park,

Choi,

Choi

et al. 2024

Sci Rep

View full text Add to dashboard Cite

As IoT devices are being widely used, malicious code is increasingly appearing in Linux environments. Sophisticated Linux malware employs various evasive techniques to deter analysis. The embedded trace microcell (ETM) supported by modern Arm CPUs is a suitable hardware tracer for analyzing evasive malware because it is almost artifact-free and has negligible overhead. In this paper, we present an efficient method to automatically find debugger-detection routines using the ETM hardware tracer. The proposed scheme reconstructs the execution flow of the compiled binary code from ETM trace data. In addition, it automatically identifies and patches the debugger-detection routine by comparing two traces (with and without the debugger). The proposed method was implemented using the Ghidra plug-in program, which is one of the most widely used disassemblers. To verify its effectiveness, 15 debugger-detection techniques were investigated in the Arm-Linux environment to determine whether they could be detected. We also confirmed that our implementation works successfully for the popular malicious Mirai malware in Linux. Experiments were further conducted on 423 malware samples collected from the Internet, demonstrating that our implementation works well for real malware samples.

show abstract