Show simple item record

dc.contributor.authorEagle, Chris
dc.dateOct. 31, 2006
dc.date.accessioned2014-01-27T19:14:38Z
dc.date.available2014-01-27T19:14:38Z
dc.date.issued2006-10-31
dc.identifier.urihttp://hdl.handle.net/10945/38473
dc.description.abstractVirtually every virus and worm that circulates the Internet today is ""protected"" by some form of obfuscation that hides the code's true intent. In the Window's world where worms prevail, the use of tools such as UPX, ASPack, and teLock has become standard. Protection of malicious code is not the only goal of binary obfuscators however which can be used to protect intellectual property. In the Linux world, tools such as Burneye and Shiva exist which can be used in ways similar to any Window's obfuscation tool. To fight such methods, analysts have created specific tools or techniques for unraveling these code obfuscators in order to reveal the software within. To date, in the fight against malware, anti-virus vendors have had the luxury of focusing on signature development since obfuscation of malware has presented little challenge. To combat this, malware authors are rapidly morphing their code in order to evade quickly developed and deployed signature-matching routines. What will happen when malware authors begin to morph their obfuscation techniques as rapidly as they morph their worms? While not designed specifically as a malware protection tool, one program, Shiva, aims to do exactly that. Shiva forces analysis of malicious code to be delayed while analysts fight through each novel mutation of Shiva's obfuscation mechanism. This, in effect, provides the malware a longer period of time to wreak havoc before countermeasures can be developed. This talk will focus on the use of emulated execution within IDA Pro to provide a generic means for rapidly deobfuscating protected code. Capabilities of the emulation engine will be discussed and the removal of several types of obfuscation will be demonstrated. Finally, the development of standalone deobfuscation tools based on the emulation engine will be discussed. Chris Eagle is the Associate Chairman of the Computer Science Department at the Naval Postgraduate School (NPS) in Monterey, CA. A computer engineer/scientist for 18 years, his research interests include computer network operations, computer forensics and reverse/anti-reverse engineering.en_US
dc.titleChris Eagle: Attacking Obfuscated Code with IDA Pro-(Partial Japanese)en_US
dc.typeRecording, oralen_US
dc.subject.authorBlack Haten_US
dc.subject.authorBlackHaten_US
dc.subject.authorBlackhaten_US
dc.subject.authorBriefingsBlackhaten_US
dc.subject.authorBriefings and Trainingen_US
dc.subject.authorBlackhat Japanen_US
dc.subject.author2004en_US
dc.subject.authorChris Eagleen_US
dc.subject.authorComputersen_US
dc.subject.authorHackingen_US
dc.subject.authorComputers_and_Interneten_US
dc.subject.authorSecurity_and_Encryptionen_US
dc.subject.authorConferencesen_US
dc.subject.authorPodcastingen_US
dc.subject.authorTech Newsen_US
dc.subject.authorTechnologyen_US
dc.subject.authoraudiocomputeren_US
dc.subject.authorcomputer securityen_US
dc.subject.authorconventionen_US
dc.subject.authorhackingen_US
dc.subject.authorinformation securityen_US
dc.subject.authorinfosecen_US
dc.subject.authorpresentationsen_US
dc.subject.authorsecurityen_US
dc.subject.authorspeechesen_US
dc.subject.authorspoken worden_US


Files in this item

Icon

This item appears in the following Collection(s)

Show simple item record