Institutional Repository
| reconstructing a packed dll binary for static analysis | |
| Wang Xianggen; Feng Dengguo; Su Purui | |
| 2009 | |
| Conference Name | 5th International Conference on Information Security Practice and Experience, ISPEC 2009 |
| Source | Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics) |
| Conference Date | April 13, |
| Conference Place | Xian, China |
| Publish Place | Germany |
| ISSN | 3029743 |
| ISBN | 3642008429 |
| Department | (1) University of Science and Technology of China; (2) State Key Laboratory of Information Security, Institute of Software, Chinese Academy of Sciences |
| English Abstract | DLLs (Dynamic Link Libraries) are usually protected by various anti-reversing engineering techniques. One technique commonly used is code packing as packed DLLs hinder static code analysis such as disassembly. In this paper, we propose a technique to reconstruct a binary file for static analysis by loading a DLL and triggering and monitoring the execution of the entry-point function and exported functions of packed DLLs. By monitoring all memory operations and control transfer instructions, our approach extracts the original hidden code which is written into the memory at run-time and constructs a binary based on the original DLL, the codes extracted and the records of control transfers. To demonstrate its effectiveness, we implemented our prototype ReconPD based on QEMU. The experiments show that ReconPD is able to analyze the packed DLLs, yet practical in terms of performance. Moreover, the reconstructed binary files can be successfully analyzed by static analysis tools, such as IDA Pro. © 2009 Springer Berlin Heidelberg. |
| Keyword | Computer Crime Embedded Systems Security Of Data Security Systems Static Analysis |
| Sponsorship | Xidian University |
| Content Type | 会议论文 |
| URI | http://ir.iscas.ac.cn/handle/311060/8538 |
| Collection | 信息安全国家重点实验室 |
| Recommended Citation GB/T 7714 | Wang Xianggen,Feng Dengguo,Su Purui. reconstructing a packed dll binary for static analysis[C]. Germany,2009. |
| Files in This Item: | There are no files associated with this item. | |||||
Items in the repository are protected by copyright, with all rights reserved, unless otherwise indicated.
Edit Comment