VMSpec recovers program semantics from virtual-machine-obfuscated code
Original title: VMSpec: A Decompiler-based Approach against Virtual Machine Obfuscation
A prototype stripped VM obfuscation from nearly all of 147 benchmark programs and six malware domain-generation algorithms.
VMSpec automates construction of virtual-machine processor specifications so existing decompilers can analyze VM-obfuscated code. The prototype was tested on 147 benchmark programs obfuscated with Tigress and Code Virtualizer, plus six domain-generation algorithms from real-world malware. The authors say output is comparable to Ghidra’s decompilation of the original code and that the method can reconstruct programs with infinite, input-dependent paths and recursive calls.
Unconfirmed: The claim of being the first such method is the authors’ and is not independently confirmed here.
- The benchmark covered hash functions, standard algorithms, and randomized functions.
- Obfuscation used different configurations of Tigress and Code Virtualizer.
- Authors say VM obfuscation was completely stripped from nearly all samples.
- They call it the first method to reconstruct complete behavior for those path types.
From the original article
1 min read at arxiv.orgMalicious actors frequently obfuscate their code to hinder investigative reverse engineering efforts. Among the most formidable techniques is virtual machine (VM) obfuscation: programs are translated into bytecode for a custom VM, often with a randomized virtual instruction set and distributed alongside a corresponding interpreter.
By Fabian Kilger · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.