loading...
 This Article 
   
 Share 
   
 Bibliographic References 
   
 Add to: 
 
Digg
Furl
Spurl
Blink
Simpy
Google
Del.icio.us
Y!MyWeb
 
 Search 
   
Seventh IEEE/ACIS International Conference on Computer and Information Science (icis 2008)
Static Analysis of the Disassembly against Malicious Code Obfuscated with Conditional Jumps
May 14-May 16
ISBN: 978-0-7695-3131-1
With the application of information technology and network, malicious codes have become a main threat to the computer security. In order to avoid being analyzed statically, malicious codes resort to various obfuscation techniques to hide themselves. Conditional jumps obfuscation is just such a kind of technique. In this paper, we introduce four forms of conditional jumps obfuscation which could confuse both of the two commonly used disassembly algorithms. Their basic idea is that two elaborate constructed conditional jump instructions are semantically equivalent to one unconditional jump. We propose a modified algorithm to crack the obfuscation. And we implement our idea in our reverse analysis tool Radux (Reverse Analysis for Detecting Unsafe eXecutables). Last we compare the disassembly output of Radux with objdump and IDApro. Relevant tests show that our implementation is effective.
Index Terms:
conditional jump, obfuscation, malicious codes, disassembly
Citation:
Chao Dai, Jianmin Pang, Rongcai Zhao, Xiaojun Ma, "Static Analysis of the Disassembly against Malicious Code Obfuscated with Conditional Jumps," icis, pp.525-530, Seventh IEEE/ACIS International Conference on Computer and Information Science (icis 2008), 2008
Usage of this product signifies your acceptance of the Terms of Use.