Abstracting stack to detect obfuscated calls in binaries

摘要: Information about calls to the operating system (or kernel libraries) made by a binary executable may be used determine whether is malicious. Being aware of this approach, malicious programmers hide information making such without using call instruction. For instance, `call addr' instruction replaced two push instructions and return instruction, first pushes address after second addr. The code further obfuscated spreading three splitting each into multiple instructions. This paper presents method statically detect in code. notion abstract stack introduced associate element that element. An graph concise representation all stacks at every point program. graph, created interpretation executables, other related obfuscations