Static disassembly of obfuscated binaries

摘要: Disassembly is the process of recovering a symbolic representation program's machine code instructions from its binary representation. Recently, number techniques have been proposed that attempt to foil disassembly process. These are very effective against state-of-the-art disassemblers, preventing substantial fraction program being disassembled correctly. This could allow an attacker hide malicious static analysis tools depend on correct disassembler output (such as virus scanners). The paper presents novel substantially improve success when confronted with obfuscated binaries. Based control flow graph information and statistical methods, large can be correctly identified. An evaluation accuracy performance our tool provided, along comparison several disassemblers.