SPiKE: engineering malware analysis tools using unobtrusive binary-instrumentation

摘要: Malware -- a generic term that encompasses viruses, trojans, spywares and other intrusive code is widespread today. analysis multi-step process providing insight into malware structure functionality, facilitating the development of an antidote. Behavior monitoring, important step in process, used to observe interaction with respect system achieved by employing dynamic coarse-grained binary-instrumentation on target system. However, current research involving binary-instrumentation, categorized probe-based just-in-time compilation (JIT), fail context malware. Probe-based schemes are not transparent. Most if all sensitive modification incorporating methods prevent their even instrument themselves for functionality stealthness. Current JIT schemes, though transparent, do support multithreading, self-modifying and/or self-checking (SM-SC) unable capture running kernel-mode. Also, they overkill terms latency instrumentation.To address this problem, we have developed new framework codenamed SPiKE, aids construction powerful tools combat becoming increasingly hard analyze. Our goal provide unobtrusive, portable, efficient, easy-to-use reusable, supporting multithreading SM-SC code, both user- In paper, discuss concept unobtrusive present design, implementation evaluation SPiKE. We also illustrate utility describing our experience tool SPiKE analyze real world