EtherAnnotate: a transparent malware analysis tool for integrating dynamic and static examination

摘要: Software security researchers commonly reverse engineer and analyze current malicious software (malware) to determine what the latest techniques attackers are utilizing how protect computer systems from attack. The most common analysis methods involve examining program behaves during execution interpreting its machine-level instructions. However, modern applications use advanced anti-debugger, anti-virtualization, code packing obfuscate malware’s true activities divert analysts. Malware analysts currently do not have a simple method for tracing activity at instruction-level in highly undetectable environment. There also lacks combining actual run-time register memory values with statically disassembled code. Combining found registers being accessed would create new level of possible by key aspects static dynamic analysis. This thesis presents EtherAnnotate, extension Xen Ether virtualization framework IDA Pro disassembler aid task consists two separate components an enhanced instruction tracer graphical annotation visualization plug-in Pro. specialized places malware binary into virtualized environment records contents all processor general that occur execution. interprets output adds line comments addition visualizing coverage instructions were executed These tools can be combined provide introspection was available previous state-of-the-art tools.