Secure and advanced unpacking using computer emulation

摘要: The purpose of this article is firstly to present a secure unpacker which specifically designed for security analyst when studying viruses but also any anti-virus scanner. Such tool in fact required assessing requirements an scanner through black box approach. During testing software, needs build virus populations several penetration tests. Virus unpacking first mandatory step before gaining the ability apply obfuscation transformation or information extraction algorithm on viral set. A useful checking robustness against reverse engineering packed protected product. Several static and dynamic analysis tools already implement algorithms, these often require human intervention are not well automatically unpack such dangerous program as virus. new encrypted presented paper. Forensics techniques reconstruct unpacked executable advanced heuristics order decrypt more sophisticated self-protected Malwares. We detection deceive virtual machine monitors discuss our low-level attacks. Our figures among set tools. then paper proof-of-concept framework implements most standard components (real-time scanner, emulator engine) addition proposes reliable system about its interaction with OS executive (stealth native API hooking), focuses decision process without same resource limitation constraint product oriented scanners. This used basis/reference comparative aspects scanners deals their driver stack efficiency de-obfuscation algorithms.