| 2/2019 - 3 |
Automatic Detection and Bypassing of Anti-Debugging Techniques for Microsoft Windows EnvironmentsPARK, J.   , JANG, Y.-H. , HONG, S. , PARK, Y. |
Extra paper information in    |
| Click to see author's profile in SCOPUS, IEEE Xplore, Web of Science |
Download PDF  (1,313 KB) | Citation | Downloads: 2,967 | Views: 3,428 |
Author keywords
computer hacking, computer security, debugging, reverse engineering, software protection
References keywords
anti(10), link(9), software(7), malware(7), debugging(7), security(6), binary(5), analysis(5), ollydbg(4), code(4)
Blue keywords are present in both the references section and the paper title.
About this article
Date of Publication: 2019-05-31
Volume 19, Issue 2, Year 2019, On page(s): 23 - 28
ISSN: 1582-7445, e-ISSN: 1844-7600
Digital Object Identifier: 10.4316/AECE.2019.02003
Web of Science Accession Number: 000475806300003
SCOPUS ID: 85066320679
Abstract
In spite of recent remarkable advances in binary code analysis, adversaries are still using diverse anti-reversing techniques for obfuscating code and making analysis difficult. Unlike most of the previous work that relies on debugger-plugins for neutralizing anti-debugging techniques, we focus on the Pin, which is one of the most widely used DBI (Dynamic Binary Instrumentation) tools in 80x86 environments. In this paper, we present an automatic anti-debugging detection/bypassing scheme using the Pin. In order to evaluate the effectiveness of our algorithm, we conducted experiments on 17 most widely used (commercial) protectors, which results in bypassing all anti-debugging techniques automatically. Particularly, our experiment includes Safengine, which is one of the most complex commercial protectors and, to the best of our knowledge, it has not been successfully analyzed by academic researchers up to now. Also, experimental results show that the proposed scheme performs better than the most recent work, Apate. |
| References | | | Cited By |
Web of Science® Times Cited: 9 [View]
View record in Web of Science® [View]
View Related Records® [View]
Updated today
SCOPUS® Times Cited: 9
View record in SCOPUS® [Free preview]
View citations in SCOPUS® [Free preview]
Updated today
[1] Bypassing Heaven’s Gate Technique Using Black-Box Testing, Hwang, Seon-Jin, Utaliyeva, Assem, Kim, Jae-Seok, Choi, Yoon-Ho, Sensors, ISSN 1424-8220, Issue 23, Volume 23, 2023.
Digital Object Identifier: 10.3390/s23239417 [CrossRef]
[2] Detection Techniques for DBI Environment in Windows, Park, Seongwoo, Park, Yongsu, Electronics, ISSN 2079-9292, Issue 5, Volume 13, 2024.
Digital Object Identifier: 10.3390/electronics13050871 [CrossRef]
[3] A practical approach for finding anti-debugging routines in the Arm-Linux using hardware tracing, Park, Yeongung, Choi, Seokwoo, Choi, Un Yeong, Jin, Haimin, Nor, Nurul Harzira Mohamad, Park, Yongsu, Scientific Reports, ISSN 2045-2322, Issue 1, Volume 14, 2024.
Digital Object Identifier: 10.1038/s41598-024-65374-w [CrossRef]
[4] Bypassing Anti-Analysis of Commercial Protector Methods Using DBI Tools, Lee, Young Bi, Suk, Jae Hyuk, Lee, Dong Hoon, IEEE Access, ISSN 2169-3536, Issue , 2021.
Digital Object Identifier: 10.1109/ACCESS.2020.3048848 [CrossRef]
[5] Pinicorn: Towards Automated Dynamic Analysis for Unpacking 32-Bit PE Malware, Lee, Gwangyeol, Kim, Minho, Yi, Jeong Hyun, Cho, Haehyun, Electronics, ISSN 2079-9292, Issue 11, Volume 13, 2024.
Digital Object Identifier: 10.3390/electronics13112081 [CrossRef]
[6] DBI, debuggers, VM: gotta catch them all, Plumerault, François, David, Baptiste, Journal of Computer Virology and Hacking Techniques, ISSN 2263-8733, Issue 2, Volume 17, 2021.
Digital Object Identifier: 10.1007/s11416-020-00371-x [CrossRef]
[7] Malware Detection with Artificial Intelligence: A Systematic Literature Review, Gaber, Matthew G., Ahmed, Mohiuddin, Janicke, Helge, ACM Computing Surveys, ISSN 0360-0300, Issue 6, Volume 56, 2024.
Digital Object Identifier: 10.1145/3638552 [CrossRef]
[8] Large-Scale Analysis on Anti-Analysis Techniques in Real-World Malware, Kim, Minho, Cho, Haehyun, Yi, Jeong Hyun, IEEE Access, ISSN 2169-3536, Issue , 2022.
Digital Object Identifier: 10.1109/ACCESS.2022.3190978 [CrossRef]
Updated today
Disclaimer: All information displayed above was retrieved by using remote connections to respective databases. For the best user experience, we update all data by using background processes, and use caches in order to reduce the load on the servers we retrieve the information from. As we have no control on the availability of the database servers and sometimes the Internet connectivity may be affected, we do not guarantee the information is correct or complete. For the most accurate data, please always consult the database sites directly. Some external links require authentication or an institutional subscription.
Web of Science® is a registered trademark of Clarivate Analytics, Scopus® is a registered trademark of Elsevier B.V., other product names, company names, brand names, trademarks and logos are the property of their respective owners.
Copyright ©2001-2024
Faculty of Electrical Engineering and Computer Science
Stefan cel Mare University of Suceava, Romania
All rights reserved: Advances in Electrical and Computer Engineering is a registered trademark of the Stefan cel Mare University of Suceava. No part of this publication may be reproduced, stored in a retrieval system, photocopied, recorded or archived, without the written permission from the Editor. When authors submit their papers for publication, they agree that the copyright for their article be transferred to the Faculty of Electrical Engineering and Computer Science, Stefan cel Mare University of Suceava, Romania, if and only if the articles are accepted for publication. The copyright covers the exclusive rights to reproduce and distribute the article, including reprints and translations.
Permission for other use: The copyright owner's consent does not extend to copying for general distribution, for promotion, for creating new works, or for resale. Specific written permission must be obtained from the Editor for such copying. Direct linking to files hosted on this website is strictly prohibited.
Disclaimer: Whilst every effort is made by the publishers and editorial board to see that no inaccurate or misleading data, opinions or statements appear in this journal, they wish to make it clear that all information and opinions formulated in the articles, as well as linguistic accuracy, are the sole responsibility of the author.
Faculty of Electrical Engineering and Computer Science
Stefan cel Mare University of Suceava, Romania
All rights reserved: Advances in Electrical and Computer Engineering is a registered trademark of the Stefan cel Mare University of Suceava. No part of this publication may be reproduced, stored in a retrieval system, photocopied, recorded or archived, without the written permission from the Editor. When authors submit their papers for publication, they agree that the copyright for their article be transferred to the Faculty of Electrical Engineering and Computer Science, Stefan cel Mare University of Suceava, Romania, if and only if the articles are accepted for publication. The copyright covers the exclusive rights to reproduce and distribute the article, including reprints and translations.
Permission for other use: The copyright owner's consent does not extend to copying for general distribution, for promotion, for creating new works, or for resale. Specific written permission must be obtained from the Editor for such copying. Direct linking to files hosted on this website is strictly prohibited.
Disclaimer: Whilst every effort is made by the publishers and editorial board to see that no inaccurate or misleading data, opinions or statements appear in this journal, they wish to make it clear that all information and opinions formulated in the articles, as well as linguistic accuracy, are the sole responsibility of the author.
