The Experts below are selected from a list of 15804 Experts worldwide ranked by ideXlab platform
Saumya K. Debray - One of the best experts on this subject based on the ideXlab platform.
-
IEEE Symposium on Security and Privacy - A Generic Approach to Automatic Deobfuscation of Executable Code
2015 IEEE Symposium on Security and Privacy, 2015Co-Authors: Babak Yadegari, Brian Johannesmeyer, Ben Whitely, Saumya K. DebrayAbstract:Malicious software are usually obfuscated to avoid detection and resist analysis. When new malware is encountered, such obfuscations have to be penetrated or removed ("deobfuscated") in order to understand the internal logic of the Code and devise countermeasures. This paper discusses a generic approach for deobfuscation of obfuscated Executable Code. Our approach does not make any assumptions about the nature of the obfuscations used, but instead uses semantics-preserving program transformations to simplify away obfuscation Code. We have applied a prototype implementation of our ideas to a variety of different kinds of obfuscation, including emulation-based obfuscation, emulation-based obfuscation with runtime Code unpacking, and return-oriented programming. Our experimental results are encouraging and suggest that this approach can be effective in extracting the internal logic from Code obfuscated using a variety of obfuscation techniques, including tools such as Themida that previous approaches could not handle.
-
a generic approach to automatic deobfuscation of Executable Code
IEEE Symposium on Security and Privacy, 2015Co-Authors: Babak Yadegari, Brian Johannesmeyer, Ben Whitely, Saumya K. DebrayAbstract:Malicious software are usually obfuscated to avoid detection and resist analysis. When new malware is encountered, such obfuscations have to be penetrated or removed ("deobfuscated") in order to understand the internal logic of the Code and devise countermeasures. This paper discusses a generic approach for deobfuscation of obfuscated Executable Code. Our approach does not make any assumptions about the nature of the obfuscations used, but instead uses semantics-preserving program transformations to simplify away obfuscation Code. We have applied a prototype implementation of our ideas to a variety of different kinds of obfuscation, including emulation-based obfuscation, emulation-based obfuscation with runtime Code unpacking, and return-oriented programming. Our experimental results are encouraging and suggest that this approach can be effective in extracting the internal logic from Code obfuscated using a variety of obfuscation techniques, including tools such as Themida that previous approaches could not handle.
-
Load redundancy elimination on Executable Code
Concurrency and Computation: Practice and Experience, 2003Co-Authors: Manel Fernandez, Roger Espasa, Saumya K. DebrayAbstract:Optimizations performed at link time or directly applied to final program Executables have received increased attention in recent years. This paper discusses the discovery and elimination of redundant load operations in the context of a link-time optimizer, an optimization that we call Load Redundancy Elimination (LRE). Our experiments show that between 50% and 75% of a program's memory references can be considered redundant because they are accessing memory locations that have been referenced less than 200–400 instructions away. We then present three profile-based LRE algorithms targeted at optimizing away these redundancies. Our results show that between 5% and 30% of the redundancy detected can indeed be eliminated, which translates into program speedups of around 8%. We also test our algorithm assuming different cache latencies, and show that, if latencies continue to grow, the load redundancy elimination will become more important. Copyright © 2003 John Wiley & Sons, Ltd.
-
ACM Conference on Computer and Communications Security - Obfuscation of Executable Code to improve resistance to static disassembly
Proceedings of the 10th ACM conference on Computer and communication security - CCS '03, 2003Co-Authors: Cullen Linn, Saumya K. DebrayAbstract:A great deal of software is distributed in the form of Executable Code. The ability to reverse engineer such Executables can create opportunities for theft of intellectual property via software piracy, as well as security breaches by allowing attackers to discover vulnerabilities in an application. The process of reverse engineering an Executable program typically begins with disassembly, which translates machine Code to assembly Code. This is then followed by various decompilation steps that aim to recover higher-level abstractions from the assembly Code. Most of the work to date on Code obfuscation has focused on disrupting or confusing the decompilation phase. This paper, by contrast, focuses on the initial disassembly phase. Our goal is to disrupt the static disassembly process so as to make programs harder to disassemble correctly. We describe two widely used static disassembly algorithms, and discuss techniques to thwart each of them. Experimental results indicate that significant portions of Executables that have been obfuscated using our techniques are disassembled incorrectly, thereby showing the efficacy of our methods.
-
disassembly of Executable Code revisited
Working Conference on Reverse Engineering, 2002Co-Authors: B Schwarz, Saumya K. Debray, Gregory R AndrewsAbstract:Machine Code disassembly routines form a fundamental component of software systems that statically analyze or modify Executable programs, e.g., reverse engineering systems, static binary translators, and link-time optimizers. The task of disassembly is complicated by indirect jumps and the presence of non-Executable data - jump tables, alignment bytes, etc. - in the instruction stream. Existing disassembly algorithms are not always able to cope successfully with Executable files containing such features, and they fail silently - i.e., produce incorrect disassemblies without any indication that the results they are producing are incorrect. In this paper we examine two commonly-used disassembly algorithms and illustrate their shortcomings. We propose a hybrid approach that performs better than these algorithms in the sense that it is able to detect situations where the disassembly may be incorrect and limit the extent of such disassembly errors. Experimental results indicate that the algorithm is quite effective: the amount of Code flagged as incurring disassembly errors is usually quite small.
Andrzej Stec - One of the best experts on this subject based on the ideXlab platform.
-
sfc graphic editor for cpdev environment
International Conference Automation, 2017Co-Authors: Andrzej StecAbstract:Process of creating a diagram in a new SFC graphical editor of the CPDev environment, as well as translation to ST textual language, compilation into VMASM Executable Code, and simulation in CPSim tool are presented. Basic functionalities of the SFC editor are now similar to those of renowned commercial software.
-
AUTOMATION - SFC Graphic Editor for CPDev Environment
Automation 2017, 2017Co-Authors: Andrzej StecAbstract:Process of creating a diagram in a new SFC graphical editor of the CPDev environment, as well as translation to ST textual language, compilation into VMASM Executable Code, and simulation in CPSim tool are presented. Basic functionalities of the SFC editor are now similar to those of renowned commercial software.
Saumya Debray - One of the best experts on this subject based on the ideXlab platform.
-
Obfuscation of Executable Code to improve resistance to static disassembly
Proceedings of the 10th ACM conference on Computer and communication security - CCS '03, 2003Co-Authors: Cullen Linn, Saumya DebrayAbstract:A great deal of software is distributed in the form of Executable Code. The ability to reverse engineer such Executables can create opportunities for theft of intellectual property via software piracy, as well as security breaches by allowing attackers to discover vulnerabilities in an application. The process of reverse engineering an Executable program typically begins with disassembly, which translates machine Code to assembly Code. This is then followed by various decompilation steps that aim to recover higher-level abstractions from the assembly Code. Most of the work to date on Code obfuscation has focused on disrupting or confusing the decompilation phase. This paper, by contrast, focuses on the initial disassembly phase. Our goal is to disrupt the static disassembly process so as to make programs harder to disassemble correctly. We describe two widely used static disassembly algorithms, and discuss techniques to thwart each of them. Experimental results indicate that significant portions of Executables that have been obfuscated using our techniques are disassembled incorrectly, thereby showing the efficacy of our methods.
Cullen Linn - One of the best experts on this subject based on the ideXlab platform.
-
Obfuscation of Executable Code to improve resistance to static disassembly
Proceedings of the 10th ACM conference on Computer and communication security - CCS '03, 2003Co-Authors: Cullen Linn, Saumya DebrayAbstract:A great deal of software is distributed in the form of Executable Code. The ability to reverse engineer such Executables can create opportunities for theft of intellectual property via software piracy, as well as security breaches by allowing attackers to discover vulnerabilities in an application. The process of reverse engineering an Executable program typically begins with disassembly, which translates machine Code to assembly Code. This is then followed by various decompilation steps that aim to recover higher-level abstractions from the assembly Code. Most of the work to date on Code obfuscation has focused on disrupting or confusing the decompilation phase. This paper, by contrast, focuses on the initial disassembly phase. Our goal is to disrupt the static disassembly process so as to make programs harder to disassemble correctly. We describe two widely used static disassembly algorithms, and discuss techniques to thwart each of them. Experimental results indicate that significant portions of Executables that have been obfuscated using our techniques are disassembled incorrectly, thereby showing the efficacy of our methods.
-
ACM Conference on Computer and Communications Security - Obfuscation of Executable Code to improve resistance to static disassembly
Proceedings of the 10th ACM conference on Computer and communication security - CCS '03, 2003Co-Authors: Cullen Linn, Saumya K. DebrayAbstract:A great deal of software is distributed in the form of Executable Code. The ability to reverse engineer such Executables can create opportunities for theft of intellectual property via software piracy, as well as security breaches by allowing attackers to discover vulnerabilities in an application. The process of reverse engineering an Executable program typically begins with disassembly, which translates machine Code to assembly Code. This is then followed by various decompilation steps that aim to recover higher-level abstractions from the assembly Code. Most of the work to date on Code obfuscation has focused on disrupting or confusing the decompilation phase. This paper, by contrast, focuses on the initial disassembly phase. Our goal is to disrupt the static disassembly process so as to make programs harder to disassemble correctly. We describe two widely used static disassembly algorithms, and discuss techniques to thwart each of them. Experimental results indicate that significant portions of Executables that have been obfuscated using our techniques are disassembled incorrectly, thereby showing the efficacy of our methods.
Gregory R Andrews - One of the best experts on this subject based on the ideXlab platform.
-
disassembly of Executable Code revisited
Working Conference on Reverse Engineering, 2002Co-Authors: B Schwarz, Saumya K. Debray, Gregory R AndrewsAbstract:Machine Code disassembly routines form a fundamental component of software systems that statically analyze or modify Executable programs, e.g., reverse engineering systems, static binary translators, and link-time optimizers. The task of disassembly is complicated by indirect jumps and the presence of non-Executable data - jump tables, alignment bytes, etc. - in the instruction stream. Existing disassembly algorithms are not always able to cope successfully with Executable files containing such features, and they fail silently - i.e., produce incorrect disassemblies without any indication that the results they are producing are incorrect. In this paper we examine two commonly-used disassembly algorithms and illustrate their shortcomings. We propose a hybrid approach that performs better than these algorithms in the sense that it is able to detect situations where the disassembly may be incorrect and limit the extent of such disassembly errors. Experimental results indicate that the algorithm is quite effective: the amount of Code flagged as incurring disassembly errors is usually quite small.
-
WCRE - Disassembly of Executable Code revisited
Ninth Working Conference on Reverse Engineering 2002. Proceedings., 1Co-Authors: B Schwarz, Saumya K. Debray, Gregory R AndrewsAbstract:Machine Code disassembly routines form a fundamental component of software systems that statically analyze or modify Executable programs, e.g., reverse engineering systems, static binary translators, and link-time optimizers. The task of disassembly is complicated by indirect jumps and the presence of non-Executable data - jump tables, alignment bytes, etc. - in the instruction stream. Existing disassembly algorithms are not always able to cope successfully with Executable files containing such features, and they fail silently - i.e., produce incorrect disassemblies without any indication that the results they are producing are incorrect. In this paper we examine two commonly-used disassembly algorithms and illustrate their shortcomings. We propose a hybrid approach that performs better than these algorithms in the sense that it is able to detect situations where the disassembly may be incorrect and limit the extent of such disassembly errors. Experimental results indicate that the algorithm is quite effective: the amount of Code flagged as incurring disassembly errors is usually quite small.