Deobfuscation method for deobfuscating obfuscated malicious program, and recording medium and deobfuscation device for performing same

Abstract

The present invention relates to a deobfuscation method in a deobfuscation device for deobfuscating an obfuscated malicious program using an obfuscation technique. The method comprises the steps of: identifying and extracting memory information including a command calling a trampoline code used in the obfuscation technique by executing a malicious program; classifying the type of obfuscation technique of the malicious program by executing the trampoline code on the basis of the memory information; and generating a deobfuscated program by deobfuscating the malicious program according to the classified obfuscation technique. A technique for obfuscating OEP and IAT can be deobfuscated.

Description

A deobfuscation method for deobfuscating an obfuscated malware, a recording medium for performing the method, and a deobfuscation device

[0001] The present invention relates to a de-obfuscation method for de-obfuscating a malicious program obfuscated according to a trampoline code-based obfuscation technique, a recording medium for performing the method, and a de-obfuscation device.

[0002] According to FireEye's 2020 M-Trends report, 31.28% of malware uses obfuscation techniques to evade detection. Obfuscation techniques, such as string encryption and application programming interface (API) obfuscation, make binaries difficult to understand to prevent deobfuscation.

[0003] And because attackers use packers that compress code and data and decompress them when the program runs, it is difficult to detect malicious code using only static analysis tools.

[0004] Accordingly, researchers are working to address the problem of using packing and obfuscation techniques in malware.

[0005] One of the key challenges in unpacking compressed malware is finding the program's original entry point (OEP). Since the unpacker first searches for the OEP to dump the unpacked executable in memory, packers obfuscate the OEP to make it harder to find. Furthermore, packers use trampoline code to defeat OEP detection approaches.

[0006] Typically, unpackers assume that when an OEP is detected, the compressed program is fully decompressed and loaded into memory. However, numerous studies have shown that packed programs perform numerous memory access operations to decompress or load compressed portions to detect OEP.

[0007] Next, the execution of the generated instructions is monitored to detect OEPs. For example, existing approaches can detect OEPs when a program executes runtime-generated instructions within a compressed section.

[0008] However, a recent study found that 9.5% of packed malware samples used OEP obfuscation, a technique used by packers to restore the packer's trampoline code to OEP instead of the original code.

[0009] Trampoline code prevents dumping of the executable file by tricking the control flow in the OEP of the compressed program.

[0010] Figure 1 is a diagram illustrating the control flow of a program obfuscated according to the OEP obfuscation technique.

[0011] As shown in Figure 1, the unpacker, which uses memory addresses or the executed instruction section to find the OEP, cannot successfully dump the original code because of the jump instructions to the trampoline code. Specifically, when executing the compressed program, the OEP first jumps to the trampoline code due to the code inserted by the packer, and then the trampoline code jumps to the program's OEP.

[0012] As a result, when the uncompressed program is executed as shown in Fig. 1, a runtime error occurs because the OEP instruction jumps to an incorrect address, but there is no case where deobfuscation for this OEP obfuscation technique is considered.

[0013] Meanwhile, the importance of reconstructing the import table to decrypt API obfuscation has been recognized. To achieve this, the unpacking routine monitors and restores the virtual memory addresses written to the import table.

[0014] However, there is a packer that records the trampoline code address of the obfuscated API in the import table, so the original import table cannot be restored using the conventional method.

[0015] Figure 2 is an exemplary diagram illustrating the control flow of a program obfuscated using an API obfuscation technique. As shown in Figure 2, a program with an incorrect import table containing an API's virtual memory address cannot execute properly. To address this API obfuscation technique, dynamic analysis tools must be used to understand how the trampoline code operates.

[0016] Accordingly, deobfuscation tools using existing dynamic analysis tools focused on reconstructing the correct import table by deobfuscating the obfuscated IAT (Import Address Table).

[0017] However, despite successfully deobfuscating the obfuscation techniques of various existing protectors, it does not consider the structure in which a single trampoline code can call multiple APIs.

[0018] Therefore, there were cases where deobfuscation failed in the past and the correct import table was not reconstructed, and there was a limitation that the regenerated malware analysis results were inaccurate.

[0019] In addition, API-Xray, a tool that deobfuscates API-obfuscated malware, showed that it can successfully reconstruct the import table and deobfuscate when there is a one-to-one correspondence between the trampoline code and the API. However, it failed to deobfuscate 9.5% of malware that had OEP obfuscation applied repeatedly.

[0020] Therefore, a method to reverse obfuscate the techniques that obfuscate OEP and IAT is needed.

[0021] [Prior Art Literature]

[0022] [Patent Document]

[0023] (Patent Document 1) Korean Patent Publication No. 10-1833220

[0024] The present invention has been devised to solve the above problems, and an object of the present invention is to provide a de-obfuscation method for de-obfuscating an obfuscated malicious program capable of de-obfuscating a technique for obfuscating OEP and IAT, a recording medium for performing the same, and a de-obfuscation device.

[0025] In order to achieve the above object, a deobfuscation method according to one embodiment of the present invention is a deobfuscation method in a deobfuscation device that deobfuscates a malicious program obfuscated using an obfuscation technique, the method comprising: a step of executing the malicious program to identify and extract memory information including a trampoline code used in the obfuscation technique; a step of executing the trampoline code based on the memory information to classify the type of obfuscation technique of the malicious program; and a step of deobfuscating the malicious program according to the classified obfuscation technique to generate a deobfuscation program.

[0026] And the memory information may include at least one of the original code and data restored to memory during execution of the malicious program; process context information, which is context information for the CPU and memory; and a trampoline code address where the trampoline code is located.

[0027] Additionally, the trampoline code address may be the address of a basic block (BB) to which the trampoline code call instruction belongs.

[0028] And in the step of classifying the type of the obfuscation technique, the trampoline code can be executed by configuring an environment identical to the process environment when the obfuscated malware is executed based on the original code and data and process context.

[0029] In addition, the step of classifying the type of the above obfuscation technique may include a step of executing the trampoline code located at the memory address of the original entry point (OEP, Original Entry Point) to obtain the address of the next original code, and storing the address of the original code as the address of the entry point (EP).

[0030] And the step of classifying the type of the above obfuscation technique may include a step of detecting a pattern in which a decrypted API (Application Programming Interface) address is written to a stack memory and a return instruction is executed during execution of the trampoline code, thereby obtaining the address of the API and generating a list of API addresses.

[0031] In addition, in the step of classifying the type of obfuscation technique, it can be classified into at least one of an OEP obfuscation technique that patches a trampoline code call instruction to the OEP memory address and an API obfuscation technique that records the start address of the trampoline code in a memory area referenced by the indirect call instruction.

[0032] And in the step of generating the deobfuscation program, the IAT (Import Address Table) can be reconstructed using the API address list, and the deobfuscation program can be generated using the reconstructed IAT and at least one of the entry point address and command.

[0033] Meanwhile, a recording medium according to one embodiment of the present invention for achieving the above purpose is a computer-readable recording medium having recorded thereon a computer program for performing the deobfuscation method.

[0034] According to one embodiment of the present invention for achieving the above object, a deobfuscation device is provided, which deobfuscates a malicious program obfuscated using an obfuscation technique, and includes a memory information extraction unit that executes the malicious program to identify and extract memory information including a trampoline code used in the obfuscation technique; and a code execution unit that executes the trampoline code based on the memory information to classify the type of obfuscation technique of the malicious program, and deobfuscates the malicious program according to the classified obfuscation technique to generate a deobfuscation program.

[0035] And the memory information may include at least one of the original code and data restored to memory during execution of the malicious program; process context information, which is context information for the CPU and memory; and a trampoline code address where the trampoline code is located.

[0036] Additionally, the trampoline code address may be the address of a basic block (BB) to which the trampoline code call instruction belongs.

[0037] And, the code execution unit can execute the trampoline code by configuring an environment identical to the process environment when the obfuscated malware is executed based on the original code and data and process context.

[0038] In addition, the above code execution unit can obtain the address of the next original code by executing the trampoline code located at the memory address of the original entry point (OEP, Original Entry Point), and store the address of the original code as the address of the entry point (EP).

[0039] And the above code execution unit may include a step of detecting a pattern in which a decrypted API (Application Programming Interface) address is written to a stack memory and a return instruction is executed during execution of the trampoline code, thereby obtaining the address of the API and generating a list of API addresses.

[0040] In addition, the code execution unit can be classified into at least one of an OEP obfuscation technique that patches a trampoline code call instruction to the OEP memory address and an API obfuscation technique that records the start address of the trampoline code in a memory area referenced by the indirect call instruction.

[0041] And the code execution unit can reconstruct an IAT (Import Address Table) using the API address list, and generate the deobfuscation program using the reconstructed IAT and at least one of the entry point address and command.

[0042] According to one aspect of the present invention described above, by providing a de-obfuscation method for de-obfuscating an obfuscated malicious program, a recording medium for performing the same, and a de-obfuscation device, a technique for obfuscating OEP and IAT can be de-obfuscated.

[0043] Figure 1 is a diagram illustrating the control flow of a program obfuscated according to the OEP obfuscation technique.

[0044] Figure 2 is a diagram illustrating an example of the control flow of a program obfuscated according to an API obfuscation technique.

[0045] Figures 3 and 4 are block diagrams for explaining the configuration of a deobfuscation device according to one embodiment of the present invention.

[0046] FIG. 5 is a diagram for explaining the flow of executing trampoline code in a code execution unit according to one embodiment of the present invention.

[0047] FIG. 6 is an exemplary diagram illustrating a process in which a code execution unit according to one embodiment of the present invention acquires an address of a normal execution flow.

[0048] FIG. 7 is an exemplary diagram illustrating a process for obtaining an API address when a code execution unit according to one embodiment of the present invention corresponds to multiple APIs and one trampoline code.

[0049] Figure 8 is a flowchart for explaining a deobfuscation method according to one embodiment of the present invention;

[0050] Figure 9a is a diagram showing the OEP code of the original program,

[0051] Figure 9b is a diagram showing the OEP code of a malicious program obfuscated according to the OEP obfuscation technique.

[0052] Figure 10 is a diagram illustrating the process in which a runtime error occurs in a malicious program obfuscated according to the OEP obfuscation technique.

[0053] FIG. 11 is a diagram showing the results of an experiment verifying the effectiveness of a deobfuscation method according to one embodiment of the present invention.

[0054] Figure 12a is a diagram illustrating the IAT of a malware obfuscated according to the API obfuscation technique.

[0055] Figure 12b is a diagram showing the memory map of a malicious program obfuscated according to the API obfuscation technique.

[0056] Figure 13a is a diagram showing the IAT of the original program, and

[0057] Figure 13b is a diagram illustrating the IAT of a program deobfuscated according to the deobfuscating method of the present invention.

[0058] The following detailed description of the present invention refers to the accompanying drawings, which illustrate specific embodiments in which the present invention may be practiced. These embodiments are described in sufficient detail to enable those skilled in the art to practice the present invention. It should be understood that the various embodiments of the present invention, while different from each other, are not necessarily mutually exclusive. For example, specific shapes, structures, and characteristics described herein may be implemented in other embodiments without departing from the spirit and scope of the present invention. Furthermore, it should be understood that the positions or arrangements of individual components within each disclosed embodiment may be modified without departing from the spirit and scope of the present invention. Accordingly, the following detailed description is not intended to be limiting, and the scope of the present invention is defined only by the appended claims, along with the full scope of equivalents to which such claims are entitled, if properly described. Like reference numerals in the drawings designate the same or similar functionality throughout the several aspects.

[0059] The components according to the present invention are defined by functional distinctions rather than physical distinctions, and can be defined by the functions each component performs. Each component may be implemented as hardware or program code and processing units that perform each function, and the functions of two or more components may be implemented by including them in a single component. Therefore, the names given to the components in the following embodiments are not intended to physically distinguish each component, but rather to suggest the representative functions performed by each component, and it should be noted that the technical spirit of the present invention is not limited by the names of the components.

[0060] Hereinafter, preferred embodiments of the present invention will be described in more detail with reference to the drawings.

[0061] FIG. 3 and FIG. 4 are block diagrams for explaining the configuration of a de-obfuscation device (100) according to one embodiment of the present invention.

[0062] A deobfuscation device (100, hereinafter referred to as device) according to the present embodiment is provided to deobfuscate a malicious program (code) (OM) that has been obfuscated using an obfuscation technique.

[0063] To this end, the device (100) according to the present embodiment may include a memory information extraction unit (110) and a code execution unit (130). In addition, the device (100) may be installed and executed with software (application) for performing a deobfuscation method, and the memory information extraction unit (110) and the code execution unit (130) may be controlled by the software (application) for performing the deobfuscation method.

[0064] At this time, the device (100) may be a separate terminal or a module of a terminal. Furthermore, the memory information extraction unit (110) and the code execution unit (130) may be formed as an integrated module or may be comprised of one or more modules. However, conversely, each component may be comprised of a separate module.

[0065] In addition, the device (100) may be mobile or fixed. This device (100) may be in the form of a server or an engine, and may be called by other terms such as a device, an apparatus, a terminal, a UE (user equipment), an MS (mobile station), a wireless device, a handheld device, etc. In addition, the device (100) may execute or produce various software based on an operating system (OS), that is, a system. Here, the operating system is a system program for enabling software to use the hardware of the device, and may include all mobile computer operating systems such as Android OS, iOS, Windows Mobile OS, Bada OS, Symbian OS, and Blackberry OS, as well as computer operating systems such as Windows series, Linux series, Unix series, MAC, AIX, and HP-UX.

[0066] And the device (100) according to the present embodiment may further include a storage unit (not shown), in which a program for performing a deobfuscation method is recorded. In addition, the storage unit temporarily or permanently stores data processed by the memory information extraction unit (110) and the code execution unit (130), and may include a volatile storage medium or a non-volatile storage medium, but the scope of the present invention is not limited thereto.

[0067] This storage unit (not shown) stores data accumulated while performing the deobfuscation method.

[0068] The memory information extraction unit (110) according to this embodiment can receive an obfuscated malicious program (OM) through an input device or a communication device.

[0069] And the memory information extraction unit (110) is provided to identify and extract memory information by executing an obfuscated malware (OM).

[0070] The memory information extraction unit (110) may use a dynamic analysis tool to identify and extract memory information. Furthermore, the memory information extracted by the memory information extraction unit (110) may include instructions for calling trampoline code (TC) used in obfuscation techniques.

[0071] This memory information extraction unit (110) can extract, as memory information, the execution information on the virtual memory by executing an obfuscated malware (OM) and the trampoline code (TC) call command and context information (CI) used to obfuscate the OEP or API.

[0072] Here, the memory information may include at least one of original code and data, context information (CI), and trampoline code (TC) addresses.

[0073] The original code and data may refer to the original code and data temporarily restored on virtual memory, and may refer to extracted code and data sections loaded and restored into the virtual memory space during the execution of a packed and obfuscated malware (OM).

[0074] Context information (CI) can refer to process context information, which is context information about the CPU and memory.

[0075] The memory information extraction unit (110) can extract context information (CI) by recording information about the context of a process and thread to enable the code execution unit (130) to emulate the process.

[0076] For example, context information (CI) may include information about the Process Environment Block (PEB), which is a process environment block, information about the Thread Environment Block (TEB), which is a thread environment block, data stored in the CPU register, the stack, and the stack location of each thread.

[0077] Specifically, CPU registers may include general registers such as RAX, RBX, RCX, and RDX; pointer registers such as RBP, RSP, and RIP; index registers such as RSI and RDI; and flag registers such as RFLAGS.

[0078] And the memory information extraction unit (110) dumps the virtual memory of the program to be unpacked in a running state (i.e., process) to record the name, address, and permission of the program section, and can check whether the name and permission of each section are changed while executing the target program.

[0079] Through this, context information (CI) can include PEB information, TEB information, program header, section, heap, and stack.

[0080] And the memory information extraction unit (110) can detect obfuscated APIs by parsing and recording the API name and address of each DLL (Dynamic Link Library) and rewrite the import table so that DLL information is included in the context information (CI).

[0081] And the memory information extraction unit (110) can extract the trampoline code address where the trampoline code (TC) is located as memory information.

[0082] These trampoline code addresses may be the addresses of the basic blocks (BB, Basic Block) to which the trampoline code call instruction belongs.

[0083] Specifically, the memory information extraction unit (110) can identify the point in time when the protector's bootstrap code completes restoration of the original code and data by analyzing the obfuscated malware (OM) through a dynamic analysis tool.

[0084] Furthermore, during the execution of trampoline code (TC), the process's code and data, as well as sections of DLLs loaded into virtual memory, can be extracted to run in an environment similar to the dumped process. Furthermore, the extracted sections of the original program contain trampoline code (TC) inserted by the protector for obfuscation purposes.

[0085] Therefore, since trampoline code (TC) branches from the original code to the protector's bootstrap code or code in the heap memory through a call instruction, the starting address of the trampoline code can be found by examining the branch address.

[0086] Therefore, the memory information extraction unit (110) can be used to identify obfuscated information by executing all call commands of the trampoline code (TC) collected through this method.

[0087] At this time, the memory information extraction unit (110) can distinguish between cases where the execution result of the trampoline code (TC) is affected and cases where it is not affected, depending on the command executed immediately before the trampoline code call command.

[0088] Instructions that affect the execution result have the characteristic of belonging to the same basic block as the trampoline code call instruction. In order to obtain the correct trampoline code execution result, it is necessary to execute all instructions of the basic block to which the trampoline code call instruction belongs, not just the trampoline code call instruction. This can identify the information protected by the trampoline code.

[0089] Conversely, instructions that do not affect the execution result can be identified by obfuscating protected information by executing only the trampoline code invocation instruction. Existing API deobfuscation tools only identify obfuscated information for instructions executed prior to trampoline code execution that do not affect the trampoline code (TC) execution result, thereby reconstructing the deobfuscated program.

[0090] However, the memory information extraction unit (110) according to the present embodiment extracts the address of the basic block to which the trampoline code call instruction belongs as the address of the trampoline code, unlike other conventional tools, in order to perform deobfuscation for both cases where trampoline code execution is affected and not affected.

[0091] And the memory information extraction unit (110) can transmit the extracted memory information to the code execution unit (130).

[0092] The code execution unit (130) can classify the type of obfuscation technique of a malicious program (OM) by executing a trampoline code (TC) based on memory information, and deobfuscate the malicious program (OM) according to the classified obfuscation technique to generate a deobfuscation program (DM).

[0093] And the code execution unit (130) may include an emulator (131) to execute the trampoline code (TC) or may mean the emulator (131) itself.

[0094] The code execution unit (130) can use original code and data, and process context to configure an environment identical to the process environment when an obfuscated malware (OM) is executed when executing trampoline code (TC) in an emulator (131).

[0095] FIG. 5 is a diagram for explaining the flow of executing trampoline code (TC) in a code execution unit (130) according to one embodiment of the present invention.

[0096] As illustrated in Fig. 5, the code execution unit (130) configures an emulator (131) environment based on context information (CI) including pre-extracted original code and data and process context.

[0097] And the code execution unit (130) can also add DLL information included in the context information (CI) to the environment to make it identical to the process environment when the obfuscated malware (OM) is executed.

[0098] After performing this initialization process, the code execution unit (130) can set the trampoline code address included in the memory information to the entry point (EP) address of the emulator (131) and execute the trampoline code (TC).

[0099] Additionally, the code execution unit (130) can observe whether a return (ret) instruction is executed during the process of repeatedly executing the trampoline code (TC), and can check the stack memory value pointed to by the ESP register by the ret instruction.

[0100] The code execution unit (130) can search for obfuscated information by executing trampoline code (TC) until the stack memory value is a meaningful memory address.

[0101] A meaningful memory address here could mean the API address of a DLL loaded into virtual memory, or the address of a code area that executes after a branch in the unobfuscated original code.

[0102] And the code execution unit (130) can classify the type of obfuscation technique of the malicious program (OM) into at least one of the OEP obfuscation technique and the API obfuscation technique through the execution result of the trampoline code (TC).

[0103] OEP obfuscation technique can refer to a technique that patches the trampoline code call instruction to the OEP (Original Entry Point) memory address, which is the original entry point.

[0104] API obfuscation techniques can be techniques that record the starting address of trampoline code (TC) in the memory area referenced by the code patch or indirect call instruction.

[0105]

[0106] FIG. 6 is an exemplary diagram illustrating a process in which a code execution unit (130) according to one embodiment of the present invention acquires an address of a normal execution flow.

[0107] Specifically, the OEP obfuscation technique applies obfuscation in the form of code patches, storing trampoline code call instructions at OEP memory addresses. This causes the obfuscated malware (OM) to call the trampoline code (TC) immediately upon entering the original entry point. The trampoline code (TC) stores the address to which the original entry point instruction branches before obfuscation in stack memory, and executes the return instruction to execute the original code after the original entry point.

[0108] Accordingly, the code execution unit (130) can execute the trampoline code (TC) located at the memory address of the original entry point (OEP, Original Entry Point) to obtain the address of the next original code, and store the address of the original code as the address (OEPI) of the entry point (EP, Entry Point). The entry point address (OEPI) stored in this way can be utilized as a function of the deobfuscation tool.

[0109] FIG. 7 is an exemplary diagram illustrating a process for obtaining an API address when a code execution unit (130) according to one embodiment of the present invention corresponds to multiple APIs and one trampoline code.

[0110] Trampoline Code (TC) is similar to the OEP obfuscation technique in that it stores the address of the API being called in the stack memory before obfuscation and executes the return instruction to execute the actual API.

[0111] Accordingly, the code execution unit (130) can detect a pattern in which a decrypted API (Application Programming Interface) address is written to the stack memory and a return instruction is executed during execution of the trampoline code (TC) by executing a direct or indirect trampoline code call instruction, thereby obtaining the address of the API and generating an API address list (APIL).

[0112] And the code execution unit (130) can reconstruct the Import Address Table (IAT) using the API address list (APIL), and generate a deobfuscation program (DM) using at least one of the entry point address (OEPI) and the command and the reconstructed IAT.

[0113] Therefore, the device (100) according to the present embodiment can be utilized to generate a de-obfuscated binary for a malicious program to which an obfuscation technique based on trampoline code insertion is applied.

[0114]

[0115] FIG. 8 is a flowchart for explaining a deobfuscation method according to one embodiment of the present invention. Since the deobfuscation method according to one embodiment of the present invention is performed on a configuration substantially identical to that of the deobfuscation device (100) illustrated in FIGS. 3 and 4, the same components as those of the deobfuscation device (100) illustrated in FIGS. 3 and 4 are given the same drawing reference numerals, and repeated descriptions are omitted.

[0116] The deobfuscation method according to the present embodiment includes a step of identifying and extracting memory information (S110), a step of classifying the type of obfuscation technique of a malicious program (S130), and a step of generating a deobfuscation program (S150).

[0117] In the step of identifying and extracting memory information (S110), the memory information extraction unit (110) can identify and extract memory information including a command that executes a malicious program to call a trampoline code used in an obfuscation technique.

[0118] The memory information extracted in the step of identifying and extracting memory information (S110) may include at least one of original code and data, context information, and trampoline code address.

[0119] Original code and data may refer to code and data restored to memory during execution of a malware.

[0120] Process context information can be context information about CPU and memory.

[0121] The trampoline code address is the address where the trampoline code is located, and may be the address of the basic block (BB) to which the trampoline code call instruction belongs.

[0122] In the step (S130) of classifying the type of obfuscation technique of a malicious program, the code execution unit (130) can classify the type of obfuscation technique of a malicious program by executing trampoline code based on memory information.

[0123] In the step (S130) of classifying the type of obfuscation technique of a malicious program, the code execution unit (130) can execute trampoline code by configuring an environment identical to the process environment when the obfuscated malicious program is executed based on the original code and data and process context.

[0124] And in the step (S130) of classifying the type of obfuscation technique of the malicious program, the code execution unit (130) executes the trampoline code located at the memory address of the original entry point (OEP, Original Entry Point) to obtain the address of the next original code, and can store the address of the original code as the address of the entry point (EP).

[0125] In addition, in the step (S130) of classifying the type of obfuscation technique of the malicious program, the code execution unit (130) can detect a pattern in which the decrypted API (Application Programming Interface) address is recorded in the stack memory and a return instruction is executed during execution of the trampoline code, thereby obtaining the address of the API and generating a list of API addresses.

[0126] And in the step (S130) of classifying the type of obfuscation technique of the malicious program, the code execution unit (130) can classify the type of obfuscation technique into at least one of the OEP obfuscation technique that patches the trampoline code call instruction to the OEP memory address and the API obfuscation technique that records the start address of the trampoline code in the memory area referenced by the indirect call instruction.

[0127] In the step (S150) of generating a de-obfuscation program, the code execution unit (130) can de-obfuscate a malicious program according to a classified obfuscation technique to generate a de-obfuscation program.

[0128] In the step (S150) of generating such a de-obfuscation program, the code execution unit (130) can reconstruct an IAT (Import Address Table) using the API address list, and generate a de-obfuscation program using at least one of the entry point address, command, and the reconstructed IAT.

[0129] The deobfuscation method of the present invention can be implemented in the form of program commands that can be executed by various computer components and recorded on a computer-readable recording medium. The computer-readable recording medium can include program commands, data files, data structures, etc., either singly or in combination.

[0130] The program commands recorded on the above computer-readable recording medium may be specially designed and configured for the present invention or may be known and available to those skilled in the art of computer software.

[0131] Examples of computer-readable recording media include magnetic media such as hard disks, floppy disks, and magnetic tapes, optical recording media such as CD-ROMs and DVDs, magneto-optical media such as floptical disks, and hardware devices specifically configured to store and execute program instructions such as ROM, RAM, and flash memory.

[0132] Examples of program instructions include not only machine language codes, such as those generated by a compiler, but also high-level language codes that can be executed by a computer using an interpreter or the like. The hardware device may be configured to operate as one or more software modules to perform processing according to the present invention, and vice versa.

[0133] And the method according to this embodiment was shown through experiments to be capable of deobfuscating binaries obfuscated by three different protectors (Themida, VMProtect, ASProtect).

[0134] Below, the efficiency of the deobfuscation method of the present invention, which unpacks and deobfuscates a program provided by Themida using the OEP obfuscation technique and the API obfuscation technique, will be described.

[0135] First, Fig. 9a is a diagram illustrating the OEP code of the original program, Fig. 9b is a diagram illustrating the OEP code of a malicious program obfuscated according to an OEP obfuscation technique, and Fig. 10 is a diagram illustrating a process in which a runtime error occurs in a malicious program obfuscated according to an OEP obfuscation technique.

[0136] As shown in Figures 9a and 9b, it can be seen that the malware obfuscated according to the OEP obfuscation technique immediately jumps directly to the trampoline code.

[0137] That is, the EntryPoint-Virtualization option of Themida (v3.0.7) modifies the instructions of the basic block that are executed at or after the OEP of the program.

[0138] And as shown in Fig. 10, it can be seen that in a malware obfuscated according to the OEP obfuscation technique, the OEP obfuscated code simply dumps the executable file from memory and then accesses an unmapped memory area, causing a runtime error.

[0139] The deobfuscation method according to this embodiment can detect trampoline code used for OEP obfuscation, similar to Algorithm 1 below. The deobfuscation method can then patch the obfuscated code to branch back to the original code. Algorithm 1 below is a deobfuscation algorithm for Themida OEP obfuscation.

[0140] [Algorithm 1]

[0141]

[0142] FIG. 11 is a diagram showing the results of an experiment verifying the effectiveness of a deobfuscation method according to one embodiment of the present invention.

[0143] Specifically, as shown in FIG. 11, the result of executing the patched program, i.e., the deobfuscated program, can be seen that the deobfuscated program according to the present invention is executed in the same manner as the original program.

[0144] Therefore, the deobfuscation method according to the present embodiment can solve OEP obfuscation by analyzing trampoline code.

[0145] Meanwhile, Themida (v3.0.7)'s API-Wrapping option obfuscates all APIs in the original IAT of the compressed program. All trampoline code in Themida is argument-insensitive, and unlike previous versions and other packers, Themida stores all trampoline code in the ".themida" section.

[0146] Fig. 12(a) is a diagram illustrating an IAT of a malicious program obfuscated according to an API obfuscation technique, and Fig. 12(b) is a diagram illustrating a memory map of a malicious program obfuscated according to an API obfuscation technique.

[0147] Themida's unpacking routine writes the trampoline code of the wrapped API to the original IAT location, as illustrated in Figure 12. The deobfuscation method according to this embodiment parses and independently executes all addresses to identify the obfuscated API. To this end, deobfuscation is performed according to Algorithm 2 below, which is a deobfuscation algorithm for Themida API obfuscation.

[0148] [Algorithm 2]

[0149]

[0150] As can be seen from the above Algorithm 2, the deobfuscation method of the present invention executes all trampoline code blocks to solve API obfuscation.

[0151] Fig. 13(a) is a diagram illustrating the IAT of the original program, and Fig. 13(b) is a diagram illustrating the IAT of the program deobfuscated according to the deobfuscation method of the present invention.

[0152] As shown in FIG. 13(a) and FIG. 13(b), it can be seen that the deobfuscation method of the present invention can successfully deobfuscate a malicious program according to the API obfuscation technique.

[0153] Although various embodiments of the present invention have been illustrated and described above, the present invention is not limited to the specific embodiments described above, and various modifications can be made by a person having ordinary skill in the art to which the present invention pertains without departing from the gist of the present invention as claimed in the claims, and such modifications should not be understood individually from the technical idea or prospect of the present invention.

[0154] [Explanation of symbols]

[0155] 100: Deobfuscation device 110: Memory information extraction unit

[0156] 130: Code execution section 131: Emulator

Claims

1. In a de-obfuscation method in a de-obfuscation device that de-obfuscates a malicious program obfuscated using an obfuscation technique, A step of executing the above malicious program to identify and extract memory information including the trampoline code used in the above obfuscation technique; A step of classifying the type of obfuscation technique of the malicious program by executing the trampoline code based on the memory information; and A deobfuscation method comprising a step of deobfuscating the malicious program according to a classified obfuscation technique to create a deobfuscated program.

2. In paragraph 1, The above memory information is, Original code and data restored to memory during execution of the above malware; Process Context information, which is context information about CPU and memory; and A deobfuscation method comprising at least one trampoline code address where the trampoline code is located.

3. In paragraph 2, The above trampoline code address is, A deobfuscation method, which is the address of the basic block (BB) to which the above trampoline code call instruction belongs.

4. In paragraph 2, In the step of classifying the types of the above obfuscation techniques, A deobfuscation method for executing the trampoline code by configuring an environment identical to the process environment when the obfuscated malware was executed based on the original code and data and process context.

5. In paragraph 2, The steps for classifying the types of the above obfuscation techniques are: A deobfuscation method comprising the step of executing the trampoline code located at the memory address of the original entry point (OEP), thereby obtaining the address of the next original code, and storing the address of the original code as the address of the entry point (EP).

6. In paragraph 2, The steps for classifying the types of the above obfuscation techniques are: A deobfuscation method comprising a step of detecting a pattern in which a decrypted API (Application Programming Interface) address is recorded in stack memory and a return instruction is executed during execution of the trampoline code, thereby obtaining the address of the API and generating a list of API addresses.

7. In either of paragraphs 5 and 6, In the step of classifying the types of obfuscation techniques, A deobfuscation method classified as at least one of an OEP obfuscation technique that patches a trampoline code call instruction to the OEP memory address and an API obfuscation technique that records the starting address of the trampoline code in a memory area referenced by the indirect call instruction.

8. In either of paragraphs 5 and 6, In the step of generating the above deobfuscation program, A deobfuscation method comprising: reconstructing an IAT (Import Address Table) using the above API address list, and generating the deobfuscation program using the reconstructed IAT and at least one of the entry point address and command.

9. A computer-readable recording medium having recorded thereon a computer program for performing the deobfuscation method according to paragraph 1.

10. In a de-obfuscation device that de-obfuscates a malicious program obfuscated using an obfuscation technique, A memory information extraction unit that executes the malicious program to identify and extract memory information including the trampoline code used in the obfuscation technique; and A deobfuscation device including a code execution unit that classifies the type of obfuscation technique of the malicious program by executing the trampoline code based on the memory information, and deobfuscates the malicious program according to the classified obfuscation technique to generate a deobfuscated program.

11. In paragraph 10, The above memory information is, Original code and data restored to memory during execution of the above malware; Process Context information, which is context information about CPU and memory; and A deobfuscation device comprising at least one trampoline code address where the trampoline code is located.

12. In paragraph 11, The above trampoline code address is, A deobfuscating device, which is the address of the basic block (BB) to which the above trampoline code call instruction belongs.

13. In paragraph 11, The above code execution part is, A deobfuscation device that executes the trampoline code by configuring an environment identical to the process environment when the obfuscated malware is executed based on the original code and data and process context.

14. In paragraph 11, The above code execution part is, A deobfuscation device that executes the trampoline code located at the memory address of the original entry point (OEP), thereby obtaining the address of the next original code, and stores the address of the original code as the address of the entry point (EP).

15. In paragraph 11, The above code execution part is, A deobfuscation device comprising a step of detecting a pattern in which a decrypted API (Application Programming Interface) address is recorded in stack memory and a return instruction is executed during execution of the trampoline code, thereby obtaining the address of the API and generating a list of API addresses.

16. In any one of paragraphs 14 and 15, The above code execution part is, A de-obfuscation device classified as at least one of an OEP obfuscation technique that patches a trampoline code call instruction to the OEP memory address and an API obfuscation technique that records the starting address of the trampoline code in a memory area referenced by the indirect call instruction.

17. In any one of paragraphs 14 and 15, The above code execution part is, A deobfuscation device that reconstructs an IAT (Import Address Table) using the above API address list and generates the deobfuscation program using the reconstructed IAT and at least one of the entry point address and command.

Images