Dummy Debugger Tricking Malware Self-Defense Termination
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional malware prevention technologies face challenges in continuously updating virus patterns and rules, consuming high system resources, and failing to effectively counter malware self-defense mechanisms, which hinder detection and analysis.
Innovation Solution
The technique employs malware's self-defense mechanisms by creating a dummy debugger or emulator presence, using API hooks and dummy data to trick malware into believing a debugger or emulator is present, causing it to terminate or sleep without executing.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If pattern matching and virus signatures are used to detect malware, then malware detection capability is improved, but system resources are heavily consumed and performance decreases
Solution Approach 1:
Instead of detecting malware through pattern matching, the invention inverts the approach by making the system appear to have a debugger present, which triggers malware's own self-defense mechanisms to terminate the malware. This reverses the traditional detection paradigm and eliminates the need for resource-intensive pattern matching.
Solution Approach 2:
The invention converts malware's harmful self-defense mechanisms into a beneficial feature. By exploiting the anti-debugger traps that malware uses to protect itself, the system causes malware to self-terminate when it detects the fake debugger presence, turning its defense mechanism against it.
2Reliability
If behavior-based rules and policies are used to detect malware, then malware detection capability is improved, but system resources are heavily consumed and performance decreases
Solution Approach 1:
The invention inverts the traditional behavior-based detection approach by not monitoring malware behavior, but instead creating conditions that trigger malware's own behavioral responses. The system appears to have a debugger, which causes malware to exhibit self-termination behavior, eliminating the need for resource-intensive behavior monitoring.
3Reliability
If continuous updates of virus patterns and rules are performed, then malware detection capability is improved, but system complexity and maintenance burden increase
Solution Approach 1:
The invention makes the malware self-terminate through its own self-defense mechanisms rather than requiring external detection systems to be updated and maintained. The system leverages the malware's inherent anti-debugger functionality, eliminating the need for continuous updates of virus patterns and rules.
Data Source
AI summary
A dummy debugger program is installed within the user computer system. The dummy program is registered with the operating system as a debugger and may also be registered as a system service as if it is a kernel mode debugger. The dummy debugger program may have the name of a popular debugging program. Dummy registry keys are created that are typically used by a debugger to make it appear as if a debugger is present within the operating system of the user computer. Dummy program folders or dummy program names are created to make it appear as if a debugger is present within the operating system of the user computer. API calls are intercepted by using API hooks and modified to always return a meaningful value indicating that a debugger is present. Malware performing any checks to see if a debugger is present will be informed that a debugger is present and will then shutdown, sleep, terminate, etc. Or, in order to trick malware into thinking that an emulator is present, any API call is intercepted and the sleep time passed in is raised by a couple of milliseconds. Malware will determine that the time parameter passed in is not equivalent to the elapsed time from before the API call to after the call and the malware will determine that an emulator is present and will terminate.