Malware Characterization via Simulated OS Memory Image
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for detecting shellcode expose the operating system's memory, potentially allowing unrestricted access and making it difficult to identify and characterize malicious code effectively.
Innovation Solution
A memory image is created with representations of a thread environment block and process environment block, including only necessary Dynamic-link libraries (DLLs) and randomized addresses, allowing controlled access and monitoring of shellcode execution, thereby preventing unrestricted access to the OS resources.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If the OS memory image is exposed to shellcode execution, then the shellcode can access OS resources freely, but this creates security risks and makes malware detection difficult
Solution Approach 1:
The patent introduces a memory image as an intermediary layer between the shellcode and the actual OS resources. This memory image contains simulated OS structures (PEB, TEB, DLL representations) that intercept shellcode calls, allowing the shellcode to execute freely while preventing actual access to real OS resources, thus resolving the security contradiction
2Adaptability or versatility
If a complete OS memory image is provided to shellcode, then all OS functionalities are available, but the system complexity and resource consumption increase
Solution Approach 1:
The patent extracts only the essential OS components needed for shellcode execution (PEB, TEB, and critical DLL representations) from the complete OS memory image. By taking out only these necessary elements and omitting redundant parts, the system maintains shellcode compatibility while significantly reducing memory image complexity and resource consumption
3Ease of operation
If DLL descriptors are included in PEB for shellcode access, then DLL functionality is available, but the memory image size and access time increase
Solution Approach 1:
The patent applies local quality by including DLL descriptors directly within the PEB structure at a readily accessible location, rather than requiring external lookups. This localized arrangement allows the shellcode to access DLL information quickly through direct pointer access from the PEB, improving access speed while maintaining a compact memory footprint
4Ease of operation
If addresses in PEB are fixed and predictable, then shellcode execution is straightforward, but security is compromised due to ease of exploitation
Solution Approach 1:
The patent changes the address parameter by implementing randomization of PEB and DLL descriptor addresses. Each memory image instance uses randomized base addresses and offset values, making the memory layout unpredictable. This parameter change maintains shellcode functionality while preventing exploitation that relies on fixed address patterns
Data Source
AI summary
An embodiment may create a memory image including a representation of a thread environment block (TEB) and representation of a process environment block (PEB) according to specifications of an operating system. A memory image may be loaded into a memory and a shellcode may be caused to use the memory image when executed. An access to the memory image, made by the shellcode, may be monitored and controlled.