Malware Deobfuscation via Trampoline Code Analysis for OEP and IAT Recovery
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing deobfuscation tools struggle to effectively handle obfuscation techniques such as OEP and IAT obfuscation in malicious programs, particularly when trampoline codes are used, leading to inaccurate analysis and failure in restoring the original code structure.
Innovation Solution
A method and apparatus that identify and execute trampoline codes to classify obfuscation techniques, restoring the original entry point and import address table by analyzing memory information and process context, thereby generating a deobfuscated program.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Object-affected harmful factors
If packers use trampoline code to obfuscate the original entry point (OEP), then the malicious program can evade detection by static analysis tools, but the original entry point becomes difficult to find and restore
Solution Approach 1:
The patent uses an intermediary approach by introducing a deobfuscation apparatus that acts as a mediator between the obfuscated malicious program and the analysis system. This apparatus executes the program in a controlled environment, monitors the control flow to identify trampoline code patterns, and restores the original entry point by analyzing the jump instructions and control flow transfers. The intermediary system bridges the gap created by the trampoline code obfuscation without requiring direct access to the original unobfuscated code.
Solution Approach 2:
The patent implements feedback mechanisms by monitoring the execution flow of the malicious program and using the observed control flow information to identify and restore the original entry point. The system continuously observes jump instructions, analyzes control flow patterns, and adjusts its understanding of the program structure based on the actual execution behavior. This feedback loop enables the system to overcome the obfuscation by learning from the program's runtime behavior rather than relying solely on static analysis.
2Reliability
If deobfuscation tools use conventional methods to restore the import address table (IAT), then API obfuscation can be addressed, but the methods fail when packers record trampoline code addresses in the import table
Solution Approach 1:
The patent applies dynamics by transitioning from static analysis of the import table to dynamic analysis during program execution. Instead of relying on the static structure of the import table which may be obfuscated with trampoline code addresses, the system dynamically monitors control flow transfers and API calls during runtime. This dynamic approach allows the system to identify the actual API invocation patterns and reconstruct the import table based on observed behavior rather than static declarations, making it resilient to obfuscation techniques that modify the import table structure.
Solution Approach 2:
The patent employs preliminary action by preparing and executing the malicious program in a controlled virtualized environment before performing detailed analysis. The system pre-configures the execution environment, instruments the program to monitor control flow and API calls, and captures runtime behavior data before attempting to restore the import table. This preliminary setup enables the system to gather necessary information about the program's actual execution patterns, which is then used to accurately reconstruct the import table despite obfuscation.
3Productivity
If unpackers assume the compressed program is completely unpacked when detecting OEP, then the unpacking process can proceed, but the assumption is incorrect when OEP obfuscation techniques are used
Solution Approach 1:
The patent replaces the mechanical assumption-based approach with an observation-based system. Instead of mechanically assuming that detecting an OEP marker means the program is fully unpacked, the system uses runtime execution monitoring to observe actual control flow behavior. The system substitutes the simple detection mechanism with a more sophisticated observation system that tracks control flow transfers, identifies trampoline code patterns, and verifies the actual unpacking status by monitoring execution behavior rather than relying on static markers or assumptions.
Data Source
AI summary
A method for a deobfuscation apparatus that deobfuscates a malicious program obfuscated using an obfuscation technique, and the deobfuscation method comprises executing the malicious program to identify and extract memory information containing a trampoline code used in the obfuscation technique, executing the trampoline code based on the memory information to classify a type of obfuscation technique of the malicious program, and deobfuscating the malicious program according to the classified obfuscation technique and generating a deobfuscation program. According to the constitution, the techniques for obfuscating OEP and IAT can be deobfuscated.