Attackers and defenders of computer systems both strive to gain complete control over the system. To maximize their control, both attackers and defenders have migrated to low-leve...
Samuel T. King, Peter M. Chen, Yi-Min Wang, Chad V...
Microscopic analysis of malicious code (malware) requires the aid of a variety of powerful tools. Chief among them is a debugger that enables runtime binary analysis at an instruc...
Abstract. In order to obtain and maintain control, kernel malware usually makes persistent control flow modifications (i.e., installing hooks). To avoid detection, malware develope...
Heng Yin, Pongsin Poosankam, Steve Hanna, Dawn Xia...
VMM (virtual machine monitor) based system provides the useful inspection and interposition of guest OS. With proper modification of guest OS, we can obtain event-driven memory sn...
Abstract. This paper gives an overview of our research in the automation of the process of software protection analysis. We will focus more particularly on the problem of obfuscati...