Equational reasoning obfuscated ...

[ Pobierz całość w formacie PDF ]
SCIS2007 The2007Symposiumon
CryptographyandInformationSecurity
Sasebo,Japan,Jan.23-26,2007
TheInstituteofElectronics,
InformationandCommunicationEngineers
Allrightsarereservedandcopyrightofthismanuscriptbelongstotheauthors.
Thismanuscripthasbeenpublishedwithoutreviewingandeditingasreceived
fromtheauthors:postingthemanuscripttoSCIS2007doesnotpreventfuture
submissionstoanyjournalsorconferenceswithproceedings.
Equationalreasoning⑲䵑␤␿
obfuscateddecipherroutine⑎║╩╡ℼ┿㠡㵐
あ䘣习ㅻ
¤
␢⑩⑞␷
┽╕╈┦┧┢⑎䙱䙉㈽⑈ぅ㥦㈽⑏™䉑┿╳║ℼ┽╕╈┦┧┢㔻㵑⑞␿⑏䥔䀵┳ℼ╉⑎㠡㵐㉳
䡲㔻㵑䅐䩽⑋␪␤⑆㵅䵗⑋⑊⑃⑆␭⑆␤⑫℣䭜佀䨸⑇⑏䙱䙉㈽␵⑬␿䥼㥦╫ℼ╁╳⑎㉲䁏⑋™
Equational
reasoning
⑲䔬䵑␷™㍆㱯║╩╡ℼ┿⑲㠡㵐␹⑫␿②⑎䩽䬡佀⑲㰨␹℣䑳う㱪䬡⑇⑏™䙱䙉㈽␵⑬␿㱂㥔
┳ℼ╉⑲㕕┢┻╳╖╫␷™䁡䤽㠽⑎㝁㰰⑋䩑㐹␹⑫℣䩑㐹␵⑬␿䁡㜲⑋䉐␷⑆™╬┾╪╥ℼ┷╧╳⑋⑨⑪
㵌䉠⅊
de-obfucsation)
⑲㥔␦℣㰡⑋™㠡㵐␵⑬␿╗╭┰╩╠㤽䈤⑲㠵⑋䕹㉁䉥䙾⑲㥔␤™║╩╡ℼ┿⑲
㠡㵐␹⑫℣䕹㉁䉥䙾⑎䅠㩮⑋⑏╇╢┸╥╬ℼ┷╧╳⑈║╩╢┸╥╬ℼ┷╧╳⑎⌲⑄⑲䵑␤␿℣⑞␿™␳⑎
㉡䑸⑇䀸䀮␵⑬␿䁡㽴⑲㠵⑋™㵌䉠⑤║╩╡ℼ┿㠡㵐⑎䙱し䕙⑎㭘䤸⑲㩮䀮␹⑫␳⑈␬㉄䜽⑇␢⑫℣䤾
㉁㱂㠳⑇⑏㽴䉎⑎
obfuscateddecipherroutine
⑲㭽⑄㠡䉎⑲™䑳う㱪䬡⑲䵑␤⑆㠡㵐␷␿℣
┭ℼ╯ℼ╉
䙱䙉㈽⑈ぅ㥦㈽™
obfuscateddecipherroutine
™
equationalreasoning
™┢┻╳╖╩┳ℼ╉™
FoL
㵨䵽㝏
1
⑏␸②⑋
3
䑳う㱪䬡
┽╕╈┦┧┢⑎ぅ㥦㈽⑈䙱䙉㈽⑏™㴾䵨䉑┿╳║ℼ䀭
⑲㍎䩝␹⑫␿②⑎㔻㵑⑈␷⑆䍭䱜␵⑬⑆␭␿␬™㙡䜯䥔
䀵┳ℼ╉⑎㠡㵐⑲㉳䡲␹⑫䩽䬡⑈␷⑆䔬䵑␵⑬⑫␳⑈
␬䈿␯⑊⑪™㵅䵗䀭⑲䅽␷⑆␭⑆␤⑫℣┽╕╈┦┧┢䙱
䙉㈽⑎㔻㵑⑏™䡦㍓䔪㼷␷␤⑈␤␦䱌③␢⑪™䙱䙉㈽⑎
┳ℼ╉⑎㰫䘰䀸䀮⑎㠦㕦™␢⑫␤⑏䙃㱬⑊╎┦╏┦␬㵪
ぢ┢╳╀ℼ┰╩╳╉⑈㡀⑯⑬⑫┤╳┿ℼ╍╃╈⑎┵┤╈
⑇㘦䴭␵⑬⑫␳⑈⑏␢⑫␬™␽⑬⑩⑲䕽㥧䔪Ω㉊㍘䔪⑋
䨬䁏␷™䤾㉁␹⑫␿②⑎㠦㕦⑏㥔⑯⑬⑫␳⑈⑏㠽㭾䕀⑇
⑏㔩⑇␢⑫℣䭜佀䨸⑇⑏™䙱䙉㈽␵⑬␿䥼㥦╫ℼ╁╳⑋
䉐␷⑆™ぬ㌬㵒㡬佀䵽⑎䑪䵽㹚䱀㝏⑲䵑␤⑆™┳ℼ╉⑎
㵌䉠⑈║╩╡ℼ┿⅊㠰™┢╉╬┹™┫┦╳┿䕹⅋⑎㠡㵐
⑲㥔␦␿②⑎䩽䬡佀⑲㰨␹℣
䑳う㱪䬡⑏™
[1]
䙱䙉㈽␵⑬␿䥼㥦╫ℼ╁╳⑎┳ℼ╉
⑎㵌䉠™
[2]
㠰™㍆㱯┢╉╬┹™┫┦╳┿⑎║╩╡ℼ┿⑎
䙃䑪⑈␤␦⌲䍊㌬␫⑩⑊⑫℣
[1]
⑋⑏╬┾╪╥ℼ┷╧╳™
[2]
⑋⑏䕹㉁䉥䙾
(equalitysubstitution)
⑈␤␦㱪䬡⑲䔬
䵑␹⑫℣
3.1
┳ℼ╉⑎㵌䉠
␳␳⑇⑎┳ℼ╉⑎㵌䉠⑈⑏™㔡䜽䔪⑋䕹㉁⑇␢⑫␬䨣㬨
䕙⅊㹩䐹䕙⅋⑎㥢␤╗╭┰╩╠⑲™⑨⑪㑊㝩⑊╗╭┰╩╠
⑋䩑㐹␹⑫␳⑈⑲㭘␹℣
de-obfuscation
⑤
simplication
⑋␢␿⑫䅠㩮⑇␢⑫℣㽞⑏™䑳う㱪䬡⑎⌱䍊㌬䱜⑲㰨␷
␿③⑎⑇␢⑫℣乣␨⑐™㽞⑎ㄦ䍊⑋␢⑫䅠㩮⑏™
-(1-1)|-(1-3)|1.
if(1-1)and(1-3)istrue,then1.
2
㑘伢㠦㕦
⑏™䄫ぜ㡸䵽
(Transitionaxioms
⅋⑈㡆⑐⑬™䙱䙉㈽␵
⑬␿┳ℼ╉⑲㑊䅇㈽␹⑫⑎⑋䵑␤⑫℣乣␨⑐™
┳╳╔╥ℼ┿┦┣╫┹⅊╯ℼ╠™╈╭┤⑲㑞①⅋⑈␽
⑎㠡㵐⑎䵽佀䔪⑊䑪㕁⑈㕄佀⑏
[1][2]
⑇㥔⑯⑬⑆␤⑫℣
SymantecCorporation
␬⌲⌰⌰⌱䜯⑋
W32.Simile
⑋⑄
␤⑆⑎㉲䁢⑲㵐␷␿㨢␫⑩™
metamorphic,polymorphic
⑈␤⑃␿ぅ㥦㈽⑈䙱䙉㈽⑲㥔␦䥔䀵┳ℼ╉⑎㠦㕦␬㍨䠯
⑋㥔⑯⑬⑫⑨␦⑋⑊⑃␿
[5][6][7]
℣
[8]
⑇⑏╢╇╫㠡㨺⑎
䔬䵑␬™
[9]
⑇⑏
attackgraph
⑲䵑␤␿㱪䬡␬㠡䘤␵⑬
⑫⑨␦⑋⑊⑃⑆␤⑫℣
Reoderinginstructions
⑋⑄␤⑆
⑎䉐ㅾ⑏
[10]
⑇㕄佀␵
⑬⑆␤⑫℣
¤
䙈丩㥔䀯䬡㽍㹰䩳䑌㼮㠦㕦㔡㤽㹰䩳䑌㼮┻┭╥╪╆┣㠦㕦┻╳┿ℼ
,
䕬㕾䕔㸮㙢て㭔㑓て䭌䐮
4-2-1,4-2-1Nukui-Kitamachi,Koganei,
Tokyo184-8795Japan,ruo@nict.go.jp
-(1-1)|-(1-3)|1.:
if(1-1)and(1-3)istrue,then1.
-(movdword_10h)|-(movedxdword_1)
|movedx0h.
⑏™
registersubstitution
⑈␤␦™㹩䐹⑊╬┸┹┿䉥䙾
⑋⑨⑪䙱䙉㈽⑲㥔␦╆┯╋╃┯⑋䉐ㅾ␹⑫③⑎⑇␢⑫℣
1
 ␫⑃␿䁡⑏⍏⍒⑲㱨⑃⑆䩝䈸␵⑬⑫␿②™䕹㉁䉥䙾⑋⑨⑃
⑆㽤佀╗╭┻┹⑲㽊②⑆␤␯␳⑈␬㉄䜽⑇␢⑫℣
CLAUSE 1-1
CLAUSE 2-1
3.3 䁡䤽㠽⑘⑎䩑㐹
CLAUSE 1
-(1-1) | -(1-3) | 1
㽞⑏™䙱䙉㈽␵⑬␿㱂㥔╕┡┤╫␫⑩™䑪䵽㹚䱀㝏␬
㵨䵽⑇␭⑫䁡㝁㰰⑎䤽㠽
(clausalrepresentation)
⑋䩑㐹
␷™㠡㵐⑲㥔␦⑞⑇⑎╕╭ℼ╁╣ℼ╈⑇␢⑫℣㱂㥔╕┡
┤╫⑲
SOUCER
⑤
IDAPro
⑊⑉⑎┽╕╈┦┧┢⑇㕕
┢┻╳╖╫␷™お㈼⑎⑨␦⑊㝁㰰⑋䩑㐹␹⑫℣
CLAUSE 1-2
CLAUSE 2
-(2-1) | -(2-2) | 2
CLAUSE 2-2
CLAUSE 1-3
instruction(operand1(x),operand2(y),z,time(1)).
OBFUSCATED CODE
SIMPLIFIED CODE
␳␳⑇™
instruction
⑏
opcode
⅊䰿乡⅋™
operand1
™⌲
⑏䰿乡⑎ぺ㽴™
z
⑏┢╉╬┹™
time(
⅋⑏™㽤佀⑎㉡䑸⑋
⑨⑃⑆㵨䵽␵⑬␿⅊㱂㥔␵⑬␿⅋㉳㽴⑇␢⑫℣
㽞
1:
3.2 ║╩╡ℼ┿⑎㠡㵐
4 䔬䵑㽤佀㔻䬡
䭜佀䨸⑇⑏™║╩╡ℼ┿⑎㠡㵐⑋
equationalreasoning
⑈␤␦㱪䬡⑲䔬䵑␹⑫℣ぬ㌬㵒㡬佀䵽⑎䑪䵽㹚䱀㝏⑇⑏™
䕹㉁䉥䙾
(equalitysubstitution)
␬␳⑬⑋㑞⑞⑬⑫℣㙱
䉎䔪⑋⑏™
demodulation
⑈
paramodulation
⑈␤␦䅠㩮
⑋⑨⑃⑆䕹㉁䉥䙾⑲㥔␦℣
4.1 㭙㭽㴸㥧䁯丬
㭙㭽㴸㥧䁯丬
[7]
⑏™⌱⌹⌶⌵䜯⑋
Wos
⑩⑋⑨⑃⑆䑳
う␵⑬␿③⑎⑇␢⑫℣␳⑎㝗㬻䁯丬⑏䀩㡂䁯丬⑎⌱⑄⑇™
㰫䘰㽤佀╗╭┰╩╠⑋䱜䤸⑈␹⑫㉲㙵㑖⑋㑘㜸⑊␤⑈␳
⑭⑲䌵㩷␻␺⑋™䉐㹝⑈␷⑆␤⑫䱤䉪⑋㴸䍦␵␻⑫⑨␦
⑋␹⑫℣䁡㴸㥧
S
™
T
␬␢⑪™
S-T
␬㴼䈭㉄䜽⑇␢⑫⑈
␭™
T
⑏
S
⑎㭙㭽㴸㥧⑇␢⑫℣␳⑎⑈␭™㭙㭽㴸㥧⑋䈰
␵⑊␤䁡䘱㭎⑇⑏䘳㵐⑲㥔⑯␺™㭙㭽㴸㥧⑋䈰␹⑫䁡⑈
⑎㑖⑇™䘳㵐⑲㥔␦䩽㽋⑲㭙㭽㴸㥧䁯丬⑈␤␦℣
fact:f(g(x),x).
fact:equal(g(a),b).
conclusionf(b,a).
fact:equal(data_16e,514Bh).
fact:mov(reg(ah),const(data_16e),63,time(1)).
conclusion:
mov(reg(ah),const(514Bh),63,time(1)).
4.2 䐶䘳㵐
䐶䘳㵐
[8]
⑏⌱⌹⌶⌵䜯⑋
Robinson
⑩⑋⑨⑃⑆䑳㸧
␵⑬␿㱪䬡⑇™䑌㹯⑎䘳㵐㝏⑎㱪䬡⑇⑏⌱䉐⑎䁡␫⑩㵧
㰡䘳㵐⑲㥔␦⑎⑋䉐␷⑆™⌲㡄お㹥⑎䁡⑋䉐␷⑆䘳㵐⑲
㥔␦℣䐶䘳㵐⑎さ䰣⑏™㈿䍊㌬③⑎⌲㥠䘳㵐⑋␢␿⑫㩮
㙈⑲⌱⑄⑋⑞⑈②␿③⑎⑇™䑌㹯⑎⌲㥠䘳㵐⑋䡦⑙⑆™
䈿␯⑎䘳㵐␬㔯␳⑫⑈␤␦㭶⑲㭘␹℣
㹥⑎⌲⑄⑎┳ℼ╉⑏™╇╢┸╥╬ℼ┷╧╳⑈␽⑎䔬䵑
乣⑲䤽␷␿③⑎⑇␢⑫℣␳⑎䅠㩮⑏™╇╢┸╥╬ℼ┿
⅊
equal
䁡⅋⑲™
fact
䁡⑋䔬䵑␷™䕹㉁䉥䙾⑲㥔␤™䉐㹝
⑈⑊⑫䁡⑎㑊䅇㈽⑲㥔␦℣
fact:mov(reg(ah),const(2Ch),162,time(1)).
fact:mov(reg(bx),reg(ah),300,time(1)).
fact:decrypt(reg(dx),reg(bx),431,time(1)).
/*decrypter*/
4.3 䩱䁝
䑪䵽㹚䱀⑲䵑␤␿㽤佀╗╭┻┹⑇⑏™䱜䤸⑈␹⑫䁡⑲
䘳㵐␹⑫㉡䑸⑇™␤␯⑄␫⑎䁡␬䩝㭽␵⑬™㼷␷␤䁡␬
䀸䀮␵⑬␿㭾䕀⑇™㉡㕮⑋䩝㭽␵⑬␿䁡⑈⑎㑖⑇™㉾②
⑆䑪䵽␬䔬䵑␵⑬⑫℣␳⑎䩝㭽␵⑬⑆␤⑫䁡⑎␦⑁™⑨
⑪ぬ䡌䔪⑊䁡⑲㭄␹㵨䵽⑲䩱䁝
[10]
⑈␤␦℣
-mov(reg(x),const(y),z,time(1))|x=const(y,z).
conclusion:decryptor(reg(dx),
key(const(2Ch,162),431,time(1)).
4.4 ╇╢┸╥╬ℼ┷╧╳
╇╢┸╥╬ℼ┷╧╳
[9]
⑈⑏™␢⑩␫␸②䕹㉁䉥䙾⑲
㥔␦␿②⑎䁡⑲䑪䵽㹚䱀㝏⑋㉃␨⑆™㵨䵽䁡㜲⑎㑊丬㈽
␢⑫␤⑏䀵㵠㈽⑲㥔␦㵨䵽⑇␢⑫℣╇╢┸╥╬ℼ┷╧╳
⑏™␽⑬㰫䉎⑇㹩䐹⑊䰿乡™␢⑫␤⑏™
MOV
䰿乡⑋⑨
⑫╡╢╪™╬┸┹┿™䩑㽴㑖⑎䔾䅷⑋⑨⑫╗╭┰╩╠⑎
㹵䉖䄫ぜ⑲㑊丬㈽␹⑫⑎⑋䴭㡺⑇␢⑫℣
㹥⑎⌲⑄⑎┳ℼ╉⑏™║╩╢┸╥╬ℼ┷╧╳⑈␽⑎䔬
䵑乣⑲㰨␷␿③⑎⑇␢⑫℣╇╢┸╥╬ℼ┷╧╳⑈䡦㍓␷
⑆⑨⑪䈿䵍⑊䁡㝁㰰⑋䵸䵑␹⑫␳⑈␬⑇␭⑫℣╇╢┸╥
╬ℼ┷╧╳␬
e®ectivness
⑲㱧㑣⑲␷⑆␤⑫⑎⑋䉐␷™␳
⑎䅠㩮⑇⑏㌵␷⑆™㐰䄴䀭⅊
completeness)
␬䩝␿⑬⑫
⑈␵⑬⑫℣╇╢┸╥╬ℼ┷╧╳␬ぬ㉳⑎䕹㉁䉥䙾⑲㥔⑃
⑆䑤㭟␹⑫⑎⑋䉐␷™║╩╢┸╥╬ℼ┷╧╳⑏㭈⑯⑬⑊
2
 CLAUSAL REPRENTATION
OF VIRUS
VIRUS
BINARY EXECUTALE
DISASSEMBLER
THEOREM PROVER
VIRUS ASEEMBLY OCDE
INFECTED?
TRANSLATOR(PARSER)
YES / NO
㽞
2:
㱂㥔╕┡┤╫␫⑩䁡㝁㰰⑘⑎䩑㐹⑈㠡㵐
4.5 ║╩╢┸╥╬ℼ┷╧╳⅊䕹㥦䐴䀰䉥䙾⅋
testcountercounter
jmploop_start
║╩╢┸╥╬ℼ┷╧╳⅊䕹㥦䐴䀰䉥䙾⅋⑏™╇╢┸╥
╬ℼ┷╧╳⑈䘱␸␯䕹㉁䉥䙾⑎䅠㩮⑇␢⑫℣╇╢┸╥╬ℼ
┷╧╳␬
e®eciency
⑲㵅㭫␷⑆䁟㝗␵⑬⑆␤⑫⑎⑋䉐␷™
║╩╢┸╥╬ℼ┷╧╳⑏㌵␷⑆㽤佀㉡䑸⑇㐰䄴䀭␬䩝㭽
␵⑬⑫℣║╩╢┸╥╬ℼ┷╧╳⑏╇╢┸╥╬ℼ┷╧╳⑎
ぬ䡌㝁⑇␢⑫℣╇╢┸╥╬ℼ┷╧╳⑏ぬ㉳䕹㉁䉥䙾␬㐰
主␹⑫⑈䑤㭟␹⑫␬™║╩╢┸╥╬ℼ┷╧╳⑇⑏㑘伢␹
⑫䁡⑏⍏⍒⑲㱨⑃⑆䩝㭽␵⑬⑫℣␽⑎␿②™䕹㉁䉥䙾⑎
⑟⑇㹵䉖䄫ぜ⑲㔯␳␷⑆™㽤佀╗╭┻┹⑲㽊②⑫␳⑈␬
㉄䜽⑇␢⑫℣
㹥⑎┳ℼ╉
(typeI)
⑏™③⑃⑈③╙ℼ┷╃┯⑊┿┤╗
⑇™䀸䀮␵⑬⑫┳ℼ╉⑎䠾䨬䑸⑎㍤㥧⑲䁪②⑫③⑎⑇␢
⑫℣⍍⍏⍖䰿乡⑇ぅ㥦㈽␵⑬␿╚┤╭ℼ╉⑲䔾䅷␷™䥼
㥦␷␿␢⑈⑋㍊䜼㠵⑎┢╉╬┹⑋䱡␷™㍆㱯║╩╡ℼ┿
⑲㤹㼷␹⑫℣
loop_start
decrypt[address]key
incaddress
deccounter
testcountercounter
jmploop_start
5 䤾㉁㱂㠳
5.1
┵╳╗╫┳ℼ╉
㨣㉳™䑳う┷┹╆╠⑎䤾㉁㱂㠳䵑⑎┳ℼ╉䀸䀮⑋⑏™
SMEG(simulatedmetamorphicencryptiongenerator)[4]
⑲䵑␤␿℣
SMEG
⑏™䴭䰾⑊╡┿╢ℼ╕┣╃┯┳ℼ╉䀸
䀮㑯⑎⌱⑄⑇␢⑪™
SMEG.Pathogen
⑤
SMEG.Queeg
⑊⑉⑎┦┣╫┹⑏䘱╗╭┰╩╠⑲┨╳┸╳⑈␷⑆䅈⑟㥾
⑳⑇␤⑫℣䤾㉁㱂㠳⑇⑏™
SMEG
⑎⌵䉎⑎䙱䙉㈽␵⑬␿
⅊
obfuscated)
┦┣╫┹┳ℼ╉⑲䀸䀮␵␻™䑪䵽㹚䱀㑯⑋
⑨⑃⑆䥼㥦╫ℼ╁╳⑲㠡㵐␹⑫㩝⑋䀸䀮␵⑬␿䁡㽴⑊⑉
⑲䡦㍓␷␿℣
SMEG
⑋⑨⑃⑆䀸䀮␵⑬⑫┦┣╫┹㜲⑏お
㈼⑎⌳㱯⑎┿┤╗⑎┳ℼ╉⑋䨬习␵⑬⑫℣
㹥⑎┳ℼ╉
(typeII)
⑏™╇ℼ┿䔾䅷⑈䥼㥦⑋㑖䁜┢╉
╬╃┷╳┰⑲䵑␤⑫③⑎⑇™⍍⍏⍖⑊⑉⑎䔾䅷䰿乡⑲㭈
⑯␺™䐾䁜┢╉╬┹⑲㭘䑪␷™㍊䜼␵⑬⑆␤⑫╚┤╭ℼ
╉⑲䥼㥦␹⑫℣
loop_start
xchgdata[address]
decryptdatakey
xchg[address]data
incaddress
deccounter
testcountercounter
jmploop_start
loop_start
movdata[address]
decryptdatakey
mov[address]data
incaddress
deccounter
㹥⑎┳ℼ╉⑏™
typeI
⑇⑎⍍⍏⍖䰿乡⑎䉥⑯⑪⑋⍘⍃
⍈⍇
(exchange)
䰿乡⑲䵑␤␿③⑎⑇␢⑫℣
3
5.2 㠡㵐║╩╡ℼ┿
┷╧╳⑎⌲⑄⑲䵑␤␿℣⑞␿™␳⑎㉡䑸⑇䀸䀮␵⑬␿䁡
㽴⑲㠵⑋™㵌䉠⑤║╩╡ℼ┿㠡㵐⑎䙱し䕙⑎㭘䤸⑲㩮䀮
␹⑫␳⑈␬㉄䜽⑇␢⑫℣䤾㉁㱂㠳⑇⑏㽴䉎⑎
obfuscated
decipherroutine
⑲㭽⑄㠡䉎⑲™䑳う㱪䬡⑲䵑␤⑆㠡㵐
␷™䑪乌䔪⑊䤾㉁⑲㥔␦␳⑈⑲㉄䜽⑋␷␿℣㨣㡥⑎㉝䉪
⑈␷⑆⑏™⑨⑪䀺敌␫⑄㥢䈮⑊║╩╡ℼ┿㠡㵐䬡⑤™═
┤╊╪┳ℼ╉⑎㉲䁏⑊⑉␬㕳␲⑩⑬⑫℣
㠡㵐║╩╡ℼ┿⑏™╚┤╭ℼ╉⑎┢╉╬┹™㠰™䥼㥦
╫ℼ╁╳⑎┹┿ℼ╈┢╉╬┹™␽␷⑆┫┦╳┿⑎⌴⑄⑇
␢⑫℣
defineAaddress_of_payload
defineBkey
defineCaddress_loop_start
defineDcounter
㬲㥍䨸㠥
[1]Computerviruses: fromtheorytoapplications.
IRISInternationalseries,SpringerVerlag,ISBN
2-287-23939-1,juin2005.Englisheditionofthe
bookoncomputerviruses.
address_loop_start
payload_transfer(A)
decryptor(B)
parload_transfer(A)
branch(D)
goto_start(C)
[2]DiomidisSpinellis. :Reliableidenticationof
bounded-lengthvirusesisNP-complete.IEEE
TransactionsonInformationTheory,January2000
:280-284.
㹥⑏™䥼㥦╫ℼ╁╳⑎㤽䈤⑎ぬ乣⑲㑊丬␷␿③⑎⑇␢
⑫℣╫ℼ╗⑋䙾⑫䄰⑋™
dene
⑤⍍⍏⍖䰿乡⑲㭈⑃⑆║
╩╡ℼ┿⑲㔬䑪␹⑫℣
[3]PeterSzorandPeterFerrie.:HuntingforMetamor-
phic.VirusBulletinConference,September2001:
123-144.
5.3 㱂㠳㝫㉌
䄰䁡⑞⑇⑇㵒⑙␿™䥼㥦╫ℼ╁╳⑎║╩╡ℼ┿㠡㵐⑎
㩝⑋䀸䀮␵⑬␿䁡㽴⑲䤽⑋㰨␹℣䤽⑏™␽⑬␾⑬䀸䀮␵
⑬␿┳ℼ╉™␽⑎┳ℼ╉⑎┿┤╗⅊⌱␫⑩⌳™䄰䁡㬲㹈⅋™
␽␷⑆䀸䀮␵⑬␿䁡㽴⑲㰨␷⑆␤⑫℣䙱䙉㈽␵⑬␿┳ℼ
╉⑎┿┤╗⑤㠡㵐␹⑫║╩╡ℼ┿⑋⑨⑃⑆䀸䀮␵⑬␿䁡
㽴␬䴽䅛お㹥⑋㹥㈼␹⑫␳⑈␬䨬␫⑃␿℣⑞␿™㱂㩝⑋
㉲䁏⑲㥔⑃␿㝐㠳␫⑩⑏™䘱㱂㠳䙢⑋㡂⑪™䙱䙉㈽⑎䑸
䕙⑲䔬䁚⑋㰨␷⑆␤⑫⑈䅛䑪␵⑬⑫℣
[4]StephenPearce,”ViralPolymorphism”,paper
submittedforGSECversion1.4b,2003.
[5]”Network-levelpolymorphicshellcodedetection
usingemulation”MichalisPolychronakis,Kostas
G.AnagnostakisandEvangelosP.Markatos
DIMVA2006
[6]Semantics-AwareMalwareDetectionMihai
Christodorescu,SomeshJha,SanjitA.Seshia,
DawnSong,RandalE.BryantIEEESecurityand
Privacy2005
5.4 ⑞⑈②⑈㨣㡥⑎㉝䉪
┽╕╈┦┧┢⑎ぅ㥦㈽⑈䙱䙉㈽⑏™㴾䵨䉑┿╳║ℼ䀭
⑲㍎䩝␹⑫␿②⑎㔻㵑⑈␷⑆䍭䱜␵⑬⑆␭␿␬™㙡䜯䥔
䀵┳ℼ╉⑎㠡㵐⑲㉳䡲␹⑫䩽䬡⑈␷⑆䔬䵑␵⑬⑫␳⑈␬
䈿␯⑊⑪™㵅䵗䀭⑲䅽␷⑆␭⑆␤⑫℣┽╕╈┦┧┢䙱䙉㈽
⑎㔻㵑⑏™䡦㍓䔪㼷␷␤⑈␤␦䱌③␢⑪™䙱䙉㈽⑎┳ℼ
╉⑎㰫䘰䀸䀮⑎㠦㕦™␢⑫␤⑏䙃㱬⑊╎┦╏┦␬㵪ぢ┢
╳╀ℼ┰╩╳╉⑈㡀⑯⑬⑫┤╳┿ℼ╍╃╈⑎┵┤╈⑇㘦
䴭␵⑬⑫␳⑈⑏␢⑫␬™␽⑬⑩⑲䕽㥧䔪Ω㉊㍘䔪⑋䨬䁏
␷™䤾㉁␹⑫␿②⑎㠦㕦⑏㥔⑯⑬⑫␳⑈⑏㠽㭾䕀⑇⑏㔩
⑇␢⑫℣䭜佀䨸⑇⑏™䙱䙉㈽␵⑬␿䥼㥦╫ℼ╁╳⑋䉐␷
⑆™ぬ㌬㵒㡬佀䵽⑎䑪䵽㹚䱀㝏⑲䵑␤⑆™┳ℼ╉⑎㵌䉠
⑈║╩╡ℼ┿⅊㠰™┢╉╬┹™┫┦╳┿䕹⅋⑎㠡㵐⑲㥔
␦␿②⑎䩽䬡佀⑲㰨␷␿℣䑳う㱪䬡⑇⑏™䙱䙉㈽␵⑬␿
㱂㥔┳ℼ╉⑲㕕┢┻╳╖╫␷™䁡䤽㠽⑎㝁㰰⑋䩑㐹␹⑫℣
䩑㐹␵⑬␿䁡㜲⑋䉐␷⑆™╬┾╪╥ℼ┷╧╳⑋⑨⑪㵌䉠
⅊
de-obfucsation)
⑲㥔␦℣㰡⑋™㠡㵐␵⑬␿╗╭┰╩╠
㤽䈤⑲㠵⑋䕹㉁䉥䙾⑲㥔␤™║╩╡ℼ┿⑲㠡㵐␹⑫℣䕹
㉁䉥䙾⑎䅠㩮⑋⑏╇╢┸╥╬ℼ┷╧╳⑈║╩╢┸╥╬ℼ
[7]StaticAnalysisofExecutablestoDetectMalicious
Patterns(2003)MihaiChristodorescuandSomesh
Jha12thUSENIXSecuritySymposium,August
2003
[8]HaoChen,DrewDean,andDavidWagner.Model
checkingonemillionlinesofCcode.InProceed-
ingsofthe11thAnnualNetworkandDistributed
SystemSecuritySymposium(NDSS),pages171–
185,SanDiego,CA,February2004.
[9]O.Sheyner,J.Haines,S.Jha,R.Lippmann,andJ.
M.Wing,”AutomatedGenerationandAnalysis
ofAttackGraphs”,IEEESymposiumonSecurity
andPrivacy,April2002.
4
generatedcode#1
TypeI BranchDecryptLoopTransfer
clausesgenerated 3378 30480 4292 30471
parafromgenerated1358 15935 1799 15935
paraintogenerated 1463 13366 1826 13362
generatedcode#2
TypeII BranchDecryptLoopTransfer
clausesgenerated 1158 1466 1258 719
parafromgenerated423 435 435 322
paraintogenerated 390 495 431 158
generatedcode#3
TypeIII BranchDecryptLoopTransfer
clausesgenerated 2751 10184 3072 909
parafromgenerated1186 5330 1436 335
paraintogenerated 803 3932 1008 185
generatedcode#4
TypeI BranchDecryptLoopTransfer
clausesgenerated 808 2890 923 703
parafromgenerated255 1125 268 255
paraintogenerated 271 1170 337 212
generatedcode#5
TypeI BranchDecryptLoopTransfer
clausesgenerated 6327 11990 9903 3235
parafromgenerated2669 3532 2748 1049
paraintogenerated 2227 3474 2686 892
䤽
1:
䕹㉁䉥䙾
(equationalreasoning)
⑋⑨⑫║╩╡ℼ┿㠡㵐㭾⑋䀸䀮␵⑬␿䁡㽴
5
  [ Pobierz całość w formacie PDF ]

zanotowane.pl

doc.pisz.pl

pdf.pisz.pl

upanicza.keep.pl