Automated Identification of Cryptographic Primitives in Binary Programs
Automated Identification of Cryptographic Primitives in Binary Programs
复制标题
DOI：
10.1007/978-3-642-23644-0_3
复制
发表时间：
2011-09
期刊：
影响因子：
--
通讯作者：
Felix Gröbert;Carsten Willems;Thorsten Holz
中科院分区：
文献类型：
--
作者：
Felix Gröbert;Carsten Willems;Thorsten Holz
识别一个给定的二进制程序实现了一个特定的密码算法，并找出更多的信息，密码代码是一个重要的问题。专有程序，特别是恶意软件（所谓的恶意软件）经常使用密码学，我们希望了解更多有关上下文的信息，例如，程序使用哪些算法和密钥。这有助于分析人员快速理解给定的二进制程序的功能并简化分析。在本文中，我们提出了几种识别密码原语的方法（例如，整个算法或仅密钥）。我们执行细粒度的动态二进制分析，并使用收集的信息作为输入的几个特征，加密代码的特定，独特的方面的密码学。我们的评估表明，这些方法提高了国家的最先进的方法在这一领域，我们可以成功地从一个给定的恶意软件二进制提取密钥。
Identifying that a given binary program implements a specific cryptographic algorithm and finding out more information about the cryptographic code is an important problem. Proprietary programs and especially malicious software (so calledmalware) often use cryptography and we want to learn more about the context, e.g., which algorithms and keys are used by the program. This helps an analyst to quickly understand what a given binary program does and eases analysis.In this paper, we present several methods to identify cryptographic primitives (e.g., entire algorithms or only keys) within a given binary program in an automated way. We perform fine-grained dynamic binary analysis and use the collected information as input for several heuristics that characterize specific, unique aspects of cryptographic code. Our evaluation shows that these methods improve the state-of-the-art approaches in this area and that we can successfully extract cryptographic keys from a given malware binary.