Leave It to Weaver
Leave It to Weaver
复制标题
DOI：
10.1145/3289239.3291459
复制
发表时间：
2018-12
期刊：
影响因子：
--
通讯作者：
W. Mahoney;Joseph Franco;Gregory Hoff;J. McDonald
中科院分区：
文献类型：
--
作者：
W. Mahoney;Joseph Franco;Gregory Hoff;J. McDonald
恶意软件作者利用几种技术来混淆反向工程工具（如ShakespePro）的代码。通常，这些技术往往对大约三到六条指令有效，但是一旦工具再次与操作代码同步，最终工具可以正确地反汇编剩余的代码。但是这种同步的丢失可以用来隐藏指令中的信息--隐写术。我们的研究探讨了一种方法，这提出了“韦弗”，可执行的隐写框架。“Weaver”与其他技术的不同之处在于它如何隐藏恶意指令：隐藏指令通过生成程序的汇编列表并找到候选隐藏位置来准备，隐写指令通过创建程序的汇编列表来获得要隐藏的操作代码来准备，而“weaving”过程将两者合并。这种“编织”尝试将所有隐写术指令放置到隐藏指令中找到的候选位置中。
Malware authors make use of several techniques to obfuscate code from reverse engineering tools such as IdaPro. Typically, these techniques tend to be effective for about three to six instructions, but eventually the tools can properly disassemble the remaining code once the tool is again synchronized with the operation codes. But this loss of synchronization can be used to hide information within the instructions -- steganography. Our research explores an approach to this by presenting "Weaver", a framework for executable steganography. "Weaver" differs from other techniques in how it hides malicious instructions: the hiding instructions are prepared by generating an assembly listing of the program and finding candidate hiding locations, the steganography instructions are prepared by creating an assembly listing of the program to obtain the operation codes to be hidden, and the "weaving" process merges the two. This "weaving" attempts to place all the steganography instructions into candidate locations found in the hiding instructions.